joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4110e7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x416188]
push edi
jae 0x4112bc
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x4161a0]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x4112bc
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x411192
test dl, 2
jne 0x411192
test dl, 0x48
je 0x41115c
cmp byte [eax + 5], 0xa
je 0x41115c
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4111a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x41118d
mov dword [0x414c64], ecx
jmp 0x4112c3
cmp eax, 0x6d
jne 0x411199
xor eax, eax
jmp 0x4112d0
push eax
call fcn.0040fc6e
pop ecx
jmp 0x4112cd
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x4112b7
test eax, eax
je 0x4111cc
cmp byte [ebx], 0xa
jne 0x4111cc
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x4111d5
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x4112b1
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x4112a1
cmp al, 0xd
je 0x411207
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x411293
dec ecx
cmp dword [ebp - 8], ecx
jae 0x411221
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x41121c
add dword [ebp - 8], 2
jmp 0x411275
mov dword [ebp - 8], eax
jmp 0x41128f
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411249
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41128f
cmp dword [ebp - 0x10], 0
je 0x41128f
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x41126a
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x411275
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x411292
cmp ebx, dword [ebp + 0xc]
jne 0x41127a
cmp byte [ebp - 1], 0xa
jne 0x41127a
mov byte [ebx], 0xa
jmp 0x411292
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040f979
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x411293
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x4111eb
jmp 0x4112b1
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x4112b1
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x4112d0
and dword [0x414c64], 0
mov dword [0x414c60], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x62e81ccc
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jle 0x62e81a05
push ebp
push edi
push esi
push ebx
sub esp, 0x100
mov dword [esp + 0x80], 0xedb88320
lea ebx, [esp + 0x84]
lea edi, [esp + 0x100]
mov esi, 1
mov dword [ebx], esi
shl esi, 1
add ebx, 4
cmp ebx, edi
jne 0x62e818e8
xor ebp, ebp
lea esi, [esi]
mov ebx, dword [esp + ebp*4 + 0x80]
xor edi, edi
test ebx, ebx
je 0x62e8191a
lea esi, [esp + 0x80]
test bl, 1
je 0x62e81913
xor edi, dword [esi]
add esi, 4
shr ebx, 1
jne 0x62e8190c
mov dword [esp + ebp*4], edi
inc ebp
cmp ebp, 0x20
jne 0x62e818f8
xor bp, bp
nop
mov ebx, dword [esp + ebp*4]
xor edi, edi
test ebx, ebx
je 0x62e81942
mov esi, esp
nop
test bl, 1
je 0x62e8193b
xor edi, dword [esi]
add esi, 4
shr ebx, 1
jne 0x62e81934
mov dword [esp + ebp*4 + 0x80], edi
inc ebp
cmp ebp, 0x20
jne 0x62e81928
xor ebp, ebp
lea esi, [esi]
mov ebx, dword [esp + ebp*4 + 0x80]
xor edi, edi
test ebx, ebx
je 0x62e81976
lea esi, [esp + 0x80]
test bl, 1
je 0x62e8196f
xor edi, dword [esi]
add esi, 4
shr ebx, 1
jne 0x62e81968
mov dword [esp + ebp*4], edi
inc ebp
cmp ebp, 0x20
jne 0x62e81954
test cl, 1
je 0x62e8199b
test eax, eax
je 0x62e8199b
xor esi, esi
mov ebx, esp
test al, 1
je 0x62e81992
xor esi, dword [ebx]
add ebx, 4
shr eax, 1
jne 0x62e8198c
mov eax, esi
mov ebp, ecx
sar ebp, 1
je 0x62e819f9
xor edi, edi
nop
mov ecx, dword [esp + edi*4]
xor esi, esi
test ecx, ecx
je 0x62e819be
mov ebx, esp
nop
test cl, 1
je 0x62e819b7
xor esi, dword [ebx]
add ebx, 4
shr ecx, 1
jne 0x62e819b0
mov dword [esp + edi*4 + 0x80], esi
inc edi
cmp edi, 0x20
jne 0x62e819a4
test ebp, 1
je 0x62e819ef
test eax, eax
je 0x62e819ef
xor ebx, ebx
lea ecx, [esp + 0x80]
test al, 1
je 0x62e819e6
xor ebx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x62e819e0
mov eax, ebx
mov ecx, ebp
sar ecx, 1
jne 0x62e8194f
xor eax, edx
add esp, 0x100
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
jmp 0x62e818b8

Function at 0x62e81ce0
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
jmp 0x62e818b8
Function at 0x62e8334c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x62e834cc
mov esi, dword [ebx + 0x1c]
test esi, esi
je 0x62e834cc
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x62e834cc
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x62e834cc
mov dword [ebx + 0x14], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x2c], 2
mov dword [esi + 0x14], 0
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x18]
cmp eax, 0
jl 0x62e83494
jne 0x62e83499
mov dword [esi + 4], 0x71
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sym.zlib1.dll_adler32
mov dword [ebx + 0x30], eax
mov dword [esi + 0x28], 0
mov dword [esp], esi
call fcn.62e8dee4
mov edx, dword [ebx + 0x1c]
mov eax, dword [edx + 0x2c]
shl eax, 1
mov dword [edx + 0x3c], eax
mov ebx, dword [edx + 0x44]
mov eax, dword [edx + 0x4c]
mov word [ebx + eax*2 - 2], 0
lea ecx, [eax + eax - 2]
xor eax, eax
mov edi, ebx
rep stosb byte es:[edi], al
mov eax, dword [edx + 0x84]
lea ecx, [eax + eax*2]
shl ecx, 2
lea eax, [ecx + 0x62e980e0]
movzx ebx, word [ecx + 0x62e980e2]
mov dword [edx + 0x80], ebx
movzx ecx, word [ecx + 0x62e980e0]
mov dword [edx + 0x8c], ecx
movzx ecx, word [eax + 4]
mov dword [edx + 0x90], ecx
movzx eax, word [eax + 6]
mov dword [edx + 0x7c], eax
mov dword [edx + 0x6c], 0
mov dword [edx + 0x5c], 0
mov dword [edx + 0x74], 0
mov dword [edx + 0x16b4], 0
mov dword [edx + 0x78], 2
mov dword [edx + 0x60], 2
mov dword [edx + 0x68], 0
mov dword [edx + 0x48], 0
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
neg eax
mov dword [esi + 0x18], eax
mov dword [esi + 4], 0x2a
cmp eax, 2
jne 0x62e833c1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sym.zlib1.dll_crc32
jmp 0x62e833dd
mov eax, 0xfffffffe
jmp 0x62e8348b
Function at 0x62e85d24
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, eax
mov edi, dword [eax + 0x58]
test edi, edi
je 0x62e85e0c
mov edx, dword [eax + 0x20]
mov eax, dword [eax + 0x54]
mov esi, edi
shr esi, 2
lea ebp, [esi*4]
lea ecx, [edx + 4]
cmp eax, ecx
setae byte [esp + 0x1f]
lea ecx, [eax + 4]
cmp edx, ecx
setae cl
or byte [esp + 0x1f], cl
cmp edi, 9
seta cl
and byte [esp + 0x1f], cl
mov ecx, edx
or ecx, eax
and ecx, 3
sete cl
test byte [esp + 0x1f], cl
je 0x62e85e3a
test ebp, ebp
je 0x62e85e3a
xor ecx, ecx
mov dword [esp + 0x18], ebx
mov ebx, dword [eax + ecx*4]
mov dword [edx + ecx*4], ebx
inc ecx
cmp esi, ecx
ja 0x62e85d8c
mov ebx, dword [esp + 0x18]
add edx, ebp
add eax, ebp
mov ecx, edi
sub ecx, ebp
cmp edi, ebp
je 0x62e85db8
add ecx, edx
mov esi, ebx
nop
mov bl, byte [eax]
mov byte [edx], bl
inc edx
inc eax
cmp edx, ecx
jne 0x62e85dac
mov ebx, esi
mov ebp, dword [ebx + 0x58]
mov edi, dword [ebx + 0x18]
sub edi, ebp
add ebp, dword [ebx + 0x20]
xor esi, esi
jmp 0x62e85dce
add esi, eax
cmp edi, esi
jbe 0x62e85df7
mov eax, edi
sub eax, esi
mov dword [esp + 8], eax
lea eax, [ebp + esi]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp eax, 0
jg 0x62e85dc8
jne 0x62e85e10
mov dword [ebx + 0x34], 1
add dword [ebx + 0x58], esi
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x54], eax
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebp, ebp
jmp 0x62e85dbb
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 8], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call fcn.62e85c34
mov eax, 0xffffffff
jmp 0x62e85e02
mov ecx, edi
jmp 0x62e85da7
Function at 0x62e86020
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, 0x7fffffff
mov dword [ebp - 8], eax
lock dec dword [ebp - 8]
sub eax, 1
jne 0x62e8602e
cmp dword [ebp - 8], eax
jne 0x62e86199
mov eax, dword fs:[0x30]
push ebx
push esi
xor esi, esi
mov edx, dword [eax + 0xc]
add edx, 0xc
push edi
mov edi, esi
mov ecx, dword [edx]
cmp ecx, edx
je 0x62e860a0
mov ebx, dword [ecx + 0x30]
mov edi, 0x78f1e5bf
mov dword [ebp - 0xc], ecx
movzx eax, word [ebx]
test ax, ax
je 0x62e86095
mov esi, eax
movzx eax, si
lea ebx, [ebx + 2]
xor eax, edi
imul edi, eax, 0x5bd1e995
mov eax, edi
shr eax, 0xf
xor edi, eax
movzx eax, word [ebx]
mov esi, eax
test ax, ax
jne 0x62e8606e
cmp edi, 0x66b65ce9
je 0x62e8609b
mov ecx, dword [ecx]
cmp ecx, edx
jne 0x62e86059
mov edi, dword [ebp - 0xc]
xor esi, esi
mov ecx, dword [edi + 0x18]
mov dword [ebp - 0xc], esi
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
add eax, ecx
mov ebx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
add ebx, ecx
mov edi, dword [eax + 0x24]
add edx, ecx
mov eax, dword [eax + 0x18]
add edi, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x62e8611c
mov edx, dword [ebx]
mov eax, 0x78f1e5bf
add edx, ecx
mov dword [ebp - 4], eax
mov al, byte [edx]
test al, al
je 0x62e86107
mov esi, dword [ebp - 4]
movsx eax, al
xor eax, esi
imul esi, eax, 0x5bd1e995
mov eax, esi
shr eax, 0xf
xor esi, eax
inc edx
mov al, byte [edx]
test al, al
jne 0x62e860e0
mov dword [ebp - 4], esi
xor esi, esi
cmp dword [ebp - 4], 0x64098594
je 0x62e86128
mov eax, dword [ebp - 0xc]
add ebx, 4
add edi, 2
inc eax
mov dword [ebp - 0xc], eax
movzx eax, ax
cmp eax, dword [ebp - 0x18]
jb 0x62e860cb
mov edi, esi
mov eax, dword [ebp + 4]
mov ecx, 0x584b2542
jmp 0x62e86136
movzx eax, word [edi]
mov edi, dword [ebp - 0x1c]
mov edi, dword [edi + eax*4]
add edi, ecx
jmp 0x62e8611e
inc eax
cmp dword [eax], ecx
jne 0x62e86135
lea ebx, [eax + 4]
mov dword [ebp - 0x10], 0x1a13f
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], ebx
push eax
push 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 0xffffffffffffffff
call edi
mov dword [ebp - 0x14], 0xc2e7e415
mov eax, esi
and eax, 3
mov al, byte [ebp + eax - 0x14]
xor byte [esi + ebx], al
inc esi
cmp esi, 0x1a13f
jb 0x62e86160
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], ebx
push eax
push 0x20
lea eax, [ebp - 0x10]
push eax
invalid
inc ebp
Function at 0x62e8ee70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], 0x62e9a644
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x62e8eed0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x62e8efc6
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x62e8ef40
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x62e8ef15
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sub.msvcrt.dll_memcpy
cmp byte [esp + 0x1f], 0
je 0x62e8ef25
cmp byte [esp + 0x1e], 0
je 0x62e8ef25
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x62e8ef25
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.62e8ee70
nop

Function at 0x62e8f260
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x62e9e040
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x62e9e058]
sub esp, 4
test ebx, ebx
je 0x62e8f2ab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x62e8f2a4
test esi, esi
je 0x62e8f2a4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x62e8f280
mov dword [esp], 0x62e9e040
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x1002df19
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002df58
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002df58
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002df58
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1002df58
cmp dword [ecx + 0x74], 0xe
jbe 0x1002df58
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1002ed30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002ed5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002ed5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1002f080
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10039618
push 0x10039610
push str.FlsAlloc
push 0x1f
call fcn.1002f363
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002f0b4
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1002f0ba
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002f0fe
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10039628
push 0x10039620
push str.FlsGetValue
push 0x21
call fcn.1002f363
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002f135
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002f13d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10039630
push 0x10039628
push str.FlsSetValue
push 0x22
call fcn.1002f363
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002f177
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10032423
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100324c0
push ebx
push esi
call fcn.100324c3
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10032327
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1003246d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100324bf
push edi
push eax
call fcn.10032734
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1003248d
call fcn.10030630
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100324be
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10032327
add esp, 0x20
test eax, eax
jne 0x100324ac
push edi
call fcn.10030630
jmp 0x100324b4
push ebx
call fcn.10030630
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0xc53370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xc5338e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xc7c074
push ecx
mov edi, eax
call fcn.00c67198
mov esi, eax
add esp, 8
test esi, esi
jne 0xc533cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00c6702e
push esi
call fcn.00c66fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xc56850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xc568ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xc81720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xc568ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00c671e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xc568ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xc81720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xc5692a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00c68082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xc56957
mov word [eax], si
add eax, 2
push eax
call fcn.00c68030
add esp, 4
jmp 0xc56959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xc568ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xc568b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xc56ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xc57080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0xc570c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xc7c458
push ecx
call fcn.00c671e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00c671e1
add esp, 0x10
jmp 0xc570d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00c6720b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00c66dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00c57050
mov eax, dword [0xc81728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0xc5713b
push esi
call fcn.00c56fb0
add esp, 4
mov dword [0xc81728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0xc5714c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00c56ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0xc5a440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0xc5a4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xc5a48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xc5a471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xc5a47e
add edx, ecx
cmp ebx, edx
jb 0xc5a48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0xc5a467
xor ecx, ecx
jmp 0xc5a4a2
test eax, eax
jne 0xc5a492
xor ecx, ecx
jmp 0xc5a4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.00c5a3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0xc5a8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0xc5a921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0xc5a946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0xc5a96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0xc5a993
push ecx
push esi
call fcn.00c5a4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret