joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47cd97
Capabilities:
Encode data using xor

Disassembly:
and edi, ebx
sbb ebx, dword [eax + 0x48]
lodsb al, byte [esi]
sahf
dec edx
sub al, 0x67
xchg edi, eax
invalid
add al, 0xda
add byte [eax + 0x2c], cl
lcall 0x5f8b, 0x4d572902
or dword [edx - 0x690d4153], ebx
xlatb
popfd
xchg ebx, eax
out dx, eax
inc ecx
lea ecx, [ebx + 0xb]
push 0xc8ef8a38
enter 0x3096, 0x6c
fst qword [ebp - 0x4b1c6244]
enter 0x859, 0xffffffffffffffaa
ficom dword [ebp + 0x7d70b0ba]
enter 0x3096, 0x6c
fst qword [ebp - 0x4b1c6244]
enter 0x859, 0xffffffffffffffaa
ficom dword [ebp + 0x7d70b0ba]
fadd st(6)
mov dword [edi - 0x46], esi
inc esp
pop ecx
push esi
or eax, 0xbf901a6f
not dword [ecx - 0x6d]
sbb eax, 0xde39a82d
jl 0x47cd69
adc dword [esp + edi*2 - 0x24], ebp
mov bl, dl
jo 0x47cd79
push edi
mov dword [esi + 0x1e5abb7e], ebx
push ds
in al, dx
dec edx
leave
jae 0x47cdf3
jno 0x47ce13
out dx, eax
in eax, dx
loop 0x47cdd0
inc esi
or byte [edi + ebx*4 - 0x3d], 0x46
xlatb
mov bl, 0x83
sbb dword [edx - 0x49478ce8], edx
push ss
out 0x41, al
push es
lds edx, [esi]
xor bh, dh
cmp dword [edx + edi + 0x24], edx
and al, 0x80
out 0x58, eax
idiv dword [ecx]
push esp
cmp ah, byte [esp]
and bh, 0x58
dec ebx
jmp 0x47ce74
insd dword es:[edi], dx
pop ss
push cs
jle 0x47cdf0
shr dh, 0xc5
mov dh, 0xf4
add byte [ebx], bl
nop
mov esi, 0x1a526db
jno 0x47cea7
js 0x47ce79
mov edx, 0x837af393
or al, 0x9a
fidivr word [eax - 0x3f]
adc eax, dword [ecx]
lcall 0x2f00, 0x1938730a
out 0xf5, al
sub byte [edi], 0x85
aaa
mov ebp, dword ss:[eax + 0x2d]
imul eax, dword [ebp + 0x1740d3a6], 0xed24bfaf
push esi
sbb edx, dword [ebp + 0x7ca93364]
fnstcw word [esi + 0xa8b5e3b]
push cs
or dword [esi + 0x28b8ffa], 0x4e0b0e1b
mov dh, 0x5d
sbb cl, byte [edi - 0x6a]
enter 0x49b, 0xffffffffffffffb7
add dword [ebx - 0x53], ebp
cmp esi, dword [edx]
or byte [esi], cl
imul ebp, dword [ebp + 0xe08323b], 0xffffffab
xor cl, byte [eax]
push cs
stosd dword es:[edi], eax
scasb al, byte es:[edi]
dec edx
scasd eax, dword es:[edi]
stc
cld
xor al, 0x1c
mov dh, 0xc3
cld
push ds
outsd dx, dword [esi]
pop ds
jp 0x47ce52
stosd dword es:[edi], eax
fimul word [edi]
wait
jmp dword [esp + edi*2 - 0x7ad6457d]
dec esi
pop ebx
cmp byte [ecx], ch
dec ebp
jo 0x47ce77
mov edi, 0x2be85a0d
fstp qword [edx - 0x72]
test eax, 0x184c0a1c
test byte [eax], 0x93
cli
add ecx, dword [esi - 0x36]
xor ah, ah
or bh, byte fs:[edi + 0x26]
cwde
xor cl, byte [eax]
aaa
cmp byte [edx + 0x79], bh
push ds
pop ecx
sbb esp, edx
fild dword [ecx + 0x25]
lodsd eax, dword [esi]
jge 0x47cec2
sbb dword [ecx - 0x67], edi
cmp bl, byte [esi + 0x7f]
xchg edx, eax
xchg dword [edx + 0x6b9fbb2e], ebx
sbb dword [esi], edi
retf

Function at 0x49b722
Capabilities:
Encode data using xor

Disassembly:
cmp al, 5
fcomp qword [ebp - 0x55593215]
or dword [eax + esi*2], edx
mov dh, 8
stc
adc al, byte [edx + 0x79]
and ch, byte [edi - 0x6c7524ff]
and dword [ebp + 0x15], edx
lodsd eax, dword [esi]
xor byte [edx + 0x12], ah
nop
mov eax, dword [0x7e9c9ea3]
and byte [ecx - 0x3919ec1b], 0x3a
rol dword [bx + di], 1
sub eax, 0x8802717e
lodsb al, byte [esi]
dec ecx
loope 0x49b72a
mov bh, 0x38
xchg edi, eax
wait
ljmp 0x9f3e
Function at 0x5abdcd
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx], 0x949136e7
pop esi
test dword [edi + 0x6d], edx
inc ecx
ror dword [esi + ecx*8 + 0x5e8d3580], cl
mov esi, 0x10bceede
cmpsd dword [esi], dword es:[edi]
cmp al, 0x45
lea ebx, [esi - 0x42]
fsubp st(6)
mov esp, 0x453ca710
xor byte [ecx], dl
cmpsb byte [esi], byte es:[edi]
in al, dx
mov eax, dword [0x92df985b]
bound ebp, qword [eax]
or byte [esi], bh
sti
jbe 0x5abd65
push esi
out 0x61, eax
invalid
scasd eax, dword es:[edi]
jbe 0x5abd75
add esi, dword [esi + 0x21]
aad 0xa2
jle 0x5abdf0
and al, 0x6c
add eax, 0xe3c7549e
fdivp st(4)
shl al, cl
wait
cli
or eax, 0x5c3ce66b
sub esi, edx
shr dword [ecx - 0x51], 1
or edi, ebx
sti
xchg esi, eax
stosd dword es:[edi], eax
pop ss
rol dword [ecx + 0x65], cl
adc bl, byte [ebp + 0x5094366c]
mov bh, 0x2a
pop esp
sti
xor al, 0x84
mov cl, 0x3e
cmp edx, dword [edi + 0x6f]
shl byte [0x1b0c7034], 0x76
aas
loope 0x5abe5c
and byte [eax + 0x5260c37d], dl
sbb cl, ch
mov ebp, 0x38f80ab4
ret
sub ch, al
sbb al, 0x7e
add bl, dh
adc byte [edx - 0x61], bl
enter 0xffffffffffffc6b7, 0x2c
leave
mov ecx, 0x98421bc
mov esi, 0x4341801b
and edx, dword [edi - 0x22]
and eax, 0xde45949a
imul esi, dword [0x6b584c90], 0xe573dcbc
dec edx
push edx
jbe 0x4d19c680
stosd dword es:[edi], eax
sbb al, 0xd7
dec ecx
pop ss
mov ss, word [ebp - 0x62]
dec edi
inc esp
or ecx, edx
or ecx, dword [ebp - 0x7df9ee74]
sub byte [edx], ah
arpl ax, sp
pop edi
and al, byte [ebx]
fcompi st(7)
jae 0x5abe2a
dec ebp
push eax
mul byte [ebp - 0x1d]
push ds
inc ebx
xor byte [edx - 0x7f], cl
adc byte [edi + 0x2e6923e8], bh
and ecx, dword [edi - 0x2c]
mov bl, 0xbe
mov ebp, 0xe98f4152
add ebp, dword [edx]
lodsd eax, dword [esi]
sub dword [eax + 0x7f], 0xffffff80
xchg edx, eax
sub al, 0x2d
stosb byte es:[edi], al
sub al, 0x59
neg ch
mov byte [0xea208644], al
dec ebx
rol dword [edx - 0x51ad5802], cl
dec ebp
invalid
Function at 0x627d11
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6313c0
cmp edx, dword [eax]
je 0x627d33
add eax, 8
inc ecx
cmp eax, 0x631450
jl 0x627d24
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6313c0]
jne 0x627e61
mov eax, dword [0x639d68]
cmp eax, 1
je 0x627e3b
test eax, eax
jne 0x627d64
cmp dword [0x6312e8], 1
je 0x627e3b
cmp edx, 0xfc
je 0x627e61
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x627d9b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006286f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628b80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x627dde
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628b80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62da64
push edi
call fcn.0062aa50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
dec eax
fisub dword [edx]
lea eax, [ebp + 8]
lea esi, [esi + 0x6313c4]
push 0
push eax
push dword [esi]
call fcn.00628b80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x402714
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
lea edi, [esi + 0x68]
lea ecx, [edi + 0xc]
call fcn.00403868
push 0
push 0x61
mov ecx, edi
call fcn.004061b5
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.00416160
mov edx, 0xce4
lea ecx, [ebp - 0xc]
call fcn.00402775
push dword [eax]
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0xc]
call fcn.00403304
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
xor eax, eax
pop esi
leave
ret 8

Function at 0x402b16
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x416d16
call fcn.00416430
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.00403770
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00402b70
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x402bc2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x416d61
call fcn.00416430
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.0040a543
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00402c18
push dword [esi + 0x24]
call fcn.00403304
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.00402542
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402fae
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x404521
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x40468c
Capabilities:
Create directory

Disassembly:
mov eax, 0x416f84
call fcn.00416430
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4046af
mov al, 1
jmp 0x4046f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4046c0
xor al, al
jmp 0x4046f4
lea ecx, [ebp - 0x44]
call fcn.00404e30
lea ecx, [ebp - 0x1c]
call fcn.00403770
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.00404e62
test al, al
je 0x4046e9
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.00403304
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404e53
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x404e61
or eax, eax
ret
Function at 0x40535f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405385
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x405385
xor al, al
jmp 0x4053a5
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00416760
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x413ad0
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x3e4
push ebp
lea eax, [esp + 4]
push esi
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x413afe
cmp dword [esp + 0xc], 6
jne 0x413afe
mov eax, dword [esp + 0x10]
test eax, eax
je 0x413b28
push str.SetDefaultDllDirectories
push 0x4187ec
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x413b28
push 0xc00
call eax
test eax, eax
jne 0x413bdc
lea ecx, [esp + 0x11c]
push 0x106
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x413bdc
cmp eax, 0x104
ja 0x413bdc
lea edx, [esp + 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
cmp word [esp + ebp*2 + 0x11a], 0x5c
je 0x413b74
mov word [esp + ebp*2 + 0x11c], 0x5c
inc ebp
mov esi, dword [str.UXTHEME]
cmp byte [esi], 0
je 0x413bdc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov al, byte [esi]
inc esi
movsx cx, al
test al, al
mov word [esp + ebp*2 + 0x124], cx
je 0x413bb8
lea ecx, [esp + ebp*2 + 0x126]
mov al, byte [esi]
inc esi
movsx dx, al
mov word [ecx], dx
add ecx, 2
test al, al
jne 0x413ba7
lea eax, [esp + 0x124]
push str..dll
push eax
call edi
lea ecx, [esp + 0x124]
push 8
push 0
push ecx
call ebx
cmp byte [esi], 0
jne 0x413b8d
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x3e4
ret
Function at 0x416170
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x416198
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4161a7
mov eax, 1
ret 4
Function at 0x4887d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x599750
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x5e89c0], 1
jge 0x5997bf
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x599795
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x599795
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x599772
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5997ab
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x5997b2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x5998af
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x599880
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x599875
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x599869
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x599870
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x5998af
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x5998aa
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x599893
mov eax, dword [ebx + 8]
jmp 0x5998af
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x5998a1
xor eax, eax
jmp 0x5998af
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5997df
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x48adb3
Capabilities:
Query environment variable

Disassembly:
jmp 0x580f67
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x580f7b
xor edi, edi
jmp 0x580fbf
push ebx
push esi
call fcn.00580e60
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.0048b682
mov edi, eax
add esp, 0x14
test edi, edi
je 0x580fac
push ebx
push esi
push edi
call fcn.0048af2a
add esp, 0xc
push 2
push 0
call fcn.0048bed9
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x98c370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x98c38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x9b5074
push ecx
mov edi, eax
call fcn.009a0198
mov esi, eax
add esp, 8
test esi, esi
jne 0x98c3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.009a002e
push esi
call fcn.0099ffb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x98f850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x98f8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x9ba720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x98f8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.009a01e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x98f8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x9ba720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x98f92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.009a1082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x98f957
mov word [eax], si
add eax, 2
push eax
call fcn.009a1030
add esp, 4
jmp 0x98f959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x98f8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x98f8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x98fff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x990080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x9900c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x9b5458
push ecx
call fcn.009a01e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.009a01e1
add esp, 0x10
jmp 0x9900d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.009a020b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.0099fdff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00990050
mov eax, dword [0x9ba728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x99013b
push esi
call fcn.0098ffb0
add esp, 4
mov dword [0x9ba728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x99014c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.0098fff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x993440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x9934b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x99348e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x993471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x99347e
add edx, ecx
cmp ebx, edx
jb 0x99348a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x993467
xor ecx, ecx
jmp 0x9934a2
test eax, eax
jne 0x993492
xor ecx, ecx
jmp 0x9934a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.009933c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x9938f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x993921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x993946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x99396e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x993993
push ecx
push esi
call fcn.009934c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x994c00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x994c4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x994c2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0x994c38
add edx, eax
cmp ebx, edx
jb 0x994c46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0x994c21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0x994c50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0x994c70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x994cb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x994c9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x994ca8
add edx, ecx
cmp ebx, edx
jb 0x994cb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x994c91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x994f60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.009a1145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x994ffb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x994fdd
lea eax, [esp + 0x18]
push eax
jmp 0x994fe2
push 0x9ba720
call fcn.009a0fd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x994fb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x994f40
push 4
push ecx
push eax
call fcn.009a143f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret