joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10061594
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x100615b5
jl 0x100615ac
test edi, edi
jne 0x100615b5
xor eax, eax
xor edx, edx
jmp 0x10061676
cmp dword [ebx + 0x38], 0
je 0x100615ca
push eax
push edi
push dword [ebp + 8]
call fcn.10022ee0
jmp 0x10061676
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10061611
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x10061611
cmp eax, edi
jb 0x100615eb
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.10064c00
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x10061617
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x1006166b
mov ecx, ebx
call fcn.10060eff
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x10061656
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.10072053
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x1006166b
jmp 0x10061629
test edx, edx
je 0x1006166b
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.10072053
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x1007438d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x10090084]
test eax, eax
je 0x100743cc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100743cc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100743cc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100743cc
cmp dword [ecx + 0x74], 0xe
jbe 0x100743cc
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10086dd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10086dfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10086dfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100e221f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cld
pushal
push esp
mov word [esp], bx
rep movsb byte es:[edi], byte [esi]
pushfd
adc di, si
call fcn.100e1709
jmp 0x100e1c8e
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x4011c6
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call fcn.0040114f
call section..text
movzx eax, al
cmp eax, 1
jne 0x4011e9
push 5
pop eax
jmp 0x4013b8
and dword [ebp - 0x40], 0
and dword [ebp - 0xc], 0
and dword [ebp - 0x30], 0
and dword [ebp - 0x14], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x44], 0
and dword [ebp - 8], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0x330
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, eax
add ebx, 0xc
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x30]
mov ecx, 0x18
xor esi, esi
xor ebx, ebx
add bl, byte [edi + ecx - 1]
add esi, ebx
loop 0x401234
cmp esi, dword [ebp - 0x2c]
je 0x401249
mov eax, dword [eax]
cmp eax, ebx
jne 0x40122a
mov eax, dword [eax + 0x18]
mov dword [ebp - 8], eax
nop
popal
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x422318
push dword [0x422300]
push 0x422304
push dword [0x422318]
push 0x42231c
call fcn.0040102b
add esp, 0x14
push 0x42231c
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
push 0x422338
push dword [0x422300]
push 0x422304
push dword [0x422338]
push 0x42233c
call fcn.0040102b
add esp, 0x14
push 0x42233c
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0x422358
push dword [0x422300]
push 0x422304
push dword [0x422358]
push 0x42235c
call fcn.0040102b
add esp, 0x14
push 0x42235c
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [0x40402c]
mov dword [ebp - 0x10], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0
call dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x404030
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10]
push eax
push dword [section..data]
push 0x404004
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 4], eax
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push 0x20
push dword [0x40402c]
push dword [ebp - 4]
call dword [ebp - 0x24]
push 0x4046fc
push dword [0x4046d0]
push 0x4046d4
push dword [0x4046fc]
push 0x404700
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [0x4223ac], eax
and dword [ebp - 0x28], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 1
push dword [ebp - 0x28]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call dword [0x4223ac]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x43b62a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
mov esi, 0x6d4897b5
sub ecx, 1
mov ecx, esi
call fcn.0043b670
or ecx, esi
sub esi, esi
xor dword [ebx], eax
inc ecx
inc ecx
push esi
pop ecx
inc ebx
mov esi, 0xed79ea18
add esi, 0x7cd1b12c
sub esi, 0xaae29315
cmp ebx, edi
jne fcn.0043b62a
push 0x12ee5b4e
pop esi
ret
Function at 0x68f5bc
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffca
ror dword [ebx], 0xb6
adc esi, dword [edx + 0x1a]
dec esi
out dx, al
cmp esp, dword [ebp + 0xb566ea0]
aad 5
invalid
ja 0x68f53e
stosb byte es:[edi], al
push edi
push ss
mov bh, 0xda
lds ebp, [edx]
jbe 0x68f599
push esp
cmp ebp, edi
wait
mov ecx, 0x678351eb
sbb eax, 0xeab5be8e
sbb esp, dword [edx + ebp - 0x56]
cmp bh, byte [ebp + 0x3e]
lahf
push 0x40
pop dword [0x25536e1e]
push esi
pop edx
lea esi, [edx]
or dh, byte [ecx - 0x75ab354b]
push 0xa
lea ecx, [ebx + 0x47]
sbb ebx, edx
lcall 0x5a4f, 0x1a8acb9a
and eax, dword [edi + 0x1b]
ficomp dword [edx + 0x1a8acb9a]
dec edi
pop edx
pop edx
lcall 0xc92e, 0x183e0a2e
push 0xe5eb7b9a
jl 0x68f54e
adc cl, byte [edx + 0x57]
jle 0x68f562
cmp ch, dh
jne 0x68f634
test dword [edx - 0x37], esp
or ch, cl
ljmp 0x7a5c
ficomp word [esi - 0x4a7995a2]
or bl, ch
movsb byte es:[edi], byte [esi]
xchg esi, eax
mov ebx, dword [eax]
xor byte [esp + edi + 0x3e], 0xfa
rcr dword [0x2e1a6f77], cl
imul ebx, dword [esi], 0x5a
lds edi, [ecx + 0x3b]
mov esi, 0x5bbad71d
fild word [eax]
xchg edi, eax
mov edx, 0x9700df5b
salc
aam 0x3f
xchg edi, eax
adc esp, eax
test dword [ecx + edi*2 + 0xa], ebp
pushfd
jle 0x68f614
sbb dword [ecx], 0x6ebf6a0e
pop ebx
cmp al, bl
pop esi
or ah, dl
sub byte [edx - 0x555ab728], cl
invalid
Function at 0x72490c
Capabilities:
Encode data using xor

Disassembly:
out 0xb2, eax
stosb byte es:[edi], al
push ecx
out 1, al
sbb cl, byte [esi]
fldcw word [edi + 0x41abd2fa]
add byte [edx], ah
inc edx
or byte [ecx + ebp], dl
mov al, 0x2c
cmp bl, ah
loopne 0x7248ca
jmp 0x7248a4
rcr dh, 1
test ebx, 0xf48da11a
test eax, 0xeb1e19e8
pushal
or eax, 0x303dcb1b
xchg ebp, eax
idiv dword [ecx - 0x652827e]
sub dword [ebp - 0x56189e61], edx
and byte [0x934b567], 0xe9
add dword [ebx], eax
out 9, eax
lcall 0x6dec, 0x618645c9
add esp, edi
or dword [edx + 0x618645c9], ebx
in al, dx
insd dword es:[edi], dx
jne 0x7248fa
jp 0x724906
push es
rol dword [edi + 0x27ed25ad], 1
loope 0x724872
cmpsb byte [esi], byte es:[edi]
sbb ecx, esi
cmp bh, al
fadd dword [ecx + 0x45]
mov ebp, 0x86de210c
xor byte [ebx + 0x60cdf51a], bh
leave
xchg esp, eax
outsd dx, dword [esi]
arpl word [ecx + 0x62bfd7d7], sp
xchg edx, eax
mov ebx, 0x90ace919
outsd dx, dword [esi]
xlatb
pop edi
pop es
mov ebp, esp
lodsd eax, dword [esi]
movsd dword es:[edi], dword [esi]
jns 0x72495e
int1
inc ebx
retf 0xa133
jo 0x7248be
add eax, 0x45a02fd9
inc ebp
stosd dword es:[edi], eax
xor al, 0x2e
in al, 0x1e
inc ebx
jnp 0x724896
add dword [0x930ec330], 0xfb234596
add eax, 0x930ec330
xchg esi, eax
inc ebp
and edi, ebx
jmp 0x72495f
mov esp, 0xd460c114
xchg ebp, eax
lahf
mov ch, 0xac
add eax, 0xd3b05438
pop ebp
xchg dword [ecx + ecx*4], ecx
jno 0x724914
sbb edi, dword [ebx]
leave
inc edi
or al, 0xdd
fld qword [ecx + 0x45]
inc ecx
inc ebp
sti
aas
mov fs, word [ebx - 0x22]
ja 0x724945
push esp
leave
adc eax, 0xa189f1ca
lodsb al, byte [esi]
loope 0x7248fa
mov ch, bh
std
test eax, 0x4a927de4
in eax, 0x1d
add cl, byte [0x39207ac3]
cmp al, 0x73
mov byte [0x8435e1a2], al
movsb byte es:[edi], byte [esi]
xchg ecx, eax
mov bh, 0xa2
xor esp, ebx
inc ebx
mov ch, 0x24
inc eax
jns 0x724a00
insd dword es:[edi], dx
or byte [ebp + 0x7b8f47e0], 0xf0
pop esp
and cl, ch
and eax, dword [ebx]
aad 0xd0
test edi, edi
jg 0x724971
test eax, 0x94895b69
pop eax
inc ebx
mov al, 0x29
mov bl, 0xb0
inc ebp
mov es, word [ecx - 0x6ce7ccf6]
std
sal dword [edi], 0x4d
lea esi, [0x4dca3dc4]
std
adc al, 0x1b
add dword [edx + ebx*4 - 0x6e383ad3], esi
xchg esp, eax
jmp 0x210be901
fdivr qword [ecx + eax*2]
popal
invalid
Function at 0x10cb370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10cb38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x10f4074
push ecx
mov edi, eax
call fcn.010df198
mov esi, eax
add esp, 8
test esi, esi
jne 0x10cb3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.010df02e
push esi
call fcn.010defb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x10ce850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x10ce8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x10f9720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x10ce8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.010df1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x10ce8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x10f9720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x10ce92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.010e0082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x10ce957
mov word [eax], si
add eax, 2
push eax
call fcn.010e0030
add esp, 4
jmp 0x10ce959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x10ce8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x10ce8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x10ceff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10cf080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x10cf0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x10f4458
push ecx
call fcn.010df1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.010df1e1
add esp, 0x10
jmp 0x10cf0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.010df20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.010dedff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.010cf050
mov eax, dword [0x10f9728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x10cf13b
push esi
call fcn.010cefb0
add esp, 4
mov dword [0x10f9728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x10cf14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.010ceff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x10d2440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x10d24b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x10d248e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10d2471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x10d247e
add edx, ecx
cmp ebx, edx
jb 0x10d248a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10d2467
xor ecx, ecx
jmp 0x10d24a2
test eax, eax
jne 0x10d2492
xor ecx, ecx
jmp 0x10d24a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.010d23c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x10d28f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10d2921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x10d2946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x10d296e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x10d2993
push ecx
push esi
call fcn.010d24c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x10d3c00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x10d3c4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x10d3c2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0x10d3c38
add edx, eax
cmp ebx, edx
jb 0x10d3c46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0x10d3c21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0x10d3c50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0x10d3c70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x10d3cb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10d3c9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x10d3ca8
add edx, ecx
cmp ebx, edx
jb 0x10d3cb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10d3c91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x10d3f60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.010e0145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x10d3ffb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10d3fdd
lea eax, [esp + 0x18]
push eax
jmp 0x10d3fe2
push 0x10f9720
call fcn.010dffd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x10d3fb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x10d3f40
push 4
push ecx
push eax
call fcn.010e043f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0x10d4310
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.010e0145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x10d43ab
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10d438d
lea eax, [esp + 0x18]
push eax
jmp 0x10d4392
push 0x10f9720
call fcn.010dffd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x10d4360
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x10d3f40
push 4
push ecx
push eax
call fcn.010e043f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret