joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414c00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x414dbb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x414d8e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040468c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00406b48
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov ecx, 0x414dd4
call fcn.00404478
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
add al, 0xbf
sub al, 0x1a
jae 0x414d84
mov eax, dword [ebp - 0x10]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x414d84
push 0x414de0
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx]
call fcn.00404354
push dword [ebp - 0x1c]
push 0x414df0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004044ec
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 0x10]
call fcn.0040462c
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x425d40]
mov edx, 0x414dfc
call fcn.00404848
mov edx, dword [ebp - 0x10]
call fcn.00404848
mov dl, 0x20
call fcn.00402fb0
call fcn.00404d84
call fcn.004030b0
cmp ebx, 0xffffffff
jne 0x414d29
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x425d40]
mov edx, 0x414e10
call fcn.00404848
mov edx, dword [ebp - 0x10]
call fcn.00404848
mov dl, 0x20
call fcn.00402fb0
call fcn.00404d84
call fcn.004030b0
cmp ebx, 0xffffffff
je 0x414d84
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0x2d4808
push ebx
call sub.kernel32.dll_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x414d98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414dc2
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004041ac
lea eax, [ebp - 4]
call fcn.00404188
ret
Function at 0x418718
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, ecx
mov edi, edx
mov dword [esp], eax
xor ebp, ebp
test esi, esi
jbe 0x41879d
mov ebx, 1
mov edx, 0x10000
mov eax, esi
call fcn.0040b4d0
mov dword [esp + 4], eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, edi
call fcn.00404684
lea eax, [eax + ebx - 1]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x41876a
or ebp, 0xffffffff
add ebx, dword [esp + 8]
sub esi, dword [esp + 8]
xor eax, eax
call fcn.0040be08
cmp ebp, 0xffffffff
je 0x418789
mov eax, dword [edi]
call fcn.0040442c
cmp ebx, eax
jle 0x418731
mov eax, dword [edi]
call fcn.0040442c
cmp ebx, eax
jle 0x41879d
mov eax, dword [edi]
call fcn.0040442c
mov ebp, eax
mov eax, ebp
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4194e4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4196c5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x425c10], 0
jne 0x419693
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x38
call fcn.00402d2c
mov bl, 0x43
lea esi, [ebp - 0x50]
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404354
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x18]
mov ecx, 0x4196dc
call fcn.00404478
mov eax, dword [ebp - 0x18]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4195fc
lea eax, [ebp - 0x10]
mov ecx, 0x4196e8
mov edx, dword [ebp - 0x18]
call fcn.00404478
mov eax, dword [ebp - 0x10]
call fcn.00406ef8
test al, al
je 0x4195b0
push dword [ebp - 0x10]
push 0x4196f8
push 0
push 0x2710
push 0
push 0x186a0
lea eax, [ebp - 0x58]
call fcn.0040b518
push dword [ebp - 0x58]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004044ec
mov eax, dword [ebp - 0x10]
call fcn.00406f1c
lea eax, [ebp - 0x14]
mov ecx, 0x419708
mov edx, dword [ebp - 0x10]
call fcn.00404478
push 0
push 0
xor ecx, ecx
mov edx, 0x41971c
mov eax, dword [ebp - 0x14]
call fcn.00413c10
mov eax, dword [ebp - 0x14]
call fcn.00406ee8
test al, al
je 0x4195f2
mov eax, dword [ebp - 0x10]
call fcn.00413f84
fstp qword [esi]
wait
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00414790
inc ebx
add esi, 8
cmp bl, 0x46
jne 0x419535
lea edx, [ebp - 0x60]
mov al, 1
call fcn.0040cd60
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00406b48
mov eax, dword [ebp - 0x5c]
mov dl, byte [eax]
mov byte [ebp - 9], dl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov bl, 0x43
lea ecx, [ebp - 0x50]
fld qword [ecx]
fcomp qword [ebp - 8]
fnstsw ax
sahf
jbe 0x41964b
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov byte [ebp - 9], bl
inc ebx
add ecx, 8
cmp bl, 0x46
jne 0x419633
cmp dl, byte [ebp - 9]
je 0x419693
lea eax, [ebp - 0x64]
mov dl, byte [ebp - 9]
call fcn.00404354
mov edx, dword [ebp - 0x64]
mov eax, 0x425c10
mov ecx, 0x419728
call fcn.00404478
mov eax, dword [0x425c10]
call fcn.00406ef8
test al, al
je 0x419693
mov eax, 0x425c10
mov edx, 0x4196f8
call fcn.00404434
cmp dword [0x425c10], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4196cc
lea eax, [ebp - 0x64]
mov edx, 5
call fcn.004041ac
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004041ac
ret
Function at 0x41db7c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x41dbfd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.0040cb00
test al, al
je 0x41dbb8
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.0041d208
jmp 0x41dbc3
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.0041cf60
test eax, eax
je 0x41dbe7
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dc04
lea eax, [ebp - 4]
call fcn.00404188
ret
Function at 0x4215dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x421683
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x425dd4]
cmp dword [eax], 0
jg 0x421668
lea eax, [ebp - 0xc]
call fcn.0041a698
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x421698
call fcn.00404478
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402820
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00407270
push dword [ebp - 0x10]
lea edx, [ebp - 0x18]
mov eax, dword [0x425d78]
mov eax, dword [eax]
call fcn.0041339c
push dword [ebp - 0x18]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004044ec
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
push 0
call sub.user32.dll_PostQuitMessage
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42168a
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004041ac
ret
Function at 0x422274
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42240d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0040cbdc
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4129b8]
call fcn.00413008
call fcn.004137b4
mov dword [ebp - 0xc], eax
mov ebx, 0x46
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x4222c7
add ebx, 0x34
mov esi, 0x14
mov edi, 0x154
mov dword [ebp - 8], 0x12
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x426660]
push eax
push 0
mov edx, 0x42241c
mov eax, 0x422420
mov ecx, 0x50000000
call fcn.00405d4c
mov edx, dword [0x425e50]
mov dword [edx], eax
mov ebx, 0x46
mov esi, 0x26
mov edi, 0x188
mov dword [ebp - 8], 0xd
push 0x50000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x426660]
push eax
push 0
mov edx, 0x422428
xor ecx, ecx
xor eax, eax
call fcn.00405cf4
mov edx, dword [0x425d90]
mov dword [edx], eax
mov ebx, 0x1a0
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x422366
mov ebx, 0x46
mov esi, 0x14
mov edi, 0x2e
mov dword [ebp - 8], 0xd
push 0x40000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x426660]
push eax
push 0
mov edx, 0x422428
xor ecx, ecx
xor eax, eax
call fcn.00405cf4
mov edx, dword [0x425d34]
mov dword [edx], eax
push 0
push 0x3e8
push 1
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetTimer
mov edx, dword [0x425d60]
mov dword [edx], eax
push 0x42243c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff5
call sub.gdi32.dll_CreateFontA
push 0
push eax
push 0x30
mov eax, dword [0x425e50]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422414
lea eax, [ebp - 0x10]
call fcn.00404188
ret
Function at 0x4225c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4227b4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, 0x4227cc
call fcn.0040d290
test eax, eax
jl 0x4225fe
neg eax
mov edx, dword [0x425df0]
mov dword [edx], eax
call sub.comctl32.dll_InitCommonControls
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x28
call fcn.00402d2c
mov dword [ebp - 0x50], 0x4224b4
mov eax, dword [0x426660]
mov dword [ebp - 0x44], eax
mov eax, dword [0x425cc0]
call fcn.0040462c
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x3c], eax
push 0x4227d8
mov eax, dword [0x426660]
push eax
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x54], 8
lea eax, [ebp - 0x54]
push eax
call sub.user32.dll_RegisterClassA
mov esi, 0x1ec
mov edi, 0x6e
push 0
call sub.user32.dll_GetSystemMetrics
sub eax, esi
sar eax, 1
jns 0x42267a
adc eax, 0
mov dword [ebp - 4], eax
push 1
call sub.user32.dll_GetSystemMetrics
sub eax, edi
sar eax, 1
jns 0x42268d
adc eax, 0
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x2c80000
lea eax, [ebp - 0x58]
call fcn.0040cbdc
mov ecx, dword [ebp - 0x58]
mov dl, 1
mov eax, dword [0x4129b8]
call fcn.00413008
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4227ec
mov edx, 0x422810
mov eax, ebx
call fcn.004136b0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
push edi
push 0
push 0
mov eax, dword [0x426660]
push eax
push 0
mov eax, dword [ebp - 0x10]
call fcn.0040462c
push eax
mov eax, dword [0x425cc0]
call fcn.0040462c
mov edx, eax
xor eax, eax
pop ecx
call fcn.00405cf4
mov edx, dword [0x425d14]
mov dword [edx], eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.004138ac
mov eax, dword [ebp - 0x5c]
push eax
mov eax, ebx
call fcn.004137b4
push eax
mov eax, ebx
call fcn.0041382c
mov edx, eax
pop ecx
pop eax
call fcn.0040e124
mov eax, dword [0x425d14]
cmp dword [eax], 0
je 0x42276a
push 0
mov eax, dword [0x425d14]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x422757
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_DispatchMessageA
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x422745
push 1
mov eax, dword [0x425d14]
mov eax, dword [eax]
push eax
call sub.user32.dll_KillTimer
mov al, 1
call fcn.0041bf78
call fcn.0041bf48
xor edx, edx
mov eax, 0x2b
call fcn.0041b7c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4227bb
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004041ac
lea eax, [ebp - 0x10]
call fcn.00404188
ret
Function at 0x422a44
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x422a4c
xor eax, eax
push ebp
push 0x422b58
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.00402820
lea eax, [ebp - 0x10]
call fcn.0041935c
push dword [ebp - 0x10]
push 0x422b6c
push 0x422b78
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004072f8
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 4
call fcn.004044ec
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
mov eax, dword [ebp - 4]
call fcn.0040462c
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x18]
call fcn.0040cfd0
push dword [ebp - 0x18]
push 0x422b84
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402820
push dword [ebp - 0x1c]
push 0x422bac
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004044ec
push dword [ebp - 0xc]
push 0x422bbc
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00402820
push dword [ebp - 0x20]
push 0x422bd4
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004044ec
push 0
push dword [ebp - 8]
push 0x422be0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00406b84
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004044ec
mov eax, dword [ebp - 0x24]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422b5f
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004041ac
ret
Function at 0x422be4
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x422bec
push ecx
push ebx
xor eax, eax
push ebp
push 0x422e0b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, 0x422e20
call fcn.0040d0b0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d40]
call fcn.00404d84
mov edx, 0x422e30
call fcn.00404848
pop edx
call fcn.00404848
call fcn.004030b0
mov eax, dword [0x425de4]
cmp byte [eax], 0
je 0x422df0
call fcn.00422814
test al, al
je 0x422c73
lea edx, [ebp - 0x14]
mov eax, 0x422e20
call fcn.0040d0b0
mov eax, dword [ebp - 0x14]
mov edx, 0x422e50
call fcn.00404578
jne 0x422df0
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402820
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0xc]
call fcn.004072f8
lea edx, [ebp - 0x1c]
mov eax, dword [0x425d78]
mov eax, dword [eax]
call fcn.0041339c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0040c478
test al, al
je 0x422df0
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d40]
call fcn.00404d84
mov edx, 0x422e5c
call fcn.00404848
call fcn.004030b0
push 0
push 0
mov eax, 0x422e7c
call fcn.0040d290
imul eax, eax, 0x3e8
xor edx, edx
call fcn.0040be40
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00402820
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00407270
push dword [ebp - 0x20]
push 0x422e8c
push dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004044ec
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040462c
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00402820
mov eax, dword [ebp - 0x28]
call fcn.0040462c
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 4]
call fcn.00404188
lea edx, [ebp - 8]
mov eax, 0x422e98
call fcn.0040d0b0
cmp dword [ebp - 8], 0
je 0x422d62
lea eax, [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, 0x422eac
call fcn.00404478
lea edx, [ebp - 8]
mov eax, 0x422ec4
call fcn.0040d0b0
cmp dword [ebp - 8], 0
je 0x422d85
lea eax, [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, 0x422ed4
call fcn.00404478
push 0
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00404478
mov eax, dword [ebp - 0x2c]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
call fcn.004027c0
test eax, eax
jle 0x422df0
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
add ebx, 0xbb8
xor edx, edx
mov eax, 0xc8
call fcn.0040be40
mov eax, dword [ebp - 0xc]
call fcn.0041d6d4
test al, al
jne 0x422df0
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
cmp edx, dword [esp + 4]
jne 0x422dec
cmp eax, dword [esp]
pop edx
pop eax
jae 0x422db9
jmp 0x422df0
pop edx
pop eax
jge 0x422db9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422e12
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.004041ac
ret
Function at 0xe1f370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xe1f38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xe48074
push ecx
mov edi, eax
call fcn.00e33198
mov esi, eax
add esp, 8
test esi, esi
jne 0xe1f3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00e3302e
push esi
call fcn.00e32fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xe22850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xe228ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xe4d720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xe228ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00e331e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xe228ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xe4d720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xe2292a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00e34082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xe22957
mov word [eax], si
add eax, 2
push eax
call fcn.00e34030
add esp, 4
jmp 0xe22959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xe228ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xe228b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xe22ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xe23080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0xe230c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xe48458
push ecx
call fcn.00e331e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00e331e1
add esp, 0x10
jmp 0xe230d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00e3320b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00e32dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00e23050
mov eax, dword [0xe4d728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0xe2313b
push esi
call fcn.00e22fb0
add esp, 4
mov dword [0xe4d728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0xe2314c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00e22ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0xe26440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0xe264b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xe2648e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xe26471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xe2647e
add edx, ecx
cmp ebx, edx
jb 0xe2648a
inc edi
add eax, 0x28
cmp edi, esi
jb 0xe26467
xor ecx, ecx
jmp 0xe264a2
test eax, eax
jne 0xe26492
xor ecx, ecx
jmp 0xe264a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.00e263c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0xe268f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0xe26921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0xe26946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0xe2696e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0xe26993
push ecx
push esi
call fcn.00e264c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret