joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a59f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x61c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100a6a6
push ebx
push esi
push edi
push 0x1001474
lea eax, [ebp - 0x61c]
push eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01002618
push edi
push edi
push 2
lea eax, [ebp - 0x20c]
push eax
call fcn.0100219b
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push esi
lea eax, [ebp - 0x414]
push eax
push 0x2db
push dword [0x101100c]
call ebx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01002618
push edi
push edi
push 2
lea eax, [ebp - 0x20c]
push eax
call fcn.0100219b
push esi
lea eax, [ebp - 0x414]
push eax
push 0x2dd
push dword [0x101100c]
call ebx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01002618
push edi
push edi
push 2
lea eax, [ebp - 0x20c]
push eax
call fcn.0100219b
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100305d
leave
ret 4

Function at 0x100a78d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0x10]
jl 0x100a7d4
push esi
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100a7d4
push 1
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.0100219b
cmp dword [ebp + 0xc], 0
jl 0x100a7fc
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x100a7f3
test esi, esi
je 0x100a7f3
call fcn.01002ca8
test al, al
je 0x100a7fc
push esi
push dword [ebp + 0xc]
call fcn.010020fd
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100305d
leave
ret 0xc
Function at 0x100a810
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 2
pop ebx
push ebx
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x100a912
push esi
call fcn.01002c4e
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.0100a6ce
push esi
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100a871
push 1
push esi
push 3
lea eax, [ebp - 0x20c]
push eax
call fcn.0100219b
push esi
push 1
push 0
call fcn.0100a78d
test esi, esi
jne 0x100a8e2
push esi
push ebx
lea eax, [ebp - 0x214]
push eax
push ebx
mov dword [ebp - 0x214], 0x10
mov dword [ebp - 0x210], 0x19
call fcn.0100a537
push 0x17
pop esi
push 1
push ebx
lea eax, [ebp - 0x214]
push eax
push ebx
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], 6
call fcn.0100a537
push 1
push 1
lea eax, [ebp - 0x210]
push eax
push 4
mov dword [ebp - 0x210], esi
call fcn.0100a537
call fcn.0100a6ba
push 0x1003d80
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
call fcn.010099b9
pop esi
test al, al
jne 0x100a907
call fcn.01009c03
call fcn.01009016
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0100305d
leave
ret 4
Function at 0x100b96e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push 2
push edi
push edi
push edi
push 0x1003df0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x100b9f5
push dword [ebp + 0xc]
push 0x1003dc8
push edi
push dword [ebp - 4]
call fcn.0100e813
mov esi, eax
cmp esi, edi
jl 0x100b9ea
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push edi
push 0x1003de0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
jne 0x100b9dc
xor esi, esi
jmp 0x100b9ea
jle 0x100b9e8
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100ba03
jle 0x100ba01
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x100c2af
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, 0x200
push esi
lea ecx, [ebp - 0x404]
push ecx
push eax
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, esi
jae 0x100c382
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x458]
push esi
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x458], edi
xor eax, eax
lea edi, [ebp - 0x414]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x458]
push eax
push esi
push esi
push 0x8000020
push esi
push esi
push esi
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100c37a
push 0x2bf20
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
je 0x100c360
cmp eax, 0x102
je 0x100c360
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100c362
xor edi, edi
push dword [ebp - 0x414]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x410]
call esi
jmp 0x100c382
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0100305d
leave
ret 4
Function at 0x100d10b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x218]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1003e90
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d245
push edi
push 4
pop edi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
mov esi, 0x100d260
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100d238
push esi
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp dword [ebp - 0x21c], edi
jne 0x100d238
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d0aa
xor ecx, ecx
cmp dword [ebp - 0x214], eax
sete cl
mov dword [ebp - 0x210], ecx
test ecx, ecx
je 0x100d238
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
mov esi, 0x1003e78
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100d238
push esi
push dword [ebp - 0x224]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp dword [ebp - 0x21c], edi
jne 0x100d238
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d0aa
xor ecx, ecx
cmp dword [ebp - 0x214], eax
sete cl
mov dword [ebp - 0x210], ecx
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100305d
leave
ret 4

Function at 0x100d27d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10113f4], 0xffffffff
jne 0x100d2ef
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x100d310
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d2ef
and dword [0x10113f4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x100d2f8
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100d2e6
mov eax, 0x600
cmp word [ebp - 0xc], ax
sbb eax, eax
inc eax
mov dword [0x10113f4], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10113f4]
leave
ret
Function at 0x100d3d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push 0x1003e90
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d472
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0x100d490
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100d466
test esi, esi
je 0x100d466
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100d367
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp word [ebp - 0x20c], ax
pop esi
setne al
xor ecx, ebp
call fcn.0100305d
leave
ret 8

Function at 0x100d4af
Capabilities:
Check if file exists
Get file attributes
Read .ini file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x41c], eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
call fcn.0100d3d8
test eax, eax
je 0x100d594
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d10b
test eax, eax
je 0x100d594
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d3d8
test eax, eax
je 0x100d594
push ebx
push 0x1003e78
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100e70e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x418], eax
push 0x80
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
push 0x10014cc
push dword [ebp - 0x41c]
push 0x100d5a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
cmp dword [ebp - 0x418], 0xffffffff
je 0x100d593
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0100305d
leave
ret 4
Function at 0x100d5bd
Capabilities:
Check os version
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10113f8], 2
jne 0x100d677
and dword [0x10113f8], 0
lea eax, [ebp - 0x320]
push eax
mov dword [ebp - 0x320], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x310], 2
jne 0x100d677
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100d676
push 0x100d688
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100e70e
cmp dword [ebp - 0x31c], 5
jae 0x100d66c
call fcn.0100d27d
test eax, eax
jne 0x100d66c
push 0x7550005
push 0x50083
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d070
test eax, eax
je 0x100d676
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4af
test eax, eax
jne 0x100d676
mov dword [0x10113f8], 1
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [0x10113f8]
xor ecx, ebp
call fcn.0100305d
leave
ret

Function at 0x100d6a5
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
and dword [edi], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x100d756
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x100d756
push eax
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100d74d
xor ebx, ebx
lea eax, [ebp + 0x10]
push eax
cmp dword [ebp + 0x14], ebx
je 0x100d725
lea eax, [ebp - 8]
push eax
push 0x10014c8
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100d74d
cmp dword [ebp + 0x10], ebx
je 0x100d74d
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
jmp 0x100d74b
lea eax, [ebp - 0xc]
push eax
push 0x100d760
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100d74d
cmp dword [ebp + 0x10], ebx
je 0x100d74d
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
mov dword [edi], ecx
movzx eax, word [eax + 2]
mov dword [esi], eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100ea3b
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x1011464], edi
jne 0x100eb57
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x100eaa2
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x1011464], edi
pop esi
je 0x100eb2a
dec eax
jne 0x100eb57
cmp dword [ebp - 0x11c], 5
jne 0x100eb17
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x100eb0b
dec eax
je 0x100eaf8
dec eax
je 0x100eade
mov dword [0x1011464], 0x14
jmp 0x100eb57
cmp word [ebp - 0xc], 1
jb 0x100eaef
mov dword [0x1011464], 0x10
or dword [0x1011464], 4
jmp 0x100eb57
cmp word [ebp - 0xc], 2
jb 0x100eaef
mov dword [0x1011464], 8
jmp 0x100eaef
mov dword [0x1011464], 4
jmp 0x100eb57
cmp dword [ebp - 0x11c], 4
ja 0x100eb69
mov dword [0x1011464], 2
cmp dword [ebp - 0x11c], 4
jne 0x100eb57
cmp dword [ebp - 0x118], edi
je 0x100eb4d
cmp dword [ebp - 0x118], 0xa
je 0x100eb4d
cmp dword [ebp - 0x118], 0x5a
jne 0x100eb57
mov dword [0x1011464], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x1011464]
xor ecx, ebp
pop edi
call fcn.0100305d
leave
ret
mov dword [0x1011464], 0x20
jmp 0x100eb57

Function at 0x100eb7a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100ebce
push 3
lea eax, [ebp - 0x44]
push 0x100ebe0
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.0100305d
leave
ret
Function at 0x100ebeb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x1011468]
jne 0x100ec86
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x100ed78
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ec85
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x100ee30
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x100ec85
push 3
push dword [esi*8 + 0x100ec98]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x100ec77
inc esi
cmp esi, 0x1c
jae 0x100ec85
jmp 0x100ec56
mov ax, word [esi*8 + 0x100ec9c]
mov word [0x1011468], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x1011468]
xor ecx, ebp
call fcn.0100305d
leave
ret
Function at 0x6e4370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x6e438e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x70d074
push ecx
mov edi, eax
call fcn.006f8198
mov esi, eax
add esp, 8
test esi, esi
jne 0x6e43cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.006f802e
push esi
call fcn.006f7fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x6e7850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x6e78ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x712720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x6e78ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.006f81e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x6e78ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x712720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x6e792a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.006f9082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x6e7957
mov word [eax], si
add eax, 2
push eax
call fcn.006f9030
add esp, 4
jmp 0x6e7959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x6e78ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x6e78b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x6e7ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x6e8080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x6e80c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x70d458
push ecx
call fcn.006f81e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.006f81e1
add esp, 0x10
jmp 0x6e80d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.006f820b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.006f7dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.006e8050
mov eax, dword [0x712728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x6e813b
push esi
call fcn.006e7fb0
add esp, 4
mov dword [0x712728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x6e814c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.006e7ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x6eb440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x6eb4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x6eb48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x6eb471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6eb47e
add edx, ecx
cmp ebx, edx
jb 0x6eb48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x6eb467
xor ecx, ecx
jmp 0x6eb4a2
test eax, eax
jne 0x6eb492
xor ecx, ecx
jmp 0x6eb4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.006eb3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x6eb8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x6eb921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x6eb946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x6eb96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x6eb993
push ecx
push esi
call fcn.006eb4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret