joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ef1b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ef325
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x94], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x4ef30a
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409d40
mov dl, 1
mov eax, dword [0x4d30f8]
call fcn.004d3150
mov edx, dword [ebp - 4]
mov dword [edx + 0x8c], eax
mov dl, 1
mov eax, dword [0x41b138]
call fcn.004039e8
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x90]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.004d31cc
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4ef307
mov dl, 1
mov eax, dword [0x4d3b78]
call fcn.004d3be0
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
mov edx, 0x4ef33c
call fcn.004d3518
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404b38
xor eax, eax
push ebp
push 0x4ef300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
call fcn.004d3ee0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004ef344
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef307
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.00403a18
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00403a18
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
call fcn.00403a18
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef32c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404850
ret

Function at 0x511994
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
lea eax, [esp + 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x5119d8
lea eax, [esp + 0x10c]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
mov eax, esp
call fcn.00409d40
add esp, 0x200
pop ebx
ret
Function at 0x100b36c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1042fb58], 0
je 0x100b36d9
mov eax, dword [0x1042fb58]
jmp 0x100b3876
mov dword [0x1042fb58], 0x1042fb28
push 0x28
push 0
push 0x1042fb28
call fcn.100a88f6
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x1042fb28], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1042fb2c], eax
cmp dword [0x1042fb2c], 0
jne 0x100b371f
xor eax, eax
jmp 0x100b3876
push str.ImagehlpApiVersionEx
mov eax, dword [0x1042fb2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1042fb30], eax
push str.SymInitialize
mov ecx, dword [0x1042fb2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1042fb34], eax
push str.SymSetOptions
mov edx, dword [0x1042fb2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1042fb38], eax
push str.SymGetOptions
mov eax, dword [0x1042fb2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1042fb3c], eax
push str.SymLoadModule
mov ecx, dword [0x1042fb2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1042fb40], eax
push str.SymGetModuleInfo
mov edx, dword [0x1042fb2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1042fb44], eax
push str.SymGetSymFromName
mov eax, dword [0x1042fb2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1042fb48], eax
push str.BindImage
mov ecx, dword [0x1042fb2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1042fb4c], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.100a88f6
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x1042fb30], 0
je 0x100b37fd
lea eax, [ebp - 8]
push eax
call dword [0x1042fb30]
cmp dword [0x1042fb30], 0
je 0x100b380f
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x100b382a
mov edx, dword [0x1042fb2c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1042fb2c], 0
xor eax, eax
jmp 0x100b3876
cmp dword [0x1042fb34], 0
je 0x100b3843
push 0
push 0
mov eax, dword [0x1042fb28]
push eax
call dword [0x1042fb34]
cmp dword [0x1042fb3c], 0
je 0x100b3871
cmp dword [0x1042fb38], 0
je 0x100b3871
call dword [0x1042fb3c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x1042fb38]
mov eax, dword [0x1042fb58]
mov esp, ebp
pop ebp
ret
Function at 0x100b4210
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10271ab8
push 0x100ab6c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], 0
jne 0x100b424d
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x100b4283
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
jmp 0x100b43e1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0x4550
je 0x100b42bb
push 0xbf
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
jmp 0x100b43e1
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax + 0x14]
test ecx, ecx
jne 0x100b42e7
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3c]
jmp 0x100b43e1
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 0
jmp 0x100b430a
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x28], edx
jae 0x100b43bb
push str..detour
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
add ecx, eax
push ecx
call fcn.100aad4a
add esp, 8
test eax, eax
jne 0x100b43b6
mov edx, dword [ebp - 0x28]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x20]
cmp dword [eax + edx + 0xc], 0
je 0x100b4357
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x20]
cmp dword [edx + ecx + 0x10], 0
jne 0x100b4359
jmp 0x100b43bb
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx], 0x30
jb 0x100b4386
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 4], 0x727444
je 0x100b4388
jmp 0x100b43bb
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 8], 0
jne 0x100b439c
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ecx + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x40]
jmp 0x100b43e1
jmp 0x100b4301
mov dword [ebp - 4], 0xffffffff
jmp 0x100b43d4
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x17a206a2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..rsrc
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x3eb4460e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x62022bf3
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x4c242744
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x639197
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp], edx
mov esp, dword [esp]
jmp 0x638fff
mov edi, ebx
pop ebx
jmp 0x638fcc
shr esi, 4
sub esi, 0x7f2c932b
jmp 0x639763
add edx, 0x78ddfb73
add edx, edi
sub edx, 0x78ddfb73
jmp 0x639208
sti
jmp 0x639377
push ebp
mov ebp, esp
jmp 0x63970a
push dword [esp]
pop edi
add esp, 4
jmp 0x638f03
xor ecx, ecx
xchg dword [esp], ebp
pop esp
mov dword [esp], ebp
mov ebp, 0x6f7a6ce0
push esi
push ecx
mov ecx, 0x58ff9100
mov esi, 0xc7b77bd5
jmp 0x6396d0
mov ebx, 4
jmp 0x638f8d
sub esi, ecx
pop ecx
jmp 0x63974b
add ebp, 4
sub ebp, 4
jmp 0x6394ac
dec esi
jmp 0x638fae
sub esi, 0x8cfe4ab
add ebp, esi
pop esi
sub ebp, 0x395f596b
add ebp, 0x356f1463
shr ebp, 2
xor ebp, 0x7bb0e178
push eax
mov eax, 0xbed15531
jmp 0x63979d
add ebp, 0x6b7bbca0
add ebp, eax
sub ebp, 0x6b7bbca0
mov eax, dword [esp]
add esp, 4
add edx, ebp
pop ebp
jmp 0x6397b9
push edi
push ebx
jmp 0x6394f7
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x43b644
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop ebx
mov edi, 0x357f721e
or edi, ecx
sub ecx, 1
call fcn.0043b688
mov ecx, 0x122f8867
push 0xc64c79d
pop ecx
xor dword [eax], ebx
and ecx, edi
add eax, 1
sub edi, edi
cmp eax, edx
jne fcn.0043b644
sub esp, 4
mov dword [esp], edi
pop edi
mov ecx, 0xdf6fad0c
and ecx, ecx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6b6f33e7
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x552515ad
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0xa4bd0a
Capabilities:
Encode data using xor

Disassembly:
call fcn.00ab59bb
ja 0xa4bd84
outsd dx, dword [esi]
arpl word [ebx + 0x33], bp
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [0xc93f0cfa], bl
sub eax, 0x6211263e
and eax, ecx
jp 0xa4bd37
xchg byte [ecx - 0x6a619781], cl
jae 0xa4bd82
cmpsb byte [esi], byte es:[edi]
lea edi, [ebx + 0x78]
mov gs, word [ebp - 0x5f74bea5]
inc esi
push ebp
mov dword [0xc5ba4aac], eax
mov ebx, 0x7b24e4f1
lodsd eax, dword [esi]
pop ebx
inc ecx
mov esp, dword [eax - 0x535caaba]
dec edx
mov edx, 0xe4f1bbc5
and al, 0x7b
inc ebx
in al, 0x73
push ebp
fcom qword [edi + 0x6c]
lcall 0x9b0e, 0x7a0faee4
retf 0xb41
mov bh, ah
cmp al, 0x43
adc dword [edx - 0x17], ecx
sub dword [esi + 0x4e], esi
invalid

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5cbf00c6
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1e773da4
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1169370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x116938e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x1192074
push ecx
mov edi, eax
call fcn.0117d198
mov esi, eax
add esp, 8
test esi, esi
jne 0x11693cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0117d02e
push esi
call fcn.0117cfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x116c850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x116c8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x1197720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x116c8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0117d1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x116c8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x1197720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x116c92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0117e082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x116c957
mov word [eax], si
add eax, 2
push eax
call fcn.0117e030
add esp, 4
jmp 0x116c959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x116c8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x116c8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x116cff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x116d080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x116d0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x1192458
push ecx
call fcn.0117d1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.0117d1e1
add esp, 0x10
jmp 0x116d0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0117d20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.0117cdff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0116d050
mov eax, dword [0x1197728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x116d13b
push esi
call fcn.0116cfb0
add esp, 4
mov dword [0x1197728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x116d14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.0116cff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x1170440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x11704b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x117048e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1170471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x117047e
add edx, ecx
cmp ebx, edx
jb 0x117048a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1170467
xor ecx, ecx
jmp 0x11704a2
test eax, eax
jne 0x1170492
xor ecx, ecx
jmp 0x11704a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.011703c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x11708f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1170921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x1170946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x117096e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x1170993
push ecx
push esi
call fcn.011704c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x1171c00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x1171c4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x1171c2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0x1171c38
add edx, eax
cmp ebx, edx
jb 0x1171c46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0x1171c21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0x1171c50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0x1171c70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x1171cb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1171c9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x1171ca8
add edx, ecx
cmp ebx, edx
jb 0x1171cb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1171c91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x1171f60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.0117e145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x1171ffb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1171fdd
lea eax, [esp + 0x18]
push eax
jmp 0x1171fe2
push 0x1197720
call fcn.0117dfd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x1171fb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x1171f40
push 4
push ecx
push eax
call fcn.0117e43f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret