joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100010b0
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10003fe1
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
and eax, 0xffff
xor ebx, ebx
cmp eax, 0x804
jne 0x100010ec
mov dword [esi + 4], 1
jmp 0x100010ef
mov dword [esi + 4], ebx
lea eax, [esi + 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x18]
lea eax, [esi + 0x24]
push edx
push str._szdlcsv.txt
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x18]
lea edx, [esi + 0x28]
push ecx
push str._szdlcsv.ds.dll
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 0x18]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov dword [esp + 0x124], ebx
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
push 0x10006034
push edx
mov byte [esp + 0x130], 1
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
push 0x5c
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x128], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x124], 1
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
lea edx, [esi + 0x20]
push ecx
push str._sRecordCSV.sdi
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov ecx, esi
call fcn.100018d0
test eax, eax
pop edi
jne 0x100011f9
mov ecx, esi
call fcn.10001c80
lea ecx, [esp + 0xc]
mov byte [esp + 0x120], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x118]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret

Function at 0x100018d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10004178
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.100039c8
mov esi, dword [esi + 0x28]
push 0
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
pop esi
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp]
jne 0x10001932
call sub.MFC42.DLL_CFileFind::CFileFind
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
call sub.MFC42.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 0x1c]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x10001c80
Capabilities:
Access peb ldr_data
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x10004262
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push esi
push edi
mov edi, ecx
call fcn.10003b83
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_AFX_MAINTAIN_STATE2::AFX_MAINTAIN_STATE2
lea ecx, [esp + 0x14]
mov dword [esp + 0x234], 0
call fcn.100039c8
mov eax, dword [edi + 0x20]
lea esi, [edi + 0x20]
push 0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x23c], 1
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x10001d8e
mov eax, dword [edi + 4]
push 0
test eax, eax
je 0x10001cf6
push 0x30
push 0x100061d0
jmp 0x10001cfd
push 0x40
push str.Fail_to_find_RecordCSV.sdi_please_select_setup_folder.
call sub.MFC42.DLL_AfxMessageBox
push 0
push str.ZTE_Record_File_.sdi___.sdi__
push 6
push 0x100060cc
push 0x100060cc
push 1
lea ecx, [esp + 0x48]
call sub.MFC42.DLL_CFileDialog::CFileDialog
lea ecx, [esp + 0x30]
mov byte [esp + 0x234], 2
call sub.MFC42.DLL_CFileDialog::DoModal
cmp eax, 1
jne 0x10001dd5
lea eax, [esp + 0x10]
lea ecx, [esp + 0x30]
push eax
call sub.MFC42.DLL_CFileDialog::GetPathName
push eax
mov ecx, esi
mov byte [esp + 0x238], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x234], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xe0]
mov byte [esp + 0x234], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x234], 1
call sub.MFC42.DLL_CDialog::CDialog
mov edi, dword [edi + 0x28]
mov esi, dword [esi]
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x14]
mov byte [esp + 0x234], 0
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
pop edi
pop esi
mov dword [eax + 4], ecx
mov eax, 1
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
add esp, 0x230
ret
lea ecx, [esp + 0xe0]
mov byte [esp + 0x234], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x234], 1
call sub.MFC42.DLL_CDialog::CDialog
lea ecx, [esp + 0x14]
mov byte [esp + 0x234], 0
call sub.MFC42.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
pop edi
xor eax, eax
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x228]
pop esi
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x10001e30
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x100042a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
lea ecx, [esp]
mov dword [esp + 0x34], 2
call fcn.10002410
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 3
call fcn.100039c8
mov eax, dword [esp + 0x3c]
push 0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 4
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x10001e8b
mov byte [esp + 0x34], 3
lea ecx, [esp + 0x10]
jmp 0x10001f02
mov ecx, dword [esp + 0x40]
push 0
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x10001eaa
mov edx, dword [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 8], esp
push eax
call sub.MFC42.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
mov byte [esp + 0x40], 5
call sub.MFC42.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov byte [esp + 0x44], 6
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 4
call fcn.10002450
test eax, eax
mov byte [esp + 0x34], 3
lea ecx, [esp + 0x10]
jne 0x10001f55
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp]
mov byte [esp + 0x34], 2
call fcn.10002440
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x44]
mov dword [esp + 0x34], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 0xc
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp]
mov byte [esp + 0x34], 2
call fcn.10002440
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x44]
mov dword [esp + 0x34], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x2c]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x38
ret 0xc
Function at 0x10001fb0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x100042f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
lea ecx, [esp]
mov dword [esp + 0x34], 2
call fcn.10002410
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 3
call fcn.100039c8
mov eax, dword [esp + 0x40]
push 0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 4
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x1000200b
mov byte [esp + 0x34], 3
lea ecx, [esp + 0x10]
jmp 0x10002082
mov ecx, dword [esp + 0x3c]
push 0
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x1000202a
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 8], esp
push eax
call sub.MFC42.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
mov byte [esp + 0x40], 5
call sub.MFC42.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov byte [esp + 0x44], 6
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 4
call fcn.100025c0
test eax, eax
mov byte [esp + 0x34], 3
lea ecx, [esp + 0x10]
jne 0x100020d5
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp]
mov byte [esp + 0x34], 2
call fcn.10002440
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x44]
mov dword [esp + 0x34], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 0xc
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp]
mov byte [esp + 0x34], 2
call fcn.10002440
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x44]
mov dword [esp + 0x34], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x2c]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x38
ret 0xc

Function at 0x10002760
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows
Terminate process
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x100043b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_2
push 0
push 0
push str.An_error_occurred_in_running_the_program.__n
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_AfxMessageBox
mov eax, dword [esp + 0x14]
push 0
push 0
push eax
call sub.MFC42.DLL_AfxMessageBox
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 4]
push str.Error_number__x._n
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0xc]
add esp, 0xc
push 0
push 0
push edx
call sub.MFC42.DLL_AfxMessageBox
push 0
push 0
push str.Program_terminating
call sub.MFC42.DLL_AfxMessageBox
push 1
call dword [sym.imp.MSVCRT.dll_exit]
Function at 0x10002ce0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10004444
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebx, [esi + 0x256]
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_2
lea ebp, [esi + 0x25a]
mov dword [esp + 0x1c], 0
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x25e]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString_2
lea edi, [esi + 0x366]
mov byte [esp + 0x1c], 2
mov ecx, edi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x36a]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x36e]
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CString::CString_2
mov ecx, esi
mov byte [esp + 0x1c], 5
mov dword [esi], 0x10005220
call fcn.10002ea0
mov ecx, esi
call fcn.10003580
push edi
mov ecx, esi
call fcn.100035f0
lea edi, [esi + 0x262]
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
push str._s_systemz32.dll
push ebx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push edi
push str._s_systemz32dll.ini
push ebp
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esi + 0x25e]
push edi
push str._s_systemz32lic.ini
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10003040
Capabilities:
Terminate process

Disassembly:
sub esp, 0x2c
xor eax, eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push eax
push eax
push 1
lea esi, [ebp + 4]
push eax
mov ecx, 6
mov edi, esi
push eax
push eax
rep stosd dword es:[edi], eax
push str..Smartvsd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
mov dword [ebp + 0x24d], eax
jne 0x1000307a
push eax
call dword [sym.imp.MSVCRT.dll_exit]
lea ecx, [ebp + 0x251]
push 0
push ecx
push 0x18
push esi
push 0
push 0
push 0x74080
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x100030bb
push eax
push eax
push str.DeviceIoControl_failed:DFP_GET_VERSION
call sub.MFC42.DLL_AfxMessageBox
mov eax, dword [ebp + 0x24d]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
test byte [ebp + 8], 1
jne 0x100030cf
push 0
push 0
push str.Error:_IDE_identify_command_not_supported.
jmp 0x10003238
mov dl, byte [ebp + 7]
mov ecx, ebp
push edx
call fcn.100034c0
mov byte [ebp + 0x255], 0
lea ebx, [ebp + 0x1c]
mov ecx, 8
xor eax, eax
mov edi, ebx
lea edx, [ebp + 0x3d]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x84
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov cl, byte [ebp + 0x255]
test cl, 1
je 0x1000310f
mov byte [ebp + 0x25], 0xb0
jmp 0x10003113
mov byte [ebp + 0x25], 0xa0
mov esi, dword [ebp + 8]
mov eax, 0x10
sar eax, cl
test esi, eax
je 0x10003134
push 0
push 0
push str.we_dont_detect_a_ATAPI_device
call sub.MFC42.DLL_AfxMessageBox
jmp 0x100031db
lea eax, [ebp + 0x251]
push 0
push eax
push 0x210
push edx
mov byte [ebp + 0x28], cl
mov ecx, dword [ebp + 0x24d]
push 0x21
push ebx
push 0x7c088
push ecx
mov byte [ebp + 0x26], 0xec
mov byte [ebp + 0x21], 1
mov byte [ebp + 0x22], 1
mov dword [ebx], 0x200
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1000322f
lea esi, [ebp + 0x83]
mov ecx, 0xa
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
push 0x28
push edx
mov ecx, ebp
mov byte [esp + 0x40], 0
call fcn.10003490
mov ecx, dword [ebp + 0x7f]
mov eax, dword [ebp + 0x7b]
lea edx, [esp + 0x10]
mov dword [esp + 0x14], ecx
push 8
push edx
mov ecx, ebp
mov dword [esp + 0x18], eax
mov byte [esp + 0x20], 0
call fcn.10003490
lea esi, [ebp + 0x61]
mov ecx, 5
lea edi, [esp + 0x10]
lea eax, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
push 0x14
push eax
mov ecx, ebp
mov byte [esp + 0x2c], 0
call fcn.10003490
mov cl, byte [ebp + 0x255]
inc cl
mov al, cl
mov byte [ebp + 0x255], cl
cmp al, 4
jb 0x100030e4
mov edx, dword [ebp + 0x24d]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
lea esi, [ebp + 0x36e]
push eax
push 0x10006034
push esi
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov ecx, esi
call sub.MFC42.DLL_CString::TrimLeft
mov ecx, esi
call sub.MFC42.DLL_CString::TrimRight
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0
push 0
push str.DeviceIoControl_failed:DFP_RECEIVE_DRIVE_DATA
call sub.MFC42.DLL_AfxMessageBox
mov ecx, dword [ebp + 0x24d]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x743370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x74338e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x76c074
push ecx
mov edi, eax
call fcn.00757198
mov esi, eax
add esp, 8
test esi, esi
jne 0x7433cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0075702e
push esi
call fcn.00756fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x746850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x7468ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x771720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x7468ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.007571e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x7468ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x771720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x74692a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00758082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x746957
mov word [eax], si
add eax, 2
push eax
call fcn.00758030
add esp, 4
jmp 0x746959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x7468ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x7468b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x746ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x747080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x7470c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x76c458
push ecx
call fcn.007571e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.007571e1
add esp, 0x10
jmp 0x7470d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0075720b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00756dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00747050
mov eax, dword [0x771728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x74713b
push esi
call fcn.00746fb0
add esp, 4
mov dword [0x771728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x74714c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00746ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x74a440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x74a4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x74a48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x74a471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x74a47e
add edx, ecx
cmp ebx, edx
jb 0x74a48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x74a467
xor ecx, ecx
jmp 0x74a4a2
test eax, eax
jne 0x74a492
xor ecx, ecx
jmp 0x74a4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.0074a3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x74a8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x74a921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x74a946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x74a96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x74a993
push ecx
push esi
call fcn.0074a4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x74bc00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x74bc4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x74bc2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0x74bc38
add edx, eax
cmp ebx, edx
jb 0x74bc46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0x74bc21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0x74bc50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0x74bc70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x74bcb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x74bc9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x74bca8
add edx, ecx
cmp ebx, edx
jb 0x74bcb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x74bc91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x74bf60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.00758145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x74bffb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x74bfdd
lea eax, [esp + 0x18]
push eax
jmp 0x74bfe2
push 0x771720
call fcn.00757fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x74bfb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x74bf40
push 4
push ecx
push eax
call fcn.0075843f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret