joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52ea7f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x57a0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x4a5fa4
mov dword [edi], 0x553254
mov dword [edi + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
lea esi, [edi + 4]
push 0
push esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0040b390
mov eax, dword [edi]
mov dword [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [ebp + 8], esi
lea eax, [ecx - 0x68]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.0040ac10
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x48], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x3d], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x583fa4]
mov dword [esi + 0x40], eax
mov eax, dword [0x583fa8]
mov dword [esi + 0x44], eax
mov eax, edi
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4b79b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5307a4
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x57a0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.004b7f00
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0xffffffff
mov dword [edi + 0x14], 0xffff
mov word [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
lea esi, [edi + 0x34]
mov byte [ebp - 4], 3
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004b7ed0
mov dword [esi], eax
push dword [ebp + 8]
lea ecx, [edi + 0x3c]
mov byte [ebp - 4], 4
call fcn.004b9a60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c3e90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x24]
lea eax, [esp + 8]
push edi
push 1
push 4
push eax
mov esi, ecx
mov dword [esp + 0x18], 0
call fcn.0050c35c
mov eax, dword [esp + 0x18]
add esp, 0x10
cmp eax, 0x950412de
jne 0x4c3ec6
mov byte [esi + 0x24], 1
jmp 0x4c3ed5
cmp eax, 0xde120495
jne 0x4c3fc7
mov byte [esi + 0x24], 0
push ebx
push 2
push 0
push edi
call fcn.00508ed0
push edi
call fcn.0051599c
mov ebx, eax
add esp, 0x10
test ebx, ebx
js 0x4c3f39
push ebp
push 0
push 0
push edi
call fcn.00508ed0
add esp, 0xc
mov byte [esp + 0x2c], 0
lea eax, [esp + 0x2c]
lea ecx, [esi + 0x18]
push eax
lea eax, [ebx + 1]
push eax
call fcn.004c43b0
push edi
push ebx
push 1
push dword [esi + 0x18]
call fcn.0050c35c
add esp, 0x10
cmp eax, ebx
jne 0x4c3f80
mov eax, dword [esi + 0x18]
pop ebp
mov dword [esi + 0x14], ebx
pop ebx
pop edi
mov dword [esi + 0x10], eax
pop esi
add esp, 0x18
ret 4
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], vtable.std::exception.0
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], str.Wrong_file_object
xorps xmm0, xmm0
mov byte [esp + 0x18], 1
push eax
movq qword [esp + 0x24], xmm0
call fcn.004f6a34
add esp, 8
mov dword [esp + 0x18], vtable.std::runtime_error.0
lea eax, [esp + 0x18]
push 0x577b1c
push eax
call fcn.004f83e3
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], vtable.std::exception.0
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], str.Failed_to_read_file
xorps xmm0, xmm0
mov byte [esp + 0x1c], 1
push eax
movq qword [esp + 0x28], xmm0
call fcn.004f6a34
add esp, 8
mov dword [esp + 0x1c], vtable.std::runtime_error.0
lea eax, [esp + 0x1c]
push 0x577b1c
push eax
call fcn.004f83e3
lea eax, [esp + 0x18]
mov dword [esp + 0x14], vtable.std::exception.0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], str.Invalid_file_format
xorps xmm0, xmm0
mov byte [esp + 0x14], 1
push eax
movq qword [esp + 0x20], xmm0
call fcn.004f6a34
add esp, 8
mov dword [esp + 0x14], vtable.std::runtime_error.0
lea eax, [esp + 0x14]
push 0x577b1c
push eax
call fcn.004f83e3
int3

Function at 0x4d1730
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533570
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x57a0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
lea ecx, [ebp - 0x70]
call fcn.004025b0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [esi + 4], eax
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.0047c398
add esp, 4
lea ecx, [ebp - 0x70]
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
call fcn.004026a0
mov dword [esi], vtable.std::codecvt_byname_wchar_t__char__struct__Mbstatet_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4d21f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533698
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x57a0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 8]
lea ecx, [esi + 0x60]
mov dword [esi], vtable.boost::locale::util::gregorian_calendar.0
push 0xffffffffffffffff
push 0
mov eax, dword [edx + 4]
mov dword [esi + 4], eax
mov eax, dword [edx + 8]
mov dword [esi + 8], eax
mov eax, dword [edx + 0xc]
mov dword [esi + 0xc], eax
movups xmm0, xmmword [edx + 0x10]
mov dword [ebp - 4], 0
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [edx + 0x20]
movups xmmword [esi + 0x20], xmm0
mov eax, dword [edx + 0x30]
mov dword [esi + 0x30], eax
movups xmm0, xmmword [edx + 0x34]
movups xmmword [esi + 0x34], xmm0
movups xmm0, xmmword [edx + 0x44]
movups xmmword [esi + 0x44], xmm0
mov eax, dword [edx + 0x54]
mov dword [esi + 0x54], eax
movzx eax, byte [edx + 0x58]
mov byte [esi + 0x58], al
movzx eax, byte [edx + 0x59]
mov byte [esi + 0x59], al
mov eax, dword [edx + 0x5c]
mov dword [esi + 0x5c], eax
lea eax, [edx + 0x60]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00409bb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4d2ab0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52b1d8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x57a0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x5c]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cdq
add eax, edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
adc edx, ebx
cmp byte [esi + 0x59], 0
mov dword [ebp - 0x2c], edx
push eax
je 0x4d2b02
call fcn.00504ad7
jmp 0x4d2b07
call fcn.0050c6b6
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x4d2b79
push 0x35
push str.boost::locale::gregorian_calendar:_invalid_time_point
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00409ab0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 4], 0
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x3c], vtable.std::exception.0
push eax
movq qword [ebp - 0x38], xmm0
mov byte [ebp - 0x40], 1
call fcn.004f6a34
add esp, 8
mov dword [ebp - 0x3c], vtable.boost::locale::date_time_error.0
lea eax, [ebp - 0x3c]
push 0x573f74
push eax
call fcn.004f83e3
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [esi + 0x20], xmm0
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x30], eax
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x34], xmm0
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [esi + 0x44], xmm0
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x54], eax
mov byte [esi + 0x58], 1
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004927a4
mov esp, ebp
pop ebp
ret 8
Function at 0x4d3a00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533864
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x57a0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x54616c
mov dword [ebp - 0x38], 0
call fcn.0050d756
add esp, 4
test eax, eax
je 0x4d3a4a
cmp byte [eax], 0
jne 0x4d3a57
push str.LC_ALL
call fcn.0050d756
add esp, 4
test eax, eax
je 0x4d3a60
cmp byte [eax], 0
jne 0x4d3a6d
push str.LANG
call fcn.0050d756
add esp, 4
test eax, eax
je 0x4d3a83
cmp byte [eax], 0
je 0x4d3a83
push eax
mov ecx, esi
call fcn.00408500
jmp 0x4d3bff
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x1c]
push 0xa
push eax
push 0x59
push 0x400
call edi
test eax, eax
jne 0x4d3abb
push 1
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], eax
push 0x54067c
mov byte [esi], al
call fcn.00409ab0
jmp 0x4d3bff
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
jne 0x4d3ad7
xor ecx, ecx
jmp 0x4d3ae9
lea ecx, [ebp - 0x1c]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d3ae0
sub ecx, edx
push ecx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x34]
call fcn.00409ab0
push 0xa
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
push 0x5a
push 0x400
call edi
test eax, eax
je 0x4d3b46
push 1
push 0x5455b0
lea ecx, [ebp - 0x34]
call fcn.00409d90
cmp byte [ebp - 0x1c], 0
jne 0x4d3b29
xor ecx, ecx
jmp 0x4d3b39
lea ecx, [ebp - 0x1c]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d3b30
sub ecx, edx
push ecx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x34]
call fcn.00409d90
cmp byte [ebp + 0xc], 0
jne 0x4d3ba8
push 0xa
lea eax, [ebp - 0x1c]
push eax
push 0x1004
push 0x400
call edi
test eax, eax
je 0x4d3b99
lea eax, [ebp - 0x1c]
push eax
call fcn.00504463
add esp, 4
lea ecx, [ebp - 0x34]
test eax, eax
jne 0x4d3b81
push str..UTF_8
call fcn.004083c0
jmp 0x4d3bb7
push str..windows_
call fcn.004083c0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x34]
call fcn.004083c0
jmp 0x4d3bb7
push 0x545584
lea ecx, [ebp - 0x34]
call fcn.004083c0
jmp 0x4d3bb7
push 6
push str..UTF_8
lea ecx, [ebp - 0x34]
call fcn.00409d90
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 0x10
mov byte [ebp - 4], 1
jb 0x4d3bd3
mov eax, dword [esi]
jmp 0x4d3bd5
mov eax, esi
mov byte [eax], 0
mov ecx, esi
lea eax, [ebp - 0x34]
push eax
call fcn.00409fc0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 2
cmp eax, 0x10
jb 0x4d3bff
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.0040a240
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004927a4
mov esp, ebp
pop ebp
ret
Function at 0x4e26a0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub ecx, edx
push ebx
inc ecx
xor ebx, ebx
push esi
shr ecx, 1
xor esi, esi
push edi
xor edi, edi
cmp edx, dword [esp + 0x14]
cmova ecx, ebx
test ecx, ecx
je 0x4e26e9
movzx eax, word [edx]
lea edx, [edx + 2]
imul eax, eax, 0xcc9e2d51
inc edi
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
cmp edi, ecx
jne 0x4e26c1
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4f4f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
mov eax, dword [0x57a0ec]
xor eax, esp
mov dword [esp + 0xf0], eax
mov dword [esp], 0x55364c
mov dword [esp + 4], 0x547b30
mov dword [esp + 8], 0x556eec
mov dword [esp + 0xc], 0x547b34
mov dword [esp + 0x10], 0x547b38
mov dword [esp + 0x14], 0x5532f8
mov dword [esp + 0x18], 0x539424
mov dword [esp + 0x1c], 0x53da34
mov dword [esp + 0x20], 0x547b3c
mov dword [esp + 0x24], 0x5532c4
mov dword [esp + 0x28], 0x5532d4
mov dword [esp + 0x2c], 0x547b40
mov dword [esp + 0x30], 0x53cbe8
mov dword [esp + 0x34], 0x547b44
mov dword [esp + 0x38], 0x552fb4
mov dword [esp + 0x3c], 0x547b48
mov dword [esp + 0x40], 0x547b4c
mov dword [esp + 0x44], 0x547b50
mov dword [esp + 0x48], 0x547768
mov dword [esp + 0x4c], 0x54776c
mov dword [esp + 0x50], 0x547b5c
mov dword [esp + 0x54], 0x547b60
mov dword [esp + 0x58], 0x55364c
mov dword [esp + 0x5c], 0x55364c
mov dword [esp + 0x60], 0x547b64
mov dword [esp + 0x64], 0x547b68
mov dword [esp + 0x68], 0x553878
mov dword [esp + 0x6c], 0x53feb4
mov dword [esp + 0x70], 0x53ef6c
mov dword [esp + 0x74], 0x547770
mov dword [esp + 0x78], 0x547774
mov dword [esp + 0x7c], 0x541318
mov dword [esp + 0x80], 0x547778
mov dword [esp + 0x84], 0x54777c
mov dword [esp + 0x88], 0x547780
mov dword [esp + 0x8c], 0x547784
mov dword [esp + 0x90], 0x538b20
mov dword [esp + 0x94], 0x540500
mov dword [esp + 0x98], 0x547788
mov dword [esp + 0x9c], 0x55364c
mov dword [esp + 0xa0], 0x55364c
mov dword [esp + 0xa4], 0x55364c
mov dword [esp + 0xa8], 0x55364c
mov dword [esp + 0xac], 0x55364c
mov dword [esp + 0xb0], 0x55364c
mov dword [esp + 0xb4], 0x55364c
mov dword [esp + 0xb8], 0x55364c
mov dword [esp + 0xbc], 0x54778c
mov dword [esp + 0xc0], 0x547790
mov dword [esp + 0xc4], 0x547794
mov dword [esp + 0xc8], 0x54067c
mov dword [esp + 0xcc], 0x547798
mov dword [esp + 0xd0], 0x54779c
mov dword [esp + 0xd4], 0x53cc88
mov dword [esp + 0xd8], 0x5477a0
mov dword [esp + 0xdc], 0x5477a4
mov dword [esp + 0xe0], 0x5477a8
mov dword [esp + 0xe4], 0x547b6c
mov dword [esp + 0xe8], 0x5477ac
mov dword [esp + 0xec], 0x5477b0
cmp cl, 0x3c
jb 0x4f51e6
mov eax, 0x55364c
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.004927a4
add esp, 0xf4
ret
movzx eax, cl
mov ecx, dword [esp + 0xf0]
xor ecx, esp
mov eax, dword [esp + eax*4]
call fcn.004927a4
add esp, 0xf4
ret
Function at 0x4f5210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x9c
mov eax, dword [0x57a0ec]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, 0x361
mov dword [esp], 0x3610300
mov dword [esp + 4], 0x4860483
lea eax, [esp + 2]
mov dword [esp + 8], 0x9030903
mov dword [esp + 0xc], 0x940093e
mov dword [esp + 0x10], 0x94c0949
mov dword [esp + 0x14], 0x9830982
mov dword [esp + 0x18], 0x9c009be
mov dword [esp + 0x1c], 0x9cc09c7
mov dword [esp + 0x20], 0x9d709d7
mov dword [esp + 0x24], 0xa400a3e
mov dword [esp + 0x28], 0xa830a83
mov dword [esp + 0x2c], 0xac00abe
mov dword [esp + 0x30], 0xacc0ac9
mov dword [esp + 0x34], 0xb030b02
mov dword [esp + 0x38], 0xb3e0b3e
mov dword [esp + 0x3c], 0xb400b40
mov dword [esp + 0x40], 0xb4c0b47
mov dword [esp + 0x44], 0xb570b57
mov dword [esp + 0x48], 0xb830b83
mov dword [esp + 0x4c], 0xbbf0bbe
mov dword [esp + 0x50], 0xbcc0bc1
mov dword [esp + 0x54], 0xbd70bd7
mov dword [esp + 0x58], 0xc030c01
mov dword [esp + 0x5c], 0xc440c41
mov dword [esp + 0x60], 0xc830c82
mov dword [esp + 0x64], 0xcbe0cbe
mov dword [esp + 0x68], 0xcc40cc0
mov dword [esp + 0x6c], 0xccb0cc7
mov dword [esp + 0x70], 0xcd60cd5
mov dword [esp + 0x74], 0xd030d02
mov dword [esp + 0x78], 0xd400d3e
mov dword [esp + 0x7c], 0xd4c0d46
mov dword [esp + 0x80], 0xd570d57
mov dword [esp + 0x84], 0xf7f0f7f
mov dword [esp + 0x88], 0x20e120d0
mov dword [esp + 0x8c], 0x309a3099
mov dword [esp + 0x90], 0xfe23fe20
mov dword [esp + 0x94], 0xffffffff
cmp dx, cx
jae 0x4f537b
add eax, 4
cmp word [eax], cx
jb 0x4f5373
sub eax, 2
cmp cx, word [eax]
jb 0x4f53a0
cmp cx, word [eax + 2]
ja 0x4f53a0
mov al, 1
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.004927a4
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
xor al, al
xor ecx, esp
call fcn.004927a4
add esp, 0x9c
ret

Function at 0x519322
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005191a1

Function at 0x51e7f7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051e4b7
Function at 0xbb3370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xbb338e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xbdc074
push ecx
mov edi, eax
call fcn.00bc7198
mov esi, eax
add esp, 8
test esi, esi
jne 0xbb33cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00bc702e
push esi
call fcn.00bc6fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xbb6850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xbb68ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xbe1720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xbb68ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00bc71e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xbb68ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xbe1720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xbb692a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00bc8082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xbb6957
mov word [eax], si
add eax, 2
push eax
call fcn.00bc8030
add esp, 4
jmp 0xbb6959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xbb68ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xbb68b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xbb6ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xbb7080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0xbb70c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xbdc458
push ecx
call fcn.00bc71e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00bc71e1
add esp, 0x10
jmp 0xbb70d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00bc720b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00bc6dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00bb7050
mov eax, dword [0xbe1728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0xbb713b
push esi
call fcn.00bb6fb0
add esp, 4
mov dword [0xbe1728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0xbb714c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00bb6ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0xbba440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0xbba4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xbba48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xbba471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xbba47e
add edx, ecx
cmp ebx, edx
jb 0xbba48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0xbba467
xor ecx, ecx
jmp 0xbba4a2
test eax, eax
jne 0xbba492
xor ecx, ecx
jmp 0xbba4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.00bba3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0xbba8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0xbba921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0xbba946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0xbba96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0xbba993
push ecx
push esi
call fcn.00bba4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret