joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401047
Capabilities:
Reference ncr atm library routines

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
lea ebx, [ebp - 0x20a]
push ebx
push dword [ebp + 8]
call sub.MSXFS.dll_WFSStartUp
or eax, eax
jne 0x40106e
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x401084
Capabilities:
Reference ncr atm library routines

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
lea ebx, [ebp - 0x212]
lea esi, [ebp - 0x418]
push edi
push 0x206
push ebx
call sub.ntdll.dll_RtlFillMemory
push edi
push 0x206
push esi
call sub.ntdll.dll_RtlFillMemory
lea eax, [ebp - 4]
push eax
push esi
push ebx
push dword [ebp + 0xc]
push 0
push 0x1f
push 0x40101f
push 0
push dword [ebp + 8]
call sub.MSXFS.dll_WFSOpen
cmp dword [ebp - 4], edi
je 0x401115
cmp dword [ebp + 0x10], edi
je 0x4010f2
cmp dword [ebp + 0x14], edi
je 0x4010f2
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp - 4]
call sub.MSXFS.dll_WFSRegister
cmp dword [ebp + 0x18], edi
je 0x401115
mov dword [ebp - 8], edi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 4]
call sub.MSXFS.dll_WFSLock
cmp dword [ebp - 8], edi
je 0x401115
push dword [ebp - 8]
call sub.MSXFS.dll_WFSFreeResult
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x40111f
Capabilities:
Reference ncr atm library routines

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
call sub.MSXFS.dll_WFSLock
cmp dword [ebp - 8], edi
je 0x401148
push dword [ebp - 8]
call sub.MSXFS.dll_WFSFreeResult
mov dword [ebp - 8], edi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.MSXFS.dll_WFSExecute
push dword [ebp - 8]
pop dword [ebp - 4]
push dword [ebp + 8]
call sub.MSXFS.dll_WFSUnlock
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x401177
Capabilities:
Reference ncr atm library routines

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
lea eax, [ebp - 8]
push eax
push 0x708
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.MSXFS.dll_WFSGetInfo
push dword [ebp - 8]
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4011ae
Capabilities:
Reference ncr atm library routines

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 8]
push dword [ebp + 8]
call sub.MSXFS.dll_WFSClose
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100101c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.10031780
mov eax, dword [0x10041d40]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb4]
push ebp
push esi
mov esi, dword [esp + 0xc4]
xor ebp, ebp
mov eax, dword [eax + 4]
push edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x14], eax
sub eax, edi
mov dword [esp + 0x10], eax
cmp esi, edi
jae 0x10010226
push str.orig_len___md_size
push pe_nt_image_headers32
push str.._ssl_s3_cbc.c
call sub.LIBEAY32.dll_Ordinal_3244
add esp, 0xc
cmp edi, 0x40
jbe 0x10010242
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call sub.LIBEAY32.dll_Ordinal_3244
add esp, 0xc
lea eax, [esp + 0x34]
neg eax
lea ebx, [esp + 0x34]
and eax, 0x3f
add ebx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0x1c], ebx
cmp esi, eax
jbe 0x10010269
mov ebp, esi
sub ebp, edi
sub ebp, 0x100
mov eax, edi
xor edx, edx
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, dword [esp + 0x10]
div edi
push edi
mov esi, edx
push 0
push ebx
mov dword [esp + 0x30], esi
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0xc8]
jae 0x1001035f
mov ecx, dword [esp + 0x10]
mov edx, ecx
mov ebx, dword [esp + 0x14]
mov esi, ebx
mov eax, dword [esp + 0xc0]
sub esi, ecx
shr edx, 0x1f
mov dword [esp + 0x28], edx
mov edx, ebx
shr edx, 0x1f
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], edx
mov edx, ebp
sub edx, ebx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x1c]
add eax, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov eax, dword [esp + 0x28]
inc ebp
shr ecx, 0x1f
lea ebx, [ebx + edx]
shr edx, 0x1f
xor dl, byte [esp + 0x14]
shr ebx, 0x1f
xor bl, al
xor al, cl
or bl, al
mov al, cl
xor al, byte [esp + 0x14]
xor bl, cl
or dl, al
dec bl
mov eax, dword [esp + 0x10]
xor dl, cl
mov ecx, dword [esp + 0x30]
dec dl
not dl
mov al, byte [ecx + eax]
mov ecx, dword [esp + 0x18]
and dl, al
and dl, bl
or byte [ecx + esi], dl
mov edx, ecx
inc edx
mov ecx, edx
mov eax, edx
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x10], edx
cmp ebp, dword [esp + 0xc8]
jb 0x100102e0
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
xor edx, edx
test edi, edi
je 0x1001039a
mov ebp, dword [esp + 0x2c]
lea esp, [esp]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + ebx]
movzx eax, byte [esi + ebx]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x10010370
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10031766
add esp, 0xa8
ret
Function at 0x10010e10
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.10031780
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
inc ebp
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x38], 1
je 0x10010e58
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
lea eax, [ecx + ebp]
cmp eax, edx
jbe 0x10010e4b
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub edx, ecx
mov dword [esi + 4], edx
jmp 0x10010e5d
cmp ebp, dword [esi + 4]
ja 0x10010e44
test dword [edi + 0x100], 0x200
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 4]
push ebx
movzx ebx, byte [ecx + eax - 1]
je 0x10010eb0
cmp dword [edi + 0x88], 0
jne 0x10010eb0
mov eax, dword [edi + 0x58]
push 8
add eax, 8
push 0x10034410
push eax
call sub.LIBEAY32.dll_Ordinal_3906
add esp, 0xc
test eax, eax
jne 0x10010ea3
test bl, 1
jne 0x10010ea3
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov eax, dword [edi + 0x58]
test byte [eax], 8
je 0x10010eb0
test ebx, ebx
je 0x10010eb0
dec ebx
mov eax, dword [edi + 0x80]
push dword [eax]
call sub.LIBEAY32.dll_Ordinal_3857
add esp, 4
test eax, 0x200000
je 0x10010eda
or eax, 0xffffffff
sub eax, ebx
add dword [esi + 4], eax
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov edx, dword [esi + 4]
lea ecx, [ebx + ebp]
mov edi, edx
mov dword [esp + 0x10], edx
sub edi, ecx
mov eax, edx
xor edi, ecx
xor eax, ecx
or edi, eax
mov ecx, 0xff
xor edi, edx
lea eax, [edx - 1]
shr edi, 0x1f
dec edi
cmp eax, ecx
cmovb ecx, eax
xor ebp, ebp
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x10010f5d
mov eax, dword [esi + 0xc]
mov ecx, ebx
shr ecx, 0x1f
lea esi, [edx - 1]
mov dword [esp + 0x24], ecx
add esi, eax
mov edi, edi
mov al, byte [esp + 0x24]
lea esi, [esi - 1]
mov edx, ebx
mov ecx, ebp
sub edx, ebp
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
inc ebp
or dl, al
movzx eax, byte [esi + 1]
xor dl, byte [esp + 0x24]
xor eax, ebx
dec dl
movzx ecx, dl
and ecx, eax
not ecx
and edi, ecx
cmp ebp, dword [esp + 0x18]
jb 0x10010f20
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
not edi
lea eax, [ebx + 1]
and edi, 0xff
pop ebx
lea ecx, [edi - 1]
not edi
shr ecx, 0x1f
shr edi, 0x1f
and ecx, edi
neg ecx
and eax, ecx
sub edx, eax
shl eax, 8
or dword [esi], eax
mov eax, ecx
pop edi
mov dword [esi + 4], edx
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebp
pop ecx
ret
Function at 0x10018330
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.10031780
push ebx
push esi
push edi
lea eax, [esp + 0x14]
xor esi, esi
push eax
lea eax, [esp + 0x10]
xor edi, edi
push eax
push esi
call fcn.10029cc0
add esp, 0xc
test eax, eax
je 0x10018539
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
shl eax, 0xa
test ebx, eax
je 0x1001836c
inc edi
lea eax, [esp + 0x14]
inc esi
push eax
lea eax, [esp + 0x10]
push eax
push esi
call fcn.10029cc0
add esp, 0xc
test eax, eax
jne 0x10018360
test edi, edi
je 0x10018539
mov ecx, dword [esp + 0x50]
mov eax, ecx
cdq
idiv edi
push ebp
mov ebp, dword [esp + 0x58]
mov esi, eax
xor eax, eax
mov dword [esp + 0x14], esi
cmp edi, 1
mov edi, dword [esp + 0x60]
push edi
push eax
cmove ecx, eax
push ebp
mov dword [esp + 0x60], ecx
call sub.MSVCR120.dll_memset
lea eax, [esp + 0x24]
mov dword [esp + 0x28], 0
push eax
lea eax, [esp + 0x20]
push eax
push 0
call fcn.10029cc0
add esp, 0x18
test eax, eax
je 0x10018504
mov ebx, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
shl eax, 0xa
test dword [esp + 0x24], eax
je 0x100184e0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x10018511
push edi
push ebx
push dword [esp + 0x54]
mov eax, dword [esp + 0x60]
push dword [esp + 0x54]
and eax, 1
push dword [esp + 0x54]
add eax, esi
mov esi, dword [esp + 0x64]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push eax
push esi
push ecx
call fcn.10018560
add esp, 0x3c
test eax, eax
je 0x1001852f
add esi, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x50], esi
test edi, edi
jle 0x100184dc
cmp edi, 0x20
jb 0x100184c1
lea eax, [ebx - 1]
lea edx, [ebp - 1]
add eax, edi
add edx, edi
cmp ebp, eax
ja 0x10018470
cmp edx, ebx
jae 0x100184c1
mov eax, edi
and eax, 0x8000001f
jns 0x1001847e
dec eax
or eax, 0xffffffe0
inc eax
mov edx, edi
mov esi, ebx
sub edx, eax
mov eax, ebp
sub esi, ebp
jmp 0x10018490
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movdqu xmm1, xmmword [esi + eax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x20], xmm1
movdqu xmm1, xmmword [ebx + ecx + 0x10]
add ecx, 0x20
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x10], xmm1
cmp ecx, edx
jl 0x10018490
cmp ecx, edi
jge 0x100184dc
mov esi, ebx
lea eax, [ecx + ebp]
mov edx, edi
sub esi, ebp
sub edx, ecx
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
dec edx
jne 0x100184d0
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
inc eax
push ecx
push eax
mov dword [esp + 0x28], eax
call fcn.10029cc0
add esp, 0xc
test eax, eax
jne 0x100183e0
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call sub.LIBEAY32.dll_Ordinal_252
add esp, 0x14
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0x109
push str.._ssl_t1_enc.c
push 0x44
push 0x11c
push 0x14
call sub.LIBEAY32.dll_Ordinal_252
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x40baa0
Capabilities:
Set environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1dc
mov eax, dword [esp + 0x1f4]
mov ecx, dword [section..data]
xor ecx, esp
mov dword [esp + 0x1d8], ecx
lea esi, [esp + 0x108]
push eax
push 0x424aca
push 0x80
push esi
call fcn.0040bc40
add esp, 0x10
mov word [esp + 8], 0
movzx ebx, byte [esp + 0x108]
test bl, bl
je 0x40bb72
mov dword [esp], esi
mov edi, 0x80
lea esi, [esp + 8]
xor eax, eax
mov ebp, esi
mov ecx, edi
test ax, ax
je 0x40bb1d
mov ecx, edi
mov eax, esi
nop dword [eax]
lea ebp, [eax + 2]
dec ecx
cmp word [eax + 2], 0
mov eax, ebp
jne 0x40bb10
test ecx, ecx
je 0x40bc31
push ebp
call fcn.00412970
add esp, 4
lea eax, [eax*2]
add eax, ebp
mov byte [esp + 0x188], bl
mov byte [esp + 0x189], 0
push 2
lea ecx, [esp + 0x18c]
push ecx
push eax
call fcn.004122c3
add esp, 0xc
mov eax, dword [esp]
movzx ebx, byte [eax + 1]
test bl, bl
je 0x40bb72
inc eax
mov dword [esp], eax
dec edi
movzx eax, word [esi + 2]
add esi, 2
jmp 0x40bb00
mov eax, dword [esp + 0x1f0]
mov word [esp + 0x188], 0
movzx ebx, byte [eax]
test bl, bl
je 0x40bc05
mov dword [esp], eax
mov edi, 0x28
lea esi, [esp + 0x188]
xor eax, eax
nop dword [eax + eax]
mov ebp, esi
mov ecx, edi
test ax, ax
je 0x40bbbd
mov ecx, edi
mov eax, esi
nop dword [eax]
lea ebp, [eax + 2]
dec ecx
cmp word [eax + 2], 0
mov eax, ebp
jne 0x40bbb0
test ecx, ecx
je 0x40bc31
push ebp
call fcn.00412970
add esp, 4
lea eax, [eax*2]
add eax, ebp
mov byte [esp + 6], bl
mov byte [esp + 7], 0
push 2
lea ecx, [esp + 0xa]
push ecx
push eax
call fcn.004122c3
add esp, 0xc
mov eax, dword [esp]
movzx ebx, byte [eax + 1]
test bl, bl
je 0x40bc05
inc eax
mov dword [esp], eax
dec edi
movzx eax, word [esi + 2]
add esi, 2
jmp 0x40bba0
lea eax, [esp + 8]
lea ecx, [esp + 0x188]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esp + 0x1d8]
xor ecx, esp
call fcn.0040d9a4
add esp, 0x1dc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0041224e
int3
Function at 0x40c4b0
Capabilities:
Check if file exists
Get file attributes
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [0x42c904]
test eax, eax
je 0x40c4f5
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40c4e9
push 0
push dword [0x42c904]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x42c904]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x42f128], 1
jne 0x40c574
movups xmm0, xmmword [0x420fe2]
movups xmmword [esp + 0xe], xmm0
movups xmm0, xmmword [0x420fd4]
movups xmmword [esp], xmm0
mov eax, esp
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edi, 0x14
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
nop word cs:[eax + eax]
push 0x42c90c
call ebx
cmp eax, 0xffffffff
je 0x40c574
and eax, 0x10
je 0x40c574
push 0x64
call ebp
movups xmm0, xmmword [0x420fe2]
movups xmmword [esp + 0xe], xmm0
movups xmm0, xmmword [0x420fd4]
movups xmmword [esp], xmm0
mov eax, esp
push eax
call esi
dec edi
jne 0x40c540
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0040d9a4
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d780
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
test edx, edx
je 0x40d86a
mov esi, edx
mov edi, ecx
mov ebp, dword [0x431140]
mov eax, dword [0x431144]
mov dword [esp], 0
jmp 0x40d7e6
cmp esi, ebp
cmovb ebp, esi
add eax, dword [0x43113c]
push ebp
push eax
push edi
call fcn.0040e830
add esp, 0xc
add edi, ebp
sub esi, ebp
add ebp, dword [0x431144]
mov dword [0x431144], ebp
mov eax, ebp
mov ebp, dword [0x431140]
test esi, esi
je 0x40d86a
sub ebp, eax
jne 0x40d7b0
mov ecx, dword [0x42e918]
mov edx, dword [0x42e914]
cmp ecx, edx
jb 0x40d810
mov ebx, dword [esp]
and bl, 1
jne 0x40d810
mov ebp, eax
cmp edx, ecx
je 0x40d7de
jmp 0x40d872
mov dword [0x431144], 0
mov dword [0x431140], 0x20000
push 0x42e910
push 0x43113c
push dword [0x431148]
call fcn.00409b60
add esp, 0xc
cmp eax, 0xffffff89
jae 0x40d872
mov ebp, dword [0x431144]
cmp ebp, dword [0x431140]
sete al
mov dword [esp], eax
mov dword [0x431140], ebp
mov dword [0x431144], 0
xor eax, eax
jmp 0x40d7de
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push str.Error__couldnt_decode_attached_data.
call fcn.00412490
add esp, 4
push 2
call fcn.004110e5
int3

Function at 0x40d890
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
mov eax, 0x2004
call fcn.0040d9c0
mov esi, ecx
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2000], eax
mov ecx, dword [0x42c908]
test ecx, ecx
je 0x40d8bd
test ecx, ecx
jg 0x40d8fb
jmp 0x40d91d
mov edi, esp
push 0x1000
push 0x424c42
push edi
call fcn.0040bcb0
add esp, 0xc
test al, al
je 0x40d99a
push edi
call fcn.00412072
add esp, 4
mov ecx, dword [0x42c908]
mov dword [ecx*4 + 0x43194c], eax
inc ecx
mov dword [0x42c908], ecx
test ecx, ecx
jle 0x40d91d
xor edi, edi
nop dword [eax]
push dword [edi*4 + 0x43194c]
push esi
call fcn.00412930
add esp, 8
test eax, eax
je 0x40d97e
inc edi
cmp edi, dword [0x42c908]
jl 0x40d900
push esi
call fcn.00412970
add esp, 4
cmp eax, 2
jne 0x40d934
mov bl, 1
cmp word [esi + 2], 0x3a
je 0x40d980
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x40d951
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
test bl, bl
je 0x40d980
cmp dword [0x42c908], 0x3ff
jg 0x40d980
push esi
call fcn.00412072
add esp, 4
mov ecx, dword [0x42c908]
mov dword [ecx*4 + 0x43194c], eax
inc ecx
mov dword [0x42c908], ecx
mov bl, 1
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.0040d9a4
mov eax, ebx
add esp, 0x2004
pop esi
pop edi
pop ebx
ret
mov ecx, 0x424c42
call fcn.0040cd50

Function at 0x40e0f5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40e134
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e134
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e134
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40e134
cmp dword [ecx + 0x74], 0xe
jbe 0x40e134
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x7b4370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x7b438e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x7dd074
push ecx
mov edi, eax
call fcn.007c8198
mov esi, eax
add esp, 8
test esi, esi
jne 0x7b43cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.007c802e
push esi
call fcn.007c7fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x7b7850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x7b78ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x7e2720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x7b78ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.007c81e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x7b78ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x7e2720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x7b792a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.007c9082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x7b7957
mov word [eax], si
add eax, 2
push eax
call fcn.007c9030
add esp, 4
jmp 0x7b7959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x7b78ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x7b78b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x7b7ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x7b8080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x7b80c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x7dd458
push ecx
call fcn.007c81e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.007c81e1
add esp, 0x10
jmp 0x7b80d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.007c820b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.007c7dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.007b8050
mov eax, dword [0x7e2728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x7b813b
push esi
call fcn.007b7fb0
add esp, 4
mov dword [0x7e2728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x7b814c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.007b7ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x7bb440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x7bb4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x7bb48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x7bb471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x7bb47e
add edx, ecx
cmp ebx, edx
jb 0x7bb48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x7bb467
xor ecx, ecx
jmp 0x7bb4a2
test eax, eax
jne 0x7bb492
xor ecx, ecx
jmp 0x7bb4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.007bb3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x7bb8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x7bb921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x7bb946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x7bb96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x7bb993
push ecx
push esi
call fcn.007bb4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret