joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10cc0bf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x111121c]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [edi*4 + 2]
push eax
mov word [ebp - 0x24], 0x30
mov word [ebp - 0x22], 0x31
mov word [ebp - 0x20], 0x32
mov word [ebp - 0x1e], 0x33
mov word [ebp - 0x1c], 0x34
mov word [ebp - 0x1a], 0x35
mov word [ebp - 0x18], 0x36
mov word [ebp - 0x16], 0x37
mov word [ebp - 0x14], 0x38
mov word [ebp - 0x12], 0x39
mov word [ebp - 0x10], 0x61
mov word [ebp - 0xe], 0x62
mov word [ebp - 0xc], 0x63
mov word [ebp - 0xa], 0x64
mov word [ebp - 8], 0x65
mov word [ebp - 6], 0x66
call fcn.0105f04e
pop ecx
mov ecx, eax
test ecx, ecx
mov dword [ebp - 0x28], ecx
je 0x10cc185
push esi
xor esi, esi
test edi, edi
jle 0x10cc180
push ebx
mov eax, dword [ebp + 8]
add eax, esi
movzx edx, byte [eax]
shr edx, 4
mov dx, word [ebp + edx*2 - 0x24]
mov word [ecx], dx
movzx eax, byte [eax]
cdq
push 0x10
pop ebx
idiv ebx
inc ecx
inc ecx
mov ax, word [ebp + edx*2 - 0x24]
mov word [ecx], ax
inc ecx
inc ecx
inc esi
cmp esi, edi
jl 0x10cc152
pop ebx
and word [ecx], 0
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
pop edi
call fcn.0105eca9
leave
ret 8

Function at 0x10db912
Capabilities:
Enumerate pe sections

Disassembly:
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x10db94c
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x10db945
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x10db951
add edx, 0x28
cmp edx, esi
jne 0x10db936
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x10db94e

Function at 0x10f5f9c
Capabilities:
Encode data using xor

Disassembly:
inc edx
inc eax
dec eax
lea ecx, [esp + 0x20]
dec ecx
mov esi, ecx
call 0x112c4f0
xor ebx, ebx
dec eax
test ebp, ebp
je 0x10f604d
dec eax
mov edi, dword [esp + 0xc8]
dec esp
mov esp, dword [esp + 0xc0]
dec eax
test edi, edi
je 0x10f5fdc
test bl, bl
jne 0x10f5fdc
dec eax
mov eax, dword [edi]
dec eax
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
jne 0x10f604f
dec ecx
mov eax, dword [esp]
dec ecx
mov ecx, esp
call dword [eax + 0x18]
dec ebp
mov ebx, dword [esp]
inc ebp
mov eax, ebp
dec ecx
mov edx, esi
dec ecx
mov ecx, esp
inc ecx
call dword [ebx + 0x20]
dec ebp
mov ebx, dword [esp]
dec eax
lea edx, [esp + 0x20]
dec ecx
mov ecx, esp
inc ecx
call dword [ebx + 0x28]
dec ebp
mov ebx, dword [esp]
dec ecx
mov ecx, esp
inc ecx
call dword [ebx + 0x30]
cmp eax, 0x40
ja 0x10f605e
xor ecx, ecx
test eax, eax
je 0x10f6038
inc esp
lea eax, [eax - 1]
dec eax
lea edx, [esp + 0x20]
inc ecx
shr eax, 2
inc ecx
inc eax
xor ecx, dword [edx]
dec eax
add edx, 4
dec ecx
dec eax
jne 0x10f602d
dec eax
test esi, esi
je 0x10f6041
cmp ecx, dword [esi]
jne 0x10f605e
dec eax
inc ebx
dec eax
cmp ebx, ebp
jb 0x10f5fc6
xor eax, eax
dec eax
add esp, 0x60
inc ecx
pop esi
inc ecx
pop ebp
inc ecx
pop esp
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, 1
jmp 0x10f604f
Function at 0x10f6068
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x10f61fb
mov eax, edx
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
inc ecx
add ecx, eax
inc ecx
xor ecx, eax
dec eax
dec eax
jne 0x10f6072
mov eax, ecx
ret
Function at 0x10f6290
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xor edx, edx
dec esp
mov ebx, ecx
dec ecx
cmp edx, edx
jbe 0x10f62d8
inc ebp
mov ecx, dword [eax]
inc ecx
mov ecx, dword [eax + 4]
inc ecx
movzx eax, cx
inc ecx
shr ecx, 0x10
imul eax, eax, 0x9069
inc ecx
add eax, ecx
inc ecx
mov dword [eax], eax
movzx eax, cx
shr ecx, 0x10
imul eax, eax, 0x4650
add eax, ecx
inc ecx
mov dword [eax + 4], eax
inc ecx
xor al, byte [eax + 8]
inc ebx
mov byte [edx + ebx], al
dec ecx
inc edx
dec esp
cmp edx, edx
jb 0x10f629b
dec ecx
mov ecx, ebx
jmp fcn.010f6250

Function at 0x10f70a8
Capabilities:
Encode data using xor

Disassembly:
dec eax
push ebx
push ebp
push esi
push edi
inc ecx
push esp
inc ecx
push ebp
inc ecx
push esi
inc ecx
push edi
dec eax
mov ebp, dword [ecx + 8]
dec esp
mov ebp, dword [ecx]
inc ebp
xor ecx, ecx
dec eax
test ebp, ebp
inc ebp
lea esp, [ecx + 1]
inc ebp
mov esi, eax
inc esp
mov edi, edx
mov ebx, 0x159a55e5
mov edi, 0x1f123bb5
inc ebp
mov edx, esp
inc ebp
mov ebx, esp
je 0x10f7258
movzx ecx, bx
shr ebx, 0x10
imul ecx, ecx, 0x9069
add ebx, ecx
movzx ecx, di
shr edi, 0x10
mov edx, ebx
shl edx, 0x10
imul ecx, ecx, 0x4650
add edi, ecx
add edx, edi
inc ecx
xor edx, esi
mov eax, edx
shr edx, 1
inc ecx
and eax, esp
je 0x10f7245
inc ecx
cmp ecx, 0x400
jb 0x10f7245
mov ecx, edx
shr edx, 2
inc ebp
mov eax, esp
and ecx, 3
inc ecx
inc ecx
shl eax, cl
inc ebp
sub eax, esp
inc esp
and eax, edx
shr edx, cl
mov eax, edx
inc ecx
inc eax
shr edx, 3
and eax, 7
je 0x10f7211
mov ecx, edx
shr edx, 2
inc ecx
mov eax, esp
and ecx, 3
inc ecx
shl eax, cl
inc ecx
sub eax, esp
and eax, edx
shr edx, cl
inc esp
add eax, eax
jmp 0x10f7169
inc ebp
add ebx, esp
inc ecx
mov ecx, ebx
inc ecx
mov eax, esp
shl eax, cl
inc ecx
cmp eax, ecx
jb 0x10f7166
inc ebp
cmp edi, ebx
mov ecx, 5
inc ecx
mov esi, edi
inc ecx
cmova esi, ebx
lea eax, [ecx - 1]
cmp esi, 0x15
cmovbe ecx, eax
inc ecx
mov eax, esp
shl eax, cl
movzx ecx, bx
shr ebx, 0x10
inc esp
lea edx, [eax - 1]
inc esp
and edx, edx
movzx edx, di
shr edi, 0x10
imul ecx, ecx, 0x9069
add ebx, ecx
inc ecx
add edx, 6
imul edx, edx, 0x4650
add edi, edx
mov edx, ebx
shl edx, 0x10
add edx, edi
inc ecx
xor edx, esi
inc esp
cmp edx, esi
ja 0x10f7193
inc ecx
mov ecx, edx
inc ecx
mov edx, 1
inc ecx
shl edx, cl
inc ecx
dec edx
inc esp
and edx, edx
inc ebp
cmp edx, ecx
jb 0x10f7208
movzx ecx, bx
shr ebx, 0x10
imul ecx, ecx, 0x9069
add ebx, ecx
movzx ecx, di
shr edi, 0x10
mov edx, ebx
imul ecx, ecx, 0x4650
add edi, ecx
shl edx, 0x10
add edx, edi
inc ecx
xor edx, esi
jmp 0x10f7193
inc ecx
mov esp, 1
inc ebp
add edx, esp
mov eax, ebp
inc ecx
mov ecx, ecx
inc ecx
sub eax, ecx
inc esp
cmp eax, eax
inc esp
cmova eax, eax
dec ecx
add ecx, ebp
inc ecx
mov eax, edx
dec eax
mov edx, ecx
inc ebp
add ecx, eax
dec eax
sub edx, eax
inc ebp
test eax, eax
je 0x10f724c
mov al, byte [edx]
dec ecx
add edx, esp
mov byte [ecx], al
dec ecx
add ecx, esp
dec ebp
sub eax, esp
jne 0x10f7234
jmp 0x10f724c
inc ebx
mov byte [ecx + ebp], dl
inc ebp
add ecx, esp
inc ecx
mov eax, ecx
dec eax
cmp eax, ebp
jb 0x10f70e2
inc ecx
pop edi
inc ecx
pop esi
inc ecx
pop ebp
inc ecx
pop esp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x702e70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x1e8000]
lea eax, [edi + 0x2df460]
push dword [eax]
mov dword [eax], 0xa1fffffe
push eax
push edi
or ebp, 0xffffffff
jmp 0x702ea2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x702ea9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x702e98
mov eax, 1
add ebx, ebx
jne 0x702ebb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x702ecc
jne 0x702eeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x702eeb
dec eax
add ebx, ebx
jne 0x702ed8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x702eb0
add ebx, ebx
jne 0x702ee7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x702f3d
xor ecx, ecx
sub eax, 3
jb 0x702f03
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x702f72
sar eax, 1
mov ebp, eax
jmp 0x702f0e
add ebx, ebx
jne 0x702f0e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x702edc
inc ecx
add ebx, ebx
jne 0x702f1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x702edc
add ebx, ebx
jne 0x702f29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x702f1e
jne 0x702f3a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x702f1e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x702f5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x702f4e
jmp 0x702e9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x702f5c
add edi, ecx
jmp 0x702e9e
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x107c9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x702f7e
cmp byte [edi], 0x2a
jne 0x702f7e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x702f83
lea edi, [esi + 0x2f5000]
mov eax, dword [edi]
or eax, eax
je 0x702ffb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3031e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3033dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x702fb0
mov ecx, edi
jns 0x702fdf
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3033e4]
or eax, eax
je 0x702ff5
mov dword [ebx], eax
add ebx, 4
jmp 0x702fcd
call dword [esi + 0x3033e0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x70302c
cmp al, 0xef
ja 0x70301f
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x703001
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x70300e
mov ebp, dword [esi + 0x3033e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x703060
sub esp, 0xffffff80
jmp 0x5b9683
Function at 0x405321
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004055c0
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x405355
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42f0a8], eax
jmp 0x4054da
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405373
test eax, eax
je 0x40548b
test byte [ebp + 0xc], 2
je 0x40548b
mov esi, 0x42b4a0
push edi
push esi
call fcn.004059d3
test ebx, ebx
je 0x405390
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405396
push edi
call fcn.00405527
push 0x40900c
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x405481
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.0040550b
cmp byte [eax], 0
je 0x4053e7
cmp byte [ebp - 0x18], 0
je 0x4053e7
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4053fd
mov al, byte [esi + 1]
test al, al
je 0x405460
cmp al, 0x2e
jne 0x4053fd
cmp byte [esi + 2], 0
je 0x405460
push esi
push ebx
call fcn.004059d3
mov eax, dword [ebp - 0x148]
test al, 0x10
je 0x405423
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405460
push dword [ebp + 0xc]
push edi
call fcn.00405321
jmp 0x405460
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405458
test byte [ebp + 0xc], 4
je 0x405450
push edi
push 0xfffffffffffffff1
call fcn.00404d82
push 0
push edi
call fcn.0040571b
jmp 0x405460
inc dword [0x42f0a8]
jmp 0x405460
push edi
push 0xfffffffffffffff2
call fcn.00404d82
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053c5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x40548b
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4054da
cmp dword [ebp - 8], esi
jne 0x4054a0
inc dword [0x42f0a8]
jmp 0x4054da
push edi
call fcn.00405ca8
test eax, eax
je 0x4054da
push edi
call fcn.004054e0
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054d2
test byte [ebp + 0xc], 4
je 0x405498
push edi
push 0xfffffffffffffff1
call fcn.00404d82
push esi
push edi
call fcn.0040571b
jmp 0x4054da
push edi
push 0xffffffffffffffe5
call fcn.00404d82
pop edi
pop esi
leave
ret 8
Function at 0xc62370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xc6238e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xc8b074
push ecx
mov edi, eax
call fcn.00c76198
mov esi, eax
add esp, 8
test esi, esi
jne 0xc623cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00c7602e
push esi
call fcn.00c75fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xc65850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xc658ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xc90720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xc658ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00c761e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xc658ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xc90720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xc6592a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00c77082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xc65957
mov word [eax], si
add eax, 2
push eax
call fcn.00c77030
add esp, 4
jmp 0xc65959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xc658ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xc658b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xc65ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xc66080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0xc660c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xc8b458
push ecx
call fcn.00c761e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00c761e1
add esp, 0x10
jmp 0xc660d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00c7620b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00c75dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00c66050
mov eax, dword [0xc90728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0xc6613b
push esi
call fcn.00c65fb0
add esp, 4
mov dword [0xc90728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0xc6614c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00c65ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0xc69440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0xc694b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xc6948e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xc69471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xc6947e
add edx, ecx
cmp ebx, edx
jb 0xc6948a
inc edi
add eax, 0x28
cmp edi, esi
jb 0xc69467
xor ecx, ecx
jmp 0xc694a2
test eax, eax
jne 0xc69492
xor ecx, ecx
jmp 0xc694a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.00c693c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0xc698f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0xc69921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0xc69946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0xc6996e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0xc69993
push ecx
push esi
call fcn.00c694c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0xc6ac00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0xc6ac4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0xc6ac2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0xc6ac38
add edx, eax
cmp ebx, edx
jb 0xc6ac46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0xc6ac21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0xc6ac50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0xc6ac70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xc6acb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xc6ac9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xc6aca8
add edx, ecx
cmp ebx, edx
jb 0xc6acb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0xc6ac91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0xc6af60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.00c77145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0xc6affb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0xc6afdd
lea eax, [esp + 0x18]
push eax
jmp 0xc6afe2
push 0xc90720
call fcn.00c76fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0xc6afb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0xc6af40
push 4
push ecx
push eax
call fcn.00c7743f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret