joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ce6c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4427a4]
cmp dword [eax + 0x24], 0
je 0x43cefc
cmp dword [ebx + 0x7c], 0
jne 0x43cef9
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x43ce00
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x78]
cmp dword [eax + 8], 0
je 0x43cef9
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x43cec8
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x78]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x43cef9
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x78]
call fcn.0040cce8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x43ced4
inc dword [ebx + 0x7c]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x43d84c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x8c], 0
je 0x43d881
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403978
jmp 0x43d88b
mov eax, esi
mov edx, dword [ebx + 0x74]
call fcn.0040392c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x43e748
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x43e780
mov eax, esi
call fcn.004280a0
test al, al
je 0x43e780
mov eax, dword [ebx + 0x6c]
call fcn.00427c78
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43e780
push 0
mov eax, dword [ebx + 0x6c]
call fcn.00427c78
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x440a04
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403cc4
mov eax, dword [ebp - 8]
call fcn.00403cc4
mov eax, dword [ebp - 0xc]
call fcn.00403cc4
xor eax, eax
push ebp
push 0x440ad3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x440aec
call fcn.00403b18
lea eax, [ebp - 8]
mov edx, 0x440aec
call fcn.00403b18
lea eax, [ebp - 0xc]
mov edx, 0x440aec
call fcn.00403b18
mov bl, 1
push 1
lea eax, [ebp - 0xc]
call fcn.00403ce0
push eax
lea eax, [ebp - 8]
call fcn.00403ce0
push eax
lea eax, [ebp - 4]
call fcn.00403ce0
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jae 0x440ab8
xor ebx, ebx
push 0
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x440af8
call fcn.00403b5c
mov eax, dword [ebp - 0x10]
mov cx, word [0x440b18]
mov dl, 1
call fcn.00440494
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440ada
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004038b8
ret
Function at 0x2580f5a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x2580f5b8
pop dword [ebp - 0x1c]
mov eax, 0x4106133c
add eax, 0xe47ae27c
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x91be95b3
sub dword [ebp - 0x2c], 0x436c5068
mov dword [ebp - 0x28], 0xd0bc070d
add dword [ebp - 0x28], 0x61774538
mov dword [ebp - 0x24], 0x7f13b76d
sub dword [ebp - 0x24], 0x32c7733f
mov dword [ebp - 0x20], 0x1a74c19b
sub dword [ebp - 0x20], 0x1a74c19b
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x65af815a
add eax, 0xbfd24eea
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xd2b777aa
add dword [ebp - 0x2c], 0xa1baf1ac
mov dword [ebp - 0x28], 0x44228bbc
add dword [ebp - 0x28], 0xfd49d5b9
mov dword [ebp - 0x24], 0xf87328be
sub dword [ebp - 0x24], 0x9503bc52
mov dword [ebp - 0x20], 0xdabda003
add dword [ebp - 0x20], 0x25425ffd
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x31058fee
add eax, 0xf47c4092
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e3ac
push 0
call eax
mov ecx, 0xfa6b26a2
add ecx, 0x59526ea
mov edx, eax
mov esi, 0xc79a47d8
add esi, 0x5de84e28
add esi, dword [ebp - 0x1c]
mov ebx, 0x5bda63f9
add ebx, 0xf119892a
mov edi, dword [esi]
mov dword [ebp - 4], 0xa67fa873
sub edi, ebx
sub dword [ebp - 0x10], edx
mov dword [edx], edi
xor dword [ebp - 0x10], ecx
add edx, 0xef02d4ac
add edx, 0x10fd2b58
add esi, 0x4dbccc9d
sub esi, 0x4dbccc99
loop 0x2580f6da
add eax, 0x12903
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x57d7e24
add ecx, 0x200281dc
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x65b025d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x65b0262b
cmp byte [esi + ebx - 1], 0xa
je 0x65b025ff
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x65b04128], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x65b033b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x4c
mov dword [ecx], 0
test byte [0x65b0401c], 8
jne 0x65b034e8
cmp word [ebx], 0
je 0x65b03534
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x65b033e0
sub eax, ebx
sar eax, 1
inc eax
test edx, edx
je 0x65b0340f
cmp word [edx], 0
je 0x65b0340f
mov ecx, edx
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x65b03400
sub ecx, edx
sar ecx, 1
add eax, ecx
add eax, eax
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x2c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x2c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x65b03488
xor eax, eax
lea esi, [esi]
movzx ecx, word [ebx + eax]
mov word [edi + eax], cx
add eax, 2
test cx, cx
jne 0x65b03448
test edx, edx
je 0x65b03488
cmp word [edi], 0
mov ecx, edi
je 0x65b03471
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x65b03468
xor eax, eax
lea esi, [esi]
nop
movzx ebx, word [edx + eax]
mov word [ecx + eax], bx
add eax, 2
test bx, bx
jne 0x65b03478
lea eax, [ebp - 0x24]
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 1
call sym._OpenPrinterW_12
sub esp, 0xc
mov ebx, eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edx
mov dword [ebp - 0x2c], edx
call sym._wine_dbgstr_wn.constprop.0
mov edi, eax
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__s__n
mov dword [esp + 8], str.open_monitor_by_name
mov dword [esp + 4], 0x65b0401c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
cmp word [ebx], 0
mov edx, dword [ebp - 0x2c]
jne 0x65b033da
mov eax, 1
jmp 0x65b033ee
Function at 0x1000fc73
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000fc82
pop dword [ebp - 0x40]
mov eax, 0x56bff16b
add eax, 0xb9410b17
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x38430
push 0
mov eax, 0xf9292d93
sub eax, 0xe9291cb7
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x41ce
xor esi, esi
add esi, eax
mov edi, 0x4cc59d5
sub edi, 0xf4ca4bd5
add edi, dword [ebp - 0x40]
mov edx, 0x96b84a29
mov dword [ebp - 0x3c], 0x41b50a2e
mov ebx, dword [edi]
add dword [ebp - 0x28], 0xcaffab74
add ebx, edx
xor dword [ebp - 0x2c], 0x20820065
mov dword [esi], ebx
add dword [ebp - 0x38], 0x32e3a50b
add esi, 0xe7097487
sub esi, 0xe7097483
add edi, 0xff8029
add edi, 0xff007fdb
loop 0x1000fcd7
add eax, 0xfa0b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1001253d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x10017eee
call fcn.10016a84
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x10012711
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.1000fc73
add esp, 0xc
test eax, eax
js 0x1001270b
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x100125d9
push esi
call fcn.10006e31
pop ecx
test al, al
je 0x100125d9
mov eax, esi
call fcn.10016c03
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x100125e5
push esi
lea ecx, [ebp - 0x428]
call fcn.1000fc73
push 3
push esi
push edi
push eax
call fcn.1000fc73
test eax, eax
je 0x1001270b
push 2
push ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x41c], edi
test edi, edi
jne 0x10012619
call fcn.10006faf
mov esi, eax
jmp 0x100126f0
push dword [ebp - 0x424]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x1001263c
call fcn.10006faf
jmp 0x100126e7
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x10012632
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x420], esi
cmp eax, esi
jae 0x1001266c
mov esi, 0x8007000e
jmp 0x100126e9
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000fc73
mov dword [ebp - 4], 1
jmp 0x100126ab
cmp dword [ebp - 0x418], 0
je 0x10012665
push esi
push dword [ebp - 0x424]
push esi
push dword [ebp - 0x418]
call fcn.1000fc73
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.1000fc73
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1001272b
lea ecx, [ebp - 0x418]
call fcn.100127c3
jmp 0x1001272b
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x10012726
lea ecx, [ebp - 0x418]
call fcn.100127c3
mov esi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.10006f60
mov eax, esi
lea esp, [ebp - 0x444]
call fcn.10016add
ret 0x10

Function at 0x10015c99
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003c50]
jne fcn.10016c44
ret
Function at 0x401130
Capabilities:
Delete directory
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
push 0
push 0x13
push 4
push 0x15
push 0
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
jmp 0x401199
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x143
jge 0x4011ad
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x401190
cmp dword [ebp - 4], 0
jbe 0x4011fc
push 0x40
jmp 0x4e21fc
mov eax, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402881
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x417890
cmp edx, dword [eax]
je 0x4028a3
add eax, 8
inc ecx
cmp eax, 0x417920
jl 0x402894
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x417890]
jne 0x4029d1
mov eax, dword [0x4db144]
cmp eax, 1
je 0x4029ab
test eax, eax
jne 0x4028d4
cmp dword [0x4177e4], 1
je 0x4029ab
cmp edx, 0xfc
je 0x4029d1
jmp 0x4e2ce6
lea eax, [ebp + 8]
lea esi, [esi + 0x417894]
push 0
push eax
push dword [esi]
call fcn.00403a70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10001240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000124f
pop dword [ebp - 0x40]
mov eax, 0xf3718afb
sub eax, 0xe37178ac
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x332fe01a
sub dword [ebp - 0x50], 0xe4dd9acf
mov dword [ebp - 0x4c], 0x25e986a1
sub dword [ebp - 0x4c], 0xf3b63a5c
mov dword [ebp - 0x48], 0x8bc1b5b7
add dword [ebp - 0x48], 0xc08a8e77
mov dword [ebp - 0x44], 0x9258a42a
add dword [ebp - 0x44], 0x6da75bd6
lea eax, [ebp - 0x50]
push eax
mov eax, 0xd8ce28d6
sub eax, 0xc8cc3896
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xd56d40b0
add dword [ebp - 0x50], 0x9f0528a6
mov dword [ebp - 0x4c], 0x9593917c
add dword [ebp - 0x4c], 0xabd8cff9
mov dword [ebp - 0x48], 0xb331b62b
add dword [ebp - 0x48], 0xb03db641
mov dword [ebp - 0x44], 0x60f51ffe
add dword [ebp - 0x44], 0x9f0ae002
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x1f2fb7ed
sub eax, 0xf2dc7a9
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3a85f
push 0
call eax
mov ecx, 0x8f7d397a
sub ecx, 0x8f7ceb0f
mov edx, eax
mov edi, 0x31600789
sub edi, 0x215d1589
add edi, dword [ebp - 0x40]
mov esi, 0xb925fb0f
add esi, 0x52d08c66
xor dword [ebp - 0x3c], edx
mov ebx, dword [edi]
mov dword [ebp - 0x28], 0x6f4b6794
xor ebx, esi
add dword [ebp - 0x2c], 0x58834d5d
mov dword [edx], ebx
xor dword [ebp - 0x24], 0x4301ae21
add edx, 0x4272f6ab
add edx, 0xbd8d0959
add edi, 0x9c6cb416
sub edi, 0x9c6cb412
loop 0x10001371
add eax, 0x12c7f
mov ebx, eax
add eax, 5
mov ecx, 0x16145ead
sub ecx, 0x6145ead
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x10001de8
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [edx + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x10001e01
push dword [esp + 8]
push dword [esp + 8]
push edx
call ecx
add esp, 0xc
ret
push dword [eax + 0x38]
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
ret
Function at 0x10005305
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x10005333
push esi
call fcn.10009b3e
cmp dword [esi + 0x40], 0
pop ecx
je 0x1000532c
xor eax, eax
mov dword [esi + 0x14], 0xcf
inc eax
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x100053a3
mov eax, dword [esi + 0x1b4]
cmp dword [eax + 0x10], 0
je 0x10005395
mov eax, dword [esi + 8]
test eax, eax
je 0x10005354
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1b4]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x10005391
cmp eax, 2
je 0x10005395
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10005349
cmp eax, 3
je 0x10005378
cmp eax, 1
jne 0x10005349
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x10005349
mov ecx, dword [esi + 0x140]
add dword [eax + 8], ecx
jmp 0x10005349
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
jmp 0x100053c1
cmp eax, 0xcc
je 0x100053c1
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.100051d0
pop esi
ret

Function at 0x1001c020
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x1001c08f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.10001240
pop ecx
pop edi
pop esi
ret

Function at 0x1001e4ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029008]
jne 0x1001e4f4
repz ret
jmp fcn.1001ea43
Function at 0x638370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x63838e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x661074
push ecx
mov edi, eax
call fcn.0064c198
mov esi, eax
add esp, 8
test esi, esi
jne 0x6383cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0064c02e
push esi
call fcn.0064bfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x63b850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x63b8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x666720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x63b8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0064c1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x63b8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x666720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x63b92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0064d082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x63b957
mov word [eax], si
add eax, 2
push eax
call fcn.0064d030
add esp, 4
jmp 0x63b959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x63b8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x63b8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x63bff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x63c080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x63c0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x661458
push ecx
call fcn.0064c1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.0064c1e1
add esp, 0x10
jmp 0x63c0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0064c20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.0064bdff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0063c050
mov eax, dword [0x666728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x63c13b
push esi
call fcn.0063bfb0
add esp, 4
mov dword [0x666728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x63c14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.0063bff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x63f440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x63f4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x63f48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x63f471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x63f47e
add edx, ecx
cmp ebx, edx
jb 0x63f48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x63f467
xor ecx, ecx
jmp 0x63f4a2
test eax, eax
jne 0x63f492
xor ecx, ecx
jmp 0x63f4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.0063f3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x63f8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x63f921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x63f946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x63f96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x63f993
push ecx
push esi
call fcn.0063f4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret