joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f3a42
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006f38c1
Function at 0x718070
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.005c3530
mov eax, dword [esp + 0x10]
push ebx
push esi
test byte [eax + 0x10], 4
mov esi, dword [eax + 4]
lea ebx, [esi - 1]
je 0x718117
mov ecx, dword [eax + 8]
xor edx, edx
push ebp
xor ebp, ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
test ecx, ecx
jle 0x718100
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
push edi
push dword [ecx]
mov eax, ebp
xor eax, ebx
lea edi, [eax - 1]
not eax
shr edi, 0x1f
shr eax, 0x1f
and edi, eax
neg edi
mov esi, edi
or esi, dword [esp + 0x14]
call fcn.00718140
mov ecx, dword [esp + 0x18]
mov edx, esi
not edx
mov dword [esp + 0x14], esi
and edx, 0x20
and eax, edi
add edx, dword [esp + 0x24]
inc ebp
add edx, eax
add ecx, 4
add esp, 4
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ecx
cmp ebp, dword [esp + 0x18]
jl 0x7180b3
pop edi
mov eax, ebx
shr ebx, 0x1f
not eax
dec eax
shr eax, 0x1f
and eax, ebx
pop ebp
dec eax
pop esi
and eax, edx
pop ebx
add esp, 0xc
ret
test esi, esi
jne 0x718123
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [eax]
push dword [eax + esi*4 - 4]
call fcn.00718140
add esp, 4
shl esi, 5
add esi, 0xffffffe0
add eax, esi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x734db0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x734dd7
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x734dc6
pop edi
movzx eax, dl
pop esi
ret
Function at 0x81d120
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0081d130

Function at 0x81d3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0081d3c0
Function at 0x401ca1
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
cmp dword [esi + 0x90], ebx
lea edi, [esi + 0x90]
je 0x401cc9
mov eax, dword [esi + 0x94]
cmp eax, ebx
je 0x401cc7
push eax
call dword [sym.imp.WINMM.dll_timeKillEvent]
mov dword [edi], ebx
mov eax, dword [esi + 0x8c]
lea edi, [esi + 0x8c]
cmp eax, ebx
je 0x401ce1
push eax
call sub.AVIFIL32.dll_AVIStreamGetFrameClose
mov dword [edi], ebx
mov eax, dword [esi + 0x98]
cmp eax, ebx
je 0x401cf1
push eax
call sub.AVIFIL32.dll_AVIStreamRelease
mov eax, dword [esi + 0x5c]
cmp eax, ebx
je 0x401d0a
jne 0x401cfe
xor eax, eax
jmp 0x401d01
mov eax, dword [eax + 4]
push eax
push dword [esi + 0x6c]
call fcn.0041f5a9
cmp dword [esi + 0x6c], ebx
je 0x401d17
lea ecx, [esi + 0x68]
call fcn.0041f4d0
cmp dword [esi + 0x64], ebx
je 0x401d24
lea ecx, [esi + 0x60]
call fcn.0041fc4b
mov eax, dword [esi + 0x40]
add esi, 0x40
cmp dword [eax - 8], ebx
je 0x401d3d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
call fcn.0041c56c
pop edi
pop esi
pop ebx
ret

Function at 0x401ea9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 8]
push 0x42b118
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov dword [ebp - 4], eax
ja 0x401f93
lea eax, [ebp - 0x20c]
mov edi, 0x80000000
push eax
push str..htm
push edi
call fcn.00401f9b
add esp, 0xc
test eax, eax
jne 0x401f93
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x20c]
push str._shellopencommand
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00401f9b
add esp, 0xc
test eax, eax
jne 0x401f93
lea eax, [ebp - 0x20c]
push str.__1_
push eax
call fcn.0040e410
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x401f70
lea eax, [ebp - 0x20c]
push 0x42b144
push eax
call fcn.0040e410
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x401f70
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x20d]
jmp 0x401f72
mov byte [edi], bl
push 0x42b148
push edi
call esi
push dword [ebp + 8]
push edi
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401f9b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x401ff4
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x406abe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0xc]
push 0x10
mov ebp, eax
call fcn.0040e4d8
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
jne 0x406ae8
push ebx
push ebx
push 0x42b204
jmp 0x406b3e
mov eax, dword [edi]
push 0xc
push esi
mov ecx, edi
call dword [eax + 0x34]
cmp dword [esi], 0x46464952
je 0x406b0a
push ebx
push ebx
push 0x42b218
call fcn.00420611
xor edi, edi
jmp 0x406b70
cmp dword [esi + 8], 0x45564157
je 0x406b1c
push ebx
push ebx
push str.Wrong_wave_format
jmp 0x406b01
mov eax, dword [esi + 4]
add eax, 8
push eax
call fcn.0040e4d8
cmp eax, ebx
pop ecx
mov dword [esi + 0xc], eax
jne 0x406b47
push esi
call fcn.0040e490
pop ecx
push ebx
push ebx
push str.error_allocating
call fcn.00420611
xor eax, eax
jmp 0x406b79
mov eax, dword [edi]
push ebx
push ebp
mov ecx, edi
call dword [eax + 0x28]
cmp eax, ebp
jne 0x406b06
mov ecx, dword [esi + 4]
mov eax, dword [edi]
add ecx, 8
push ecx
mov ecx, edi
push dword [esi + 0xc]
call dword [eax + 0x34]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
call fcn.0040e490
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x406c6a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
push 0xfffffffffffffffe
mov ecx, dword [esi + 0x44]
pop edi
mov eax, ecx
cdq
idiv edi
mov dword [ebp - 8], eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 8], eax
jge 0x406d71
mov ecx, dword [esi + 0x40]
push 0xfffffffffffffffe
mov eax, ecx
pop edi
cdq
idiv edi
mov dword [ebp - 4], eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
jge 0x406d66
fild dword [ebp - 8]
mov eax, dword [esi + 0xb94]
fild dword [ebp - 4]
lea edi, [esi + eax*4 + 0x5f4]
lea ebx, [esi + eax*4 + 0x54]
fld st(1)
fmul dword [edi]
fld st(1)
fmul dword [ebx]
faddp st(1)
fmul dword [esi + 0xb98]
call fcn.0040e6ec
add eax, 0x10
cdq
fmul dword [edi]
idiv dword [esi + 0xbdc]
fld st(1)
fmul dword [ebx]
fsubp st(1)
fmul dword [esi + 0xb98]
mov eax, edx
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
imul ecx, dword [esi + 0xbd8]
mov dword [ebp - 0x10], ecx
call fcn.0040e6ec
add eax, 0x10
mov ecx, dword [ebp - 0x10]
cdq
idiv dword [esi + 0xbdc]
mov edi, dword [esi + 0xba4]
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add ecx, eax
mov eax, dword [esi + 0x44]
cdq
sub eax, edx
mov edx, dword [esi + 0xbe4]
sar eax, 1
add eax, dword [ebp - 8]
mov ecx, dword [edi + ecx*4]
imul eax, dword [esi + 0x40]
add eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
inc dword [ebp - 4]
mov dword [edx + eax*4], ecx
mov eax, dword [esi + 0x40]
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
jl 0x406cb7
fstp st(0)
inc dword [ebp - 8]
mov eax, dword [esi + 0x44]
jmp 0x406c85
mov ecx, dword [esi + 0xc70]
lea eax, [esi + 0xb94]
add dword [eax], ecx
mov ecx, dword [eax]
cmp ecx, 0x168
jl 0x406d8c
and dword [eax], 0
fld dword [esi + 0xb98]
fadd dword [esi + 0xb9c]
lea eax, [esi + 0xb98]
fcom dword [esi + 0xc78]
fst dword [eax]
fnstsw ax
sahf
jb 0x406dbd
fstp st(0)
fld dword [esi + 0xc7c]
fchs
fstp dword [esi + 0xb9c]
jmp 0x406dd4
fcomp qword [0x424278]
fnstsw ax
sahf
ja 0x406dd4
mov eax, dword [esi + 0xc7c]
mov dword [esi + 0xb9c], eax
cmp dword [esi + 0x4c], 0
je 0x406dfc
push dword [esi + 0xc74]
lea edi, [esi + 0xc20]
lea ebx, [esi + 0xbe0]
push edi
mov ecx, ebx
call fcn.00404925
push edi
mov ecx, ebx
call fcn.00404899
push 0x105
push 0
push 0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b6d1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x42b8a0]
push 0x105
lea ecx, [ebp - 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
call fcn.0041c8dd
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.0041c92c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0xc]
push str.AVC_X.AVI
push eax
call fcn.004181a6
add esp, 0xc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041c7c4
push eax
lea ecx, [ebp - 4]
call fcn.0041c6ce
lea ecx, [ebp - 0x10]
call fcn.0041c5e1
push 0
push dword [ebp - 4]
call fcn.0040f07f
pop ecx
test eax, eax
pop ecx
je 0x40b708
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0041c356
lea ecx, [ebp - 4]
call fcn.0041c5e1
lea ecx, [ebp - 0xc]
call fcn.0041c5e1
lea ecx, [ebp - 8]
call fcn.0041c5e1
mov eax, dword [ebp + 8]
leave
ret 4

Function at 0x40d404
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
push esi
push edi
jne 0x40d4e8
push 0x24
xor eax, eax
pop ecx
lea edi, [ebp - 0x90]
mov dword [ebp - 0x94], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp + 0xc]
push eax
push dword [0x42d2f8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x84]
dec eax
je 0x40d46d
dec eax
jne 0x40d4d3
mov esi, 0x40cf28
mov eax, 0x40d2ac
jmp 0x40d477
mov esi, 0x40ce08
mov eax, 0x40d2a8
call eax
push 0x100
push 0x4338f0
call esi
pop ecx
xor esi, esi
cmp eax, ebx
pop ecx
mov dword [0x448cf4], eax
jbe 0x40d4d3
mov ebx, 0x433900
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebx - 0x10]
je 0x40d4c4
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
call fcn.0040ed0f
pop ecx
push eax
push dword [ebp + 8]
call fcn.0040ef00
add esp, 0xc
test eax, eax
je 0x40d4da
inc esi
add ebx, 0x154
cmp esi, dword [0x448cf4]
jb 0x40d497
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
imul esi, esi, 0x154
mov eax, dword [esi + 0x4338f0]
jmp 0x40d4d5
cmp byte [ebp + 0xc], 1
jne 0x40d4d3
push 0x448cf8
push str.program_manager
push ebx
mov dword [0x448cfc], ebx
mov dword [0x448cf8], ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp + 8]
mov ecx, 0x4338e8
call fcn.0041c71e
push dword [0x42d2f8]
push 0x40d537
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x448cfc]
jmp 0x40d4d5
Function at 0x40f07f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40f09f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004106e5
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40f0c2
test byte [esp + 8], 2
je 0x40f0c2
call fcn.00410758
mov dword [eax], 0xd
call fcn.00410761
mov dword [eax], 5
jmp 0x40f09b
xor eax, eax
ret

Function at 0x4140cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x42c968
cmp edx, dword [eax]
je 0x4140ef
add eax, 8
inc ecx
cmp eax, 0x42c9f8
jl 0x4140e0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x42c968]
jne 0x41421d
mov eax, dword [0x44ad50]
cmp eax, 1
je 0x4141f7
test eax, eax
jne 0x414120
cmp dword [0x42beb4], 1
je 0x4141f7
cmp edx, 0xfc
je 0x41421d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x414157
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004127e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004123f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41419a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004123f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x426b08
push edi
call fcn.00416420
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004127e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004127f0
lea eax, [ebp - 0xa0]
push 0x426ae8
push eax
call fcn.004127f0
push dword [esi + 0x42c96c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004127f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00416b0f
add esp, 0x2c
pop edi
jmp 0x41421d
lea eax, [ebp + 8]
lea esi, [esi + 0x42c96c]
push 0
push eax
push dword [esi]
call fcn.004123f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x419d93
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x419dcb
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0041c954
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0041c92c
jmp 0x419dd7
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x41b3c6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41b408
call fcn.00421595
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41b408
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41b3ff
xor eax, eax
jmp 0x41b410
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041b416
pop edi
pop esi
pop ebx
ret 4

Function at 0x41cb9d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x41cbbf
cmp dword [edi + 0x3c], 0
jne 0x41cbbf
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00421595
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0041cbec
pop edi
pop esi
pop ebx
ret 8
Function at 0x4055ae
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.0040586c
test bl, 8
mov dword [ebp - 0xc], eax
je 0x4055ed
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7a1fc8], eax
jmp 0x405777
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405607
test eax, eax
je 0x405725
test bl, 2
je 0x405725
mov esi, 0x79f548
push edi
push esi
call fcn.00405d0c
cmp dword [ebp + 8], 0
je 0x405626
push 0x4093a4
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x40562c
push edi
call fcn.004057c5
cmp byte [edi], 0
jne 0x40563a
cmp byte [0x79f548], 0x5c
jne 0x405645
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x40571b
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.004057a9
cmp byte [eax], 0
je 0x40568b
cmp byte [ebp - 0x1c], 0
je 0x40568b
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x4056a1
mov al, byte [esi + 1]
test al, al
je 0x4056fa
cmp al, 0x2e
jne 0x4056a1
cmp byte [esi + 2], 0
je 0x4056fa
push esi
push ebx
call fcn.00405d0c
test byte [ebp - 0x14c], 0x10
je 0x4056c6
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4056fa
push dword [ebp + 0xc]
push edi
call fcn.004055ae
jmp 0x4056fa
push dword [ebp - 4]
push edi
call fcn.00405566
test eax, eax
jne 0x4056f2
cmp dword [ebp - 4], eax
je 0x4056ea
push edi
push 0xfffffffffffffff1
call fcn.00404f25
push 0
push edi
call fcn.00405bc7
jmp 0x4056fa
inc dword [0x7a1fc8]
jmp 0x4056fa
push edi
push 0xfffffffffffffff2
call fcn.00404f25
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405669
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405725
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405777
cmp dword [ebp - 0xc], esi
jne 0x405739
inc dword [0x7a1fc8]
jmp 0x405777
push edi
call fcn.00406010
test eax, eax
je 0x405777
push edi
call fcn.0040577e
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405566
test eax, eax
jne 0x40576f
cmp dword [ebp - 4], esi
je 0x405731
push edi
push 0xfffffffffffffff1
call fcn.00404f25
push esi
push edi
call fcn.00405bc7
jmp 0x405777
push edi
push 0xffffffffffffffe5
call fcn.00404f25
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0xb3e0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b3e200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb3e0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb3e0c2
add dl, dl
jne 0xb3e0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb3e134
xor eax, eax
add dl, dl
jne 0xb3e0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb3e1d5
add dl, dl
jne 0xb3e0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb3e108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb3e113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb3e11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb3e12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb3e0cd
mov eax, 1
add dl, dl
jne 0xb3e142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb3e14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb3e139
sub eax, ebx
mov ebx, 1
jne 0xb3e180
mov ecx, 1
add dl, dl
jne 0xb3e166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb3e171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb3e15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb3e0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb3e197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb3e1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb3e18e
cmp eax, 0x7d00
jae 0xb3e1c5
cmp eax, 0x500
jb 0xb3e1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb3e0cd
cmp eax, 0x7f
ja 0xb3e1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb3e0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb3e1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb3e0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xb07370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xb0738e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xb30074
push ecx
mov edi, eax
call fcn.00b1b198
mov esi, eax
add esp, 8
test esi, esi
jne 0xb073cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00b1b02e
push esi
call fcn.00b1afb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xb0a850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xb0a8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xb35720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xb0a8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00b1b1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xb0a8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xb35720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xb0a92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00b1c082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xb0a957
mov word [eax], si
add eax, 2
push eax
call fcn.00b1c030
add esp, 4
jmp 0xb0a959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xb0a8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xb0a8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xb0aff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret