joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100db912
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x101b6043]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.100db1ae
mov eax, dword [0x101cf4d4]
add eax, 0xffffe70f
mov dword [0x101cf4d4], eax
call fcn.100db4d5
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.100dae4c
cmp eax, 0
mov dword [ebp - 0x3c], eax
je 0x100dba26
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x101cf4d4]
add ecx, 0x1acf
mov dword [0x101cf4d4], ecx
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.100db71e
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x54], ecx
mov dword [0x101cf4d4], 0x112
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0x4c], ecx
add ecx, 0x1828
mov esi, dword [ebp - 0x40]
cmp esi, 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
je 0x100dba1c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add esp, 0x50
pop esi
pop edi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop edi
pop ebp
ret
Function at 0x100dbbc9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov ecx, dword [0x101cf4d4]
add ecx, 0x4b29
mov dword [0x101cf4d4], ecx
mov dword [ebp - 0x10], eax
call fcn.100db2bd
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x101cf4d8], 0x47e5
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x101cf4d4], 0x660
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x100dbd4c
jmp 0x100dbcc6
mov eax, dword [ebp - 0x28]
add eax, 1
mov cl, byte [ebp - 0x29]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x2a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x30], eax
jne 0x100dbc98
jmp 0x100dbc8f
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
xor esi, esi
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + eax*4]
add edx, 0x24f8
mov dword [0x101cf4d4], edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x30], esi
jmp 0x100dbc98
mov al, byte [ebp - 0x2a]
test al, 1
jne 0x100dbd15
jmp 0x100dbce5
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x29], bh
mov byte [ebp - 0x2a], cl
je 0x100dbc8f
jmp 0x100dbc37
mov eax, 0x660
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x24]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
jmp 0x100dbc61
xor eax, eax
mov ecx, dword [ebp - 0x44]
add ecx, 2
mov edx, dword [ebp - 0x40]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x24], eax
jb 0x100dbc61
jmp 0x100dbd4c
mov eax, dword [ebp - 0x20]
add eax, 0x1c
mov ecx, dword [ebp - 0x44]
movzx edx, word [ecx]
mov esi, dword [ebp - 0x1c]
add esi, eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x50]
add eax, dword [ecx]
mov dword [0x101cf4d4], 0xc39
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x54]
add edx, dword [eax + esi*4]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100dbd57
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x101cf4dc], 0
mov dword [0x101cf4e0], 0
mov dword [0x101cf4ec], 0
mov dword [0x101cf4d8], 0x14e0
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x100dbdc8
mov dword [0x101cf4d8], 0xe7d
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x101cf4d4], 0xb69
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101cf4dc], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101cf4e0], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101cf4e4], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x101cf4d4], 0x226c
mov cl, byte [0x101cf4e4]
mov edx, dword [0x101cf4e0]
mov byte [edi + edx], cl
mov edx, dword [0x101cf4dc]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101cf4e0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x101cf4ec], ebx
mov dword [0x101cf4d4], 0x11c5
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov byte [ebx + edx], cl
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x38], edx
je 0x100dbdb6
mov eax, dword [0x101cf4dc]
mov ecx, dword [0x101cf4e0]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
jmp 0x100dbdc8
Function at 0x12749a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x12b8e10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x12d2014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x12d30ec
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.012880c0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x12d2a8c
push eax
call fcn.012880c0
mov esi, dword [0x12d30fc]
xor ebx, ebx
mov edi, dword [0x12d3100]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x12d6390], bl
mov eax, ebx
mov ecx, 0x12d30ec
cmovae ecx, dword [0x12d30ec]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x12d64a0], al
inc ebx
cmp ebx, 0x100
jl 0x1274a20
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x12d6390]
movzx eax, byte [esi + 0x12d64a0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x1274a74
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x12d6390]
mov byte [esi + 0x12d6390], al
inc esi
mov byte [edi + 0x12d6390], dl
cmp esi, 0x100
jl 0x1274a50
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.01274690
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x1274ac9
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1274abf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1274b1f
push edx
push ecx
call fcn.0128d663
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x1274b0b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1274b01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1274b1f
push edx
push ecx
call fcn.0128d663
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.012a6c6a
int3
Function at 0x12770a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x12d2014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x9e0788
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1277289
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x1277289
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.012a40f0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x9e088b
nop
test eax, eax
je 0x1277289
push 4
push 0x1000
push 4
push 0
call 0x9e008d
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x4500e6
nop
test eax, eax
je 0x1277289
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x12c8df8
push dword [esp + 0x30]
call 0x450511
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x12771ac
push 0x12c8dfc
push 0x12c8e14
call 0x9d0c36
nop
push eax
call 0x4502e2
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x45037c
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x1277289
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x9e0672
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x1277243
mov dword [esp + 0xc], eax
call fcn.01276ef0
push eax
call 0x5606c8
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x9e0672
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x12771f2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x9e0672
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x450766
nop
push dword [esp + 0x24]
call 0x9d0cc0
nop
push 0x8000
push 0
push esi
call 0x9e05aa
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0128cff1
mov esp, ebp
pop ebp
ret
Function at 0x127af20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x12b9726
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x12d2014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x414], ebx
push 0
mov dword [ebp - 0x414], ebx
call fcn.012a8b63
push eax
call fcn.012a6660
add esp, 8
call fcn.012a663f
cdq
mov ecx, 0x3313
idiv ecx
mov edi, edx
call fcn.012a663f
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
imul esi, edi
call fcn.012a663f
imul edx, eax, 0x4d
lea ecx, [ebp - 0x444]
add edx, 0x64
add edx, esi
call fcn.012745b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
lea edx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x444]
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x127afd0
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x127afe6
push 0x40
push 0
push 0x12d8560
sub esi, ecx
call fcn.012a40f0
add esp, 0xc
mov dword [0x12d8554], 0
mov edx, esi
mov dword [0x12d8550], 0
lea ecx, [ebp - 0x410]
mov dword [0x12d8540], 0x67452301
mov dword [0x12d8544], 0xefcdab89
mov dword [0x12d8548], 0x98badcfe
mov dword [0x12d854c], 0x10325476
call fcn.01275530
call fcn.012755f0
mov ecx, 0x12d65a0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0xf
mov byte [ebp - 0x42c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x127b071
sub ecx, edx
push ecx
push 0x12d65a0
lea ecx, [ebp - 0x42c]
call fcn.012880c0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0x127b0cc
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x127b0c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x127b18c
push edx
push ecx
call fcn.0128d663
add esp, 8
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x41c]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
cmp eax, 1
jb 0x127b187
dec eax
mov ecx, 0xa
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push ecx
inc eax
mov ecx, ebx
push eax
call fcn.012880c0
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0x127b169
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x127b15f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x127b18c
push edx
push ecx
call fcn.0128d663
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0128cff1
mov esp, ebp
pop ebp
ret
call fcn.01288200
call fcn.012a6c6a
int3
Function at 0x128dcc7
Capabilities:
Parse pe header

Disassembly:
push 0
call 0xa614d3
nop
test eax, eax
je 0x128dd07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x128dd07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x128dd07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x128dd07
cmp dword [ecx + 0x74], 0xe
jbe 0x128dd07
cmp dword [ecx + 0xe8], 0
je 0x128dd07
mov al, 1
ret
xor al, al
ret
Function at 0x107c370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x107c38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x10a5074
push ecx
mov edi, eax
call fcn.01090198
mov esi, eax
add esp, 8
test esi, esi
jne 0x107c3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0109002e
push esi
call fcn.0108ffb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x107f850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x107f8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x10aa720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x107f8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.010901e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x107f8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x10aa720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x107f92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.01091082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x107f957
mov word [eax], si
add eax, 2
push eax
call fcn.01091030
add esp, 4
jmp 0x107f959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x107f8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x107f8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x107fff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1080080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x10800c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x10a5458
push ecx
call fcn.010901e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.010901e1
add esp, 0x10
jmp 0x10800d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0109020b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.0108fdff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.01080050
mov eax, dword [0x10aa728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x108013b
push esi
call fcn.0107ffb0
add esp, 4
mov dword [0x10aa728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x108014c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.0107fff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x1083440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x10834b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x108348e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1083471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x108347e
add edx, ecx
cmp ebx, edx
jb 0x108348a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1083467
xor ecx, ecx
jmp 0x10834a2
test eax, eax
jne 0x1083492
xor ecx, ecx
jmp 0x10834a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.010833c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x10838f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1083921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x1083946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x108396e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x1083993
push ecx
push esi
call fcn.010834c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x1084c00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x1084c4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x1084c2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0x1084c38
add edx, eax
cmp ebx, edx
jb 0x1084c46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0x1084c21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0x1084c50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0x1084c70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x1084cb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1084c9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x1084ca8
add edx, ecx
cmp ebx, edx
jb 0x1084cb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1084c91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x1084f60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.01091145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x1084ffb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1084fdd
lea eax, [esp + 0x18]
push eax
jmp 0x1084fe2
push 0x10aa720
call fcn.01090fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x1084fb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x1084f40
push 4
push ecx
push eax
call fcn.0109143f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret