joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x42b1a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x42b1a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x42bdff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.0042bf02
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.0042bf1c
push edx
push dword [ebp + 0x10]
push eax
call fcn.0042beea
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0042bf02
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0042becb
push ecx
push dword [ebp + 8]
call fcn.0042bf02
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0042bf02
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0042becb
push ecx
push dword [ebp + 8]
call fcn.0042bf02
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0042bf02
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0042becb
push ecx
push dword [ebp + 8]
call fcn.0042bf02
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0042bf02
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0042becb
cmp ecx, 0x2b
jne 0x42be0f
leave
ret 0xc

Function at 0x42d495
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x42d525
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x12050
push 0
call dword [eax + 0x20]
test eax, eax
je 0x42d5b7
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x12050
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x12050
call fcn.0042d3d4
push 0x12050
push dword [ebp + 0xc]
call fcn.0042b1a8
test eax, eax
jne 0x42d599
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x12050
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.0042d5be
test eax, eax
je 0x42d5b7
jmp 0x42d555
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x42d5b7
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x42d5ec
Capabilities:
Terminate process

Disassembly:
call fcn.0042d5f9
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x402960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00404a90
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
test al, 0xf
mov ecx, eax
sete dl
shr ecx, 9
lea edx, [edx*4 + 2]
and dl, cl
movsx ecx, al
inc dl
movsx edx, dl
imul edx, ecx
mov ecx, eax
shr ecx, 6
xor cl, al
add dl, cl
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x4029e3
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403cdc
mov esp, ebp
pop ebp
ret
Function at 0x403040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00404a90
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ebx, ebx
mov ecx, ebx
mov eax, ebx
shr eax, 0xb
mov esi, ebx
shr ecx, 0xd
not esi
and cl, al
mov eax, esi
shr eax, 9
and al, 3
movsx ecx, cl
movsx eax, al
imul ecx, eax
movsx eax, bl
movsx edx, cl
mov ecx, esi
imul edx, eax
mov eax, ebx
and eax, 0x6000
shr ecx, 0xb
or eax, 0x8000
shr esi, 0xb
shr eax, 0xd
and ecx, 1
imul eax, ebx
and esi, 1
shr eax, cl
mov ecx, esi
xor dl, al
mov eax, ebx
and eax, 0x6000
and dl, 0x7f
or eax, 0x8000
shr eax, 0xd
imul eax, ebx
shr eax, cl
xor dl, al
mov byte [ebp + ebx - 0x3a988], dl
inc ebx
cmp ebx, 0x3a980
jb 0x4030c5
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00403cdc
mov esp, ebp
pop ebp
ret
Function at 0x43f8b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
cmp al, 0xe
rcl dword [esi + 0x18e2805d]
mov edi, 0xb1cf3897
dec esi
test byte [ebp - 3], cl
lock add edx, dword [edi]
invalid

Function at 0x46f658
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
arpl word [edi + 0x4ea77c9a], cx
xor byte [edi - 0x6c], ah
xchg esp, eax
add ebp, edx
xchg esp, eax
jno 0x46f642
cmpsb byte [esi], byte es:[edi]
and byte [ebp - 0x757fa70b], dl
out 0x78, al
dec edi
jo 0x46f64a
pushal
mov esi, 0x98182388
out dx, al
insb byte es:[edi], dx
scasb al, byte es:[edi]
mov byte [ebx], al
out 0x68, al
or dword [esi - 0x3c0e6b41], eax
xchg ecx, eax
leave
fsub st(7)
add dword [eax], ebp
hlt

Function at 0x47b001
Capabilities:
Encode data using xor

Disassembly:
add byte [eax + edi*4], al
test byte [esi], 0x7c
jecxz 0x47b00a
shr byte [ebx], 1
das
sub ebp, dword [edi]
add byte [ebx + 0x875], cl
lock and dword [ebp - 4], 0
sub eax, 0x8b147401
inc ebp
or al, 0x8b
add byte [eax], al
add byte [eax], dl
push eax
call 0x16c8836
add eax, 0x10
pop ecx
mov dword [esi], eax
call 0xb69c9678
fidivr word [esi + 0x1d]
movsb byte es:[edi], byte [esi]
push 0xffffffffffffffd4
push eax
shl dword [ecx], cl
push esi
xor al, 0x96
les esp, [eax - 0x2c]
jl 0x47b009
inc esp
wait
js 0x47b0a4
das
xchg ebp, eax
shl dword [esi + ecx - 0x181bfa06], 0x55
jns 0x47b095
invalid
push ss
in al, 0x37
and esp, dword [esi]
mov ebp, dword [edx + 0x2e5ced9b]
enter 0xffffffffffffb407, 0x46
add al, 0x7b
stosd dword es:[edi], eax
enter 0x59e4, 0xffffffffffffffe4
xchg ecx, eax
std
adc esp, edi
inc esi
ljmp 0x1fad
xlatb
ror byte [esi], 1
cmp dword [edx + 0x7275f6d9], ecx
mov byte [0xcc569409], al
push 0xc9c5c374
add al, 0x35
call 0x386e7833
stosb byte es:[edi], al
salc
push ebp
imul ebx, dword [ebp + 0x6d566cc], 0x10
sti
retf
je 0x47b069
invalid

Function at 0x4827a3
Capabilities:
Encode data using xor

Disassembly:
daa
int3
inc edx
mov byte [ebx - 0x473db1d1], bl
xor byte [eax + 0x26], bl
or dword [0x1a3f4e2], eax
jne 0x48282a
test byte [edi], bl
aam 0xed
xchg edx, eax
mov byte [edx + edi*4 + 0x74], bl
arpl word [edx - 0x17], ax
push esp
inc ecx
scasb al, byte es:[edi]
mov edx, 0xde0274e0
jo 0x4827cd
jle 0x48280d
inc edi
invalid
fcomp qword [ecx - 0x45]
jne 0x48279a
mov esp, 0xd597fb6b
cmp eax, 0x7143e318
test al, 5
imul ecx, dword [ecx - 0x21], 0x32
fcomp dword [eax + esi*2 - 0x79]
aaa
movsd dword es:[edi], dword [esi]
and dword [ebx + 8], ecx
hlt
or ah, dh
add al, byte [edx + 1]
push edi
sti
sar dword [esi - 0x314cc6ba], 0xda
mov bh, bl
mov al, 0x9a
ror byte [ebp + 0x22bd3018], cl
jecxz 0x482850
xchg esi, eax
inc ebx
and byte [eax - 0x63e1bb86], al
sti
and byte [ebx + 0x2e], cl
mov word [esi - 0x18f0b5ea], ds
invalid
Function at 0x49affd
Capabilities:
Encode data using xor

Disassembly:
push ebx
int3
std
pop ds
cmpsb byte [esi], byte es:[edi]
jg 0x49b06a
push 0x58
push 0xfffffffffffffffd
dec esi
push eax
clc
popfd
mov cl, 0x87
test al, 0xfd
and dh, byte [esp + ebp*8 - 0x2bd8b47]
and esi, dword [edi]
lodsd eax, dword [esi]
dec edx
jo 0x49b099
fnstenv [edx]
lds eax, [edx - 0x3a]
les eax, [ecx + 0x65]
fnsave dword [edx - 0x4f]
dec edi
std
sbb dh, cl
out 0xdf, al
rol eax, cl
jno 0x49b08c
frstor dword [edi - 0x591060e8]
frstor dword [edi - 0x591060e8]
loopne 0x49afc8
adc esp, dword [esi]
dec ebx
xor eax, 0x98709c7c
fmul dword [esi + 0x68]
js 0x49b031
invalid
lcall 0xae94, 0x61356fca
cmpsd dword [esi], dword es:[edi]
rcl dword [esi - 0x35ae7cfc], cl
cmp bh, byte [ecx + 0x66071910]
xchg edi, eax
adc byte [ecx], bl
pop es
xchg di, ax
mov cl, byte [edi]
cmp al, 0x5f
fld dword [esi]
sahf
mov ah, byte [edx]
salc
push 0xffffffffffffffc9
add esi, dword [ecx + 0x22]
jno 0x49b0b0
cdq
lds edx, [ebx - 0x10]
xchg edi, eax
or ecx, dword [edi - 0x7f]
retf 0xd8a3
sbb eax, edi
stc
cdq
mov word [ecx], gs
out 0xfc, al
inc edi
push ebp
pop ecx
bound ebx, qword [eax + 0x76]
std
fimul dword [ecx]
dec edx
sub al, 0x66
inc ebx
and edx, dword [ecx + 0x6f]
outsd dx, dword [esi]
wait
std
jae 0x49b07a
jg 0x49b104
int1
lahf
or ebx, dword [eax + 0x46]
sub esp, dword [ebx]
fstp xword [ebp - 0x5e99ee84]
inc eax
in al, 0x30
cmp al, 0xe3
stosd dword es:[edi], eax
out 0x27, eax
clc
pushal
scasd eax, dword es:[edi]
push esp
nop
sbb eax, 0xc6e8b878
pop ecx
push ds
imul ecx, dword [ebx + edx*8 + 0x5386bc4a], 0x3c3d81a8
cdq
out 0x28, al
add eax, 0x63efa60f
mov ebx, dr7
loope 0x49b10b
fst qword [edi + 0x63]
scasd eax, dword es:[edi]
inc ebp
je 0x49b0d2
and dword es:[ebx + 0x25], edx
pop ds
inc ecx
test eax, 0x2bb100dc
pushal
or byte [edi], al
pop es
scasd eax, dword es:[edi]
loope 0x49b0b0
loop 0x49b09b
mov ebp, 0xe044ec71
aaa
or dword [edi - 0x22], 0x3e6b0f56
cmpsb byte [esi], byte es:[edi]
push edx
out dx, eax
out 0xab, al
mov edi, 0xe3801866
jl 0x49b105
mov dl, 0x11
arpl word [ebx], bx
mov ebp, 0x8823c275
inc ebp
dec ecx
popal
mov esi, 0x73efaefc
les ebp, [ebx]
out dx, eax
call 0x29b8b74c
xlatb
add edi, dword [ecx - 0x7dbe12cf]
sbb cl, 0xfd
xchg ecx, eax
fcomi st(1)
pushfd
dec ecx
xor byte gs:[edi + 0x4e], dh
fiadd dword [edi - 0x24814e49]
ror dword [0x57799165], cl
mov cl, 0x7e
fcmovnbe st(0), st(3)
or eax, 0x57799165
push eax
popal
push ecx
pushal
pop eax
xor eax, ebx
jb 0x49b1ca
push cs
jbe 0x49b156
js 0x49b162
shr byte [edx - 0x61], 0xa6
cmpsd dword [esi], dword es:[edi]
mov edx, 0xaa432a35
cwde
or eax, 0x68433857
push ecx
stosb byte es:[edi], al
pop eax
mov ebx, 0x1e61c583
salc
inc eax
retf 0x8fad
sti
call 0x73cc69a1
cmpsd dword [esi], dword es:[edi]
mov al, byte [0x1c21c6b7]
xlatb
add al, 0x87
invalid
Function at 0x4a7f01
Capabilities:
Accept command line arguments

Disassembly:
push 0x5f790157
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
pop esp
push ebx
push 0x237fca69
pop ebx
add ebx, 0x76f7afc7
neg ebx
dec ebx
not ebx
or ebx, 0x77f7cde8
not ebx
push edx
mov edx, 0x90007
sub ebx, 0x56fd01cf
sub ebx, edx
add ebx, 0x56fd01cf
pop edx
and ecx, ebx
pop ebx
push ebp
mov ebp, esp
add ebp, 4
sub esp, 4
mov dword [esp], ebx
mov ebx, 0x5effb628
or ebx, 0x7deea57a
xor ebx, 0x7fffb77e
sub ebp, ebx
pop ebx
xchg dword [esp], ebp
mov esp, dword [esp]
mov dword [esp], eax
push edx
mov dword [esp], ebp
mov dword [esp], ebx
mov eax, dword [esp]
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
mov eax, dword [esp]
push edi
mov edi, esp
add edi, 4
push eax
mov eax, 4
add edi, eax
pop eax
push edi
push dword [esp + 4]
pop edi
pop dword [esp]
mov esp, dword [esp]
jmp fcn.0051e39e

Function at 0x6228aa
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0xe7
inc esp
pop esp
add edi, esi
invalid
push cs
fisubr dword [eax + 0x25]
and eax, 0xc5868d1e
fisub word [esi]
invalid
and eax, 0xc5868d1e
fisub word [esi]
jg 0x6228b2
jmp ecx
loope 0x6228bc
pop ecx
les esp, [edx]
pop edi
fadd dword [edi]
mov al, byte [eax - 0x50bf85f2]
or byte [esi], 0x7a
inc eax
scasd eax, dword es:[edi]
dec ebp
mov eax, dword [0x2547737b]
mov esi, 0x1bc693cd
jne 0x62291a
sbb esp, dword [eax + 0x4c]
loop 0x622864
cmpxchg ah, ah
loop 0x6228e9
test al, 0xd2
leave
js 0x6228a7
mov esi, 0x19979b0a
das
outsd dx, dword [esi]
xchg dword [edi + 0x4c1707ab], esi
mov bh, 0xab
pop es
pop ss
dec esp
sal dword [edi - 0x74], 1
pop ecx
or bl, byte [eax]
in eax, dx
outsb dx, byte [esi]
mov ah, 0xcb
imul edx, dword [ecx], 0x8df01b9f
xor eax, 0xf7dad1e1
and byte [ebp - 0x70], bh
push esp
or byte [ebx + 0x5e], 0xab
scasd eax, dword es:[edi]
mov al, byte [0xed6b6791]
mov al, byte [0x31a19b6a]
jae 0x6228e5
pop ebx
cmpsd dword [esi], dword es:[edi]
daa
clc
dec ebx
add ebx, dword [ecx + edx*4]
sbb al, 0x91
outsb dx, byte [esi]
stosd dword es:[edi], eax
fsubp st(2)
loope 0x6228c0
cmp dword [edx], ebx
ret 0x64be
Function at 0x627585
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x62e3d0
cmp edx, dword [eax]
je 0x6275a7
add eax, 8
inc ecx
cmp eax, 0x62e460
jl 0x627598
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x62e3d0]
jne 0x6276d5
mov eax, dword [0x636d78]
cmp eax, 1
je 0x6276af
test eax, eax
jne 0x6275d8
cmp dword [0x62e2f8], 1
je 0x6276af
cmp edx, 0xfc
je 0x6276d5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62760f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00627f70
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628400
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x627652
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628400
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62c6e4
push edi
call fcn.0062a2d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00627f70
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00627f80
lea eax, [ebp - 0xa0]
push 0x62c6c4
push eax
call fcn.00627f80
push dword [esi + 0x62e3d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00627f80
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062a244
add esp, 0x2c
pop edi
jmp 0x6276d5
lea eax, [ebp + 8]
lea esi, [esi + 0x62e3d4]
push 0
push eax
push dword [esi]
call fcn.00628400
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0xe9c370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xe9c38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xec5074
push ecx
mov edi, eax
call fcn.00eb0198
mov esi, eax
add esp, 8
test esi, esi
jne 0xe9c3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00eb002e
push esi
call fcn.00eaffb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xe9f850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xe9f8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xeca720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xe9f8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00eb01e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xe9f8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xeca720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xe9f92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00eb1082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xe9f957
mov word [eax], si
add eax, 2
push eax
call fcn.00eb1030
add esp, 4
jmp 0xe9f959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xe9f8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xe9f8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xe9fff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xea0080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0xea00c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xec5458
push ecx
call fcn.00eb01e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00eb01e1
add esp, 0x10
jmp 0xea00d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00eb020b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00eafdff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00ea0050
mov eax, dword [0xeca728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0xea013b
push esi
call fcn.00e9ffb0
add esp, 4
mov dword [0xeca728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0xea014c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00e9fff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0xea3440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0xea34b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xea348e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xea3471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xea347e
add edx, ecx
cmp ebx, edx
jb 0xea348a
inc edi
add eax, 0x28
cmp edi, esi
jb 0xea3467
xor ecx, ecx
jmp 0xea34a2
test eax, eax
jne 0xea3492
xor ecx, ecx
jmp 0xea34a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.00ea33c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0xea38f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0xea3921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0xea3946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0xea396e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0xea3993
push ecx
push esi
call fcn.00ea34c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret