joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402480
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x28]
mov ebx, dword [ebp + 0x20]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
movzx eax, byte [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov ax, word [ebp + 0xc]
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov edi, dword [ebp + 0x24]
mov dword [ebp - 8], edi
cmp esi, 0xffffffff
je 0x402525
push 0
push 0
xorps xmm0, xmm0
movq qword [ebp - 0x40], xmm0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x40251b
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x402525
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x402584
test ebx, ebx
je 0x40252f
mov dword [ebx], 0
test edi, edi
je 0x402539
mov dword [edi], 0
xor esi, esi
nop dword [eax + eax]
lea eax, [ebp - 0x38]
push eax
call fcn.004027b0
add esp, 4
test al, al
jne 0x40255a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x40256f
mov eax, 0x51eb851f
mul dword [ebp - 0x14]
shr edx, 5
cmp edx, 2
je 0x402582
mov edi, 0x10dc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x402540
jmp 0x402584
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test edi, edi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.00410bbe
mov esp, ebp
pop ebp
ret
Function at 0x4038c0
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x10], ecx
push esi
push esi
push esi
push 0x1000002
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
jne 0x403900
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x403996
push edi
push 0
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x403920
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40398e
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40397f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40397f
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], esi
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0x423800
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40397f
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x423804
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
jmp 0x403987
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test esi, esi
pop esi
sete al
xor ecx, ebp
pop ebx
call fcn.00410bbe
mov esp, ebp
pop ebp
ret

Function at 0x4043e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
push 0
push eax
push 0x404020
push 0
push 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40441b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x404428
lock inc dword [0x42e9c4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410bbe
mov esp, ebp
pop ebp
ret

Function at 0x404440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
push 0
push eax
push 0x4041b0
push 0
push 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40447b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x404488
lock inc dword [0x42e9c4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410bbe
mov esp, ebp
pop ebp
ret
Function at 0x405160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00404dfc
push eax
push esi
push dword [ebp + 8]
call fcn.00404db1
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00404dfc
push eax
push esi
push dword [ebp + 8]
call fcn.00404db1
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00404dfc
push eax
push esi
push dword [ebp + 8]
call fcn.00404db1
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00404dec
jo 0x4052e8
into
or cl, byte [eax - 0x8363]
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
invalid
Function at 0x408410
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422160
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4084f9
cmp dword [ebp - 0x14], 0
jl 0x408471
jg 0x408462
cmp dword [ebp - 0x18], 0x40000000
jbe 0x408471
push str.Unable_to_process_files_over_1GB_
push 0xdf
jmp 0x408505
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x40848f
push str.Unable_to_open_file_mapping_
jmp 0x4084fe
mov dword [ebp - 0x2c], esi
push 0
push 0
push 0
push 4
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4084b5
push str.Unable_to_open_file_mapping_
jmp 0x4084fe
mov dword [ebp - 0x30], edi
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [ebp - 0x18]
push edi
call fcn.00408520
add esp, 0xc
mov bl, al
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410bbe
mov esp, ebp
pop ebp
ret
push str.Unable_to_determine_file_size_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407da0
push 0x42b144
lea eax, [ebp - 0x28]
push eax
call fcn.0041203a
int3
Function at 0x408dc0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4221d8
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x78], esi
mov dword [esi], 0
movups xmm0, xmmword [str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider]
mov eax, dword [0x4249ac]
mov dword [ebp - 0x40], eax
mov ax, word [0x4249b0]
movups xmmword [ebp - 0x70], xmm0
push 0x2a
movups xmm0, xmmword [0x42498c]
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x3a]
push 0
movups xmmword [ebp - 0x60], xmm0
push eax
movups xmm0, xmmword [0x42499c]
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x50], xmm0
call fcn.00411ee0
add esp, 0xc
call fcn.00407fe0
cmp eax, 0x5020000
jae 0x408e5c
push str.__Prototype_
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0xf0000040
push 0x18
lea eax, [ebp - 0x70]
push eax
push 0
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x408ea7
mov eax, dword [esi]
mov ecx, dword [ebp - 0x74]
mov dword [esi], ecx
test eax, eax
je 0x408e8b
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410bbe
mov esp, ebp
pop ebp
ret
push str.Unable_to_acquire_cryptographic_provider_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x88]
call fcn.00407da0
push 0x42b144
lea eax, [ebp - 0x88]
push eax
call fcn.0041203a
int3
Function at 0x409020
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422269
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 0
movlpd qword [ebp - 0x18], xmm0
call fcn.00408dc0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x409172
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x4090ad
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0x14]
push 0
push dword [ebp + 0x10]
mov dword [ebp - 4], 1
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x409194
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
push 4
push esi
mov dword [ebp - 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x4091b6
lea eax, [ebp - 0x22]
mov byte [ebp - 0x21], 0
push eax
lea eax, [ebp - 0x21]
xorps xmm0, xmm0
push eax
push dword [ebp - 0x20]
movq qword [edi], xmm0
mov ecx, edi
mov dword [edi + 8], 0
call fcn.00408c80
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], 2
push eax
push dword [edi]
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x4091d8
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x409144
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x409154
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410bbe
mov esp, ebp
pop ebp
ret
push str.Unable_to_create_hash_context_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00407da0
push 0x42b144
lea eax, [ebp - 0x3c]
push eax
call fcn.0041203a
push str.Unable_to_update_hash_context_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00407da0
push 0x42b144
lea eax, [ebp - 0x4c]
push eax
call fcn.0041203a
push str.Unable_to_determine_digest_size_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00407da0
push 0x42b144
lea eax, [ebp - 0x4c]
push eax
call fcn.0041203a
push str.Unable_to_retrieve_digest_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00407da0
push 0x42b144
lea eax, [ebp - 0x3c]
push eax
call fcn.0041203a
int3
Function at 0x409250
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42229c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x42ea68]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x42e9f0]
cmp eax, dword [ecx + 4]
jg 0x4092d1
lea eax, [ebp - 0x18]
xorps xmm0, xmm0
push eax
push 8
push dword [0x42e9ec]
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x40931b
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410bbe
mov esp, ebp
pop ebp
ret
push 0x42e9f0
call fcn.00410aca
add esp, 4
cmp dword [0x42e9f0], 0xffffffff
jne 0x409294
mov ecx, 0x42e9ec
mov dword [ebp - 4], 0
call fcn.00408dc0
push 0x422660
call fcn.00410f59
push 0x42e9f0
mov dword [ebp - 4], 0xffffffff
call fcn.00410a80
add esp, 8
jmp 0x409294
push str.Unable_to_generate_random_number_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407da0
push 0x42b144
lea eax, [ebp - 0x28]
push eax
call fcn.0041203a
int3
Function at 0x885370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x88538e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x8ae074
push ecx
mov edi, eax
call fcn.00899198
mov esi, eax
add esp, 8
test esi, esi
jne 0x8853cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0089902e
push esi
call fcn.00898fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x888850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x8888ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x8b3720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x8888ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.008991e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x8888ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x8b3720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x88892a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0089a082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x888957
mov word [eax], si
add eax, 2
push eax
call fcn.0089a030
add esp, 4
jmp 0x888959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x8888ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x8888b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x888ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x889080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x8890c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x8ae458
push ecx
call fcn.008991e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.008991e1
add esp, 0x10
jmp 0x8890d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0089920b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00898dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00889050
mov eax, dword [0x8b3728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], reloc.wtsapi32.dll_WTSSetSessionInformationW
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x88913b
push esi
call fcn.00888fb0
add esp, 4
mov dword [0x8b3728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x88914c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00888ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x88c440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x88c4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x88c48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x88c471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x88c47e
add edx, ecx
cmp ebx, edx
jb 0x88c48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x88c467
xor ecx, ecx
jmp 0x88c4a2
test eax, eax
jne 0x88c492
xor ecx, ecx
jmp 0x88c4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.0088c3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x88c8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x88c921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x88c946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x88c96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], reloc.wtsapi32.dll_WTSQueryUserToken
jne 0x88c993
push ecx
push esi
call fcn.0088c4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x88dc00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x88dc4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x88dc2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0x88dc38
add edx, eax
cmp ebx, edx
jb 0x88dc46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0x88dc21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0x88dc50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0x88dc70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x88dcb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x88dc9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x88dca8
add edx, ecx
cmp ebx, edx
jb 0x88dcb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x88dc91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x88df60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.0089a145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x88dffb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x88dfdd
lea eax, [esp + 0x18]
push eax
jmp 0x88dfe2
push 0x8b3720
call fcn.00899fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x88dfb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x88df40
push 4
push ecx
push eax
call fcn.0089a43f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret