joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a67e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1005c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100228af
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100228af
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1002a6f5
cmp word [ecx], dx
je 0x1002a6f5
mov eax, dword [0x10050f4c]
push edi
dec eax
push eax
push 0x10050e38
call fcn.1002a61d
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1002a768
cmp word [eax], dx
je 0x1002a768
mov eax, dword [edi]
test eax, eax
je 0x1002a719
cmp word [eax], dx
je 0x1002a719
lea eax, [ebp - 0x10]
push eax
call fcn.1002a000
jmp 0x1002a722
lea eax, [ebp - 0x10]
push eax
call fcn.1002a09b
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1002a792
mov eax, dword [0x10050e34]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10050b28
call fcn.1002a61d
add esp, 0xc
test al, al
je 0x1002a792
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1002a75d
cmp word [eax], di
je 0x1002a75d
lea eax, [ebp - 0x10]
push eax
call fcn.1002a000
pop ecx
jmp 0x1002a794
lea eax, [ebp - 0x10]
push eax
call fcn.1002a09b
jmp 0x1002a75a
mov eax, dword [edi]
test eax, eax
je 0x1002a77f
cmp word [eax], dx
je 0x1002a77f
lea eax, [ebp - 0x10]
push eax
call fcn.10029fb5
pop ecx
jmp 0x1002a792
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1002a85d
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1002a4a2
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1002a85d
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1002a85d
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1002a85d
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1002a7ea
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10025ea5
test ebx, ebx
je 0x1002a858
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10025ea5
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1002a85d
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1002a85d
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1002c668
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1002a85f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100191f9
leave
ret
Function at 0x1002e280
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002e2ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002e2ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e004]
jne 0x40100a
repz ret
jmp fcn.00401587

Function at 0x40444b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00401e3b
and dword [ebp - 0x14], 0
cmp dword [0x4408c8], 0
mov dword [ebp - 0x18], eax
jne 0x4044fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4045a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4045a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4408c8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4408cc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4408d0], eax
call edi
push eax
call esi
mov dword [0x4408d8], eax
test eax, eax
je 0x4044fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4408d4], eax
mov eax, dword [0x4408d4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404557
cmp dword [0x4408d8], ecx
je 0x404557
push eax
call esi
push dword [0x4408d8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404557
test ebx, ebx
je 0x404557
call edi
test eax, eax
je 0x40454e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40454e
test byte [ebp - 8], 1
jne 0x404557
or dword [ebp + 0x10], 0x200000
jmp 0x40458a
mov eax, dword [0x4408cc]
cmp eax, dword [ebp - 0x18]
je 0x40458a
push eax
call esi
test eax, eax
je 0x40458a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40458a
mov eax, dword [0x4408d0]
cmp eax, dword [ebp - 0x18]
je 0x40458a
push eax
call esi
test eax, eax
je 0x40458a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4408c8]
call esi
test eax, eax
je 0x4045a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4045a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x401000
Capabilities:
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
lea eax, [ebp - 0x214]
mov ebx, 0x61
add bx, 0x14
mov word [eax], bx
sub bx, 2
mov word [eax + 2], bx
sub bx, 0xe
mov word [eax + 4], bx
add bx, 0xd
mov word [eax + 6], bx
sub bx, 0x3f
mov word [eax + 8], bx
dec bx
mov word [eax + 0xa], bx
sub bx, 4
mov word [eax + 0xc], bx
add bx, 0x36
mov word [eax + 0xe], bx
add bx, 8
mov word [eax + 0x10], bx
mov word [eax + 0x12], bx
mov word [eax + 0x14], 0
push eax
push 0xec0e4ea4
push 0x6a4abc5b
call fcn.00401236
call eax
lea eax, [ebp - 0x214]
mov ebx, 0x61
add bx, 0x12
mov word [eax], bx
sub bx, 0xb
mov word [eax + 2], bx
sub bx, 3
mov word [eax + 4], bx
add bx, 7
mov word [eax + 6], bx
mov word [eax + 8], bx
sub bx, 0x39
mov word [eax + 0xa], bx
dec bx
mov word [eax + 0xc], bx
sub bx, 4
mov word [eax + 0xe], bx
add bx, 0x36
mov word [eax + 0x10], bx
add bx, 8
mov word [eax + 0x12], bx
mov word [eax + 0x14], bx
mov word [eax + 0x16], 0
push eax
push 0xec0e4ea4
push 0x6a4abc5b
call fcn.00401236
call eax
lea eax, [ebp - 0x214]
mov ebx, 0x61
add bx, 0x12
mov word [eax], bx
sub bx, 0xb
mov word [eax + 2], bx
add bx, 4
mov word [eax + 4], bx
add bx, 0xb
mov word [eax + 6], bx
sub bx, 0x16
mov word [eax + 8], bx
add bx, 0xf
mov word [eax + 0xa], bx
sub bx, 7
mov word [eax + 0xc], bx
sub bx, 0x3b
mov word [eax + 0xe], bx
add bx, 0x36
mov word [eax + 0x10], bx
add bx, 8
mov word [eax + 0x12], bx
mov word [eax + 0x14], bx
mov word [eax + 0x16], 0
push eax
push 0xec0e4ea4
push 0x6a4abc5b
call fcn.00401236
call eax
lea eax, [ebp - 0x214]
mov ebx, 0x61
add bx, 0x16
mov word [eax], bx
sub bx, 0xe
mov word [eax + 2], bx
add bx, 5
mov word [eax + 4], bx
sub bx, 5
mov word [eax + 6], bx
add bx, 5
mov word [eax + 8], bx
sub bx, 9
mov word [eax + 0xa], bx
add bx, 0xf
mov word [eax + 0xc], bx
sub bx, 0x46
mov word [eax + 0xe], bx
add bx, 0x36
mov word [eax + 0x10], bx
add bx, 8
mov word [eax + 0x12], bx
mov word [eax + 0x14], bx
mov word [eax + 0x16], 0
push eax
push 0xec0e4ea4
push 0x6a4abc5b
call fcn.00401236
call eax
mov dword [ebp - 0xa], 0x4017c3
mov dword [ebp - 6], 0x11a00
push 1
push 2
push 0x401787
push dword [ebp - 6]
push dword [ebp - 0xa]
push 1
call fcn.0040132a
test eax, eax
je 0x4011f9
mov dword [ebp - 0xa], 0x4131c3
mov dword [ebp - 6], 0x8400
push 1
push 2
push 0x4017a5
push dword [ebp - 6]
push dword [ebp - 0xa]
push 1
call fcn.0040132a
test eax, eax
je 0x401221
push 0
push 0x73e2d87e
push 0x6a4abc5b
call fcn.00401236
call eax
leave
ret
Function at 0x401236
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, 3
shl eax, 4
mov eax, dword fs:[eax]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax + 0x24]
test ecx, ecx
je 0x401313
mov esi, dword [eax + 0x28]
xor eax, eax
cld
lodsb al, byte [esi]
ror edx, 0xd
add edx, eax
cmp al, 0x61
jl 0x401277
sub edx, 0x20
dec ecx
test ecx, ecx
jne 0x40126a
cmp edx, dword [ebp + 8]
jne 0x401313
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, dword [eax + 0x3c]
mov eax, dword [eax + 0x78]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
cmp eax, dword [ebp - 4]
je 0x40130d
xor edx, edx
mov esi, dword [ebp - 0xc]
mov esi, dword [esi]
add esi, dword [ebp - 0x14]
xor eax, eax
cld
lodsb al, byte [esi]
test al, al
je 0x4012e0
ror edx, 0xd
add edx, eax
jmp 0x4012d4
cmp edx, dword [ebp + 0xc]
jne 0x401300
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 8]
movzx ebx, word [ebx]
lea eax, [eax + ebx*4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
leave
ret 8
add dword [ebp - 0xc], 4
add dword [ebp - 8], 2
inc dword [ebp - 4]
jmp 0x4012bc
xor eax, eax
leave
ret 8
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x1c]
jne 0x401253
xor eax, eax
leave
ret 8
Function at 0x403d76
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00403a59
out dx, eax
xor al, 0x5f
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x40]
push eax
call fcn.00403a69
push eax
push esi
push dword [ebp + 8]
call fcn.00403a1e
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00403a59
sub dword [eax - 0x1e], edx
jp 0x403d4e
inc ebp
call 0x51289b4f
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00403a69
push eax
push esi
push dword [ebp + 8]
call fcn.00403a1e
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00403a69
push eax
push esi
push dword [ebp + 8]
call fcn.00403a1e
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00403a69
push eax
push esi
push dword [ebp + 8]
call fcn.00403a1e
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00403a59
push eax
lcall 0xff7c, 0x9d88f9ab
invalid
Function at 0x405c21
Capabilities:
Resolve function by parsing pe exports

Disassembly:
invalid
call fcn.00403a59
push esp
pop eax
sbb bl, byte [ebx]
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00403a59
jns 0x405c9f
adc al, 0x99
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x405c46
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x405c46
call fcn.00403a59
arpl ax, bp
xchg esi, eax
jecxz 0x405bf4
pop edx
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ecx, dword [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00403a59
adc bh, byte [ebx]
adc dword [ecx - 0xf78a01], ebx
jne 0x405c8f
push dword [ebp]
call fcn.00404259
test eax, eax
jne 0x405c6e
invalid
call esi
pop esi
leave
ret 4
add bh, bh
je 0x405cc7
or bh, bh
adc eax, sym.imp.KERNEL32.dll_CreateDirectoryA
test eax, eax
je 0x405cb2
xor eax, eax
jmp 0x405cb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
ret 4
rol byte [ebp + 0x330474c0], 1
rol byte [eax - 0x3d], 0x33
rol bl, 0x55
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422e40], 0x44
push eax
xor eax, eax
push 0x422e40
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405d12
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405cd3
Capabilities:
Create process on windows

Disassembly:
invalid
call fcn.00403a59
push esp
pop eax
sbb bl, byte [ebx]
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00403a59
jns 0x405c9f
adc al, 0x99
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x405c46
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x405c46
call fcn.00403a59
arpl ax, bp
xchg esi, eax
jecxz 0x405bf4
pop edx
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ecx, dword [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00403a59
adc bh, byte [ebx]
adc dword [ecx - 0xf78a01], ebx
jne 0x405c8f
push dword [ebp]
call fcn.00404259
test eax, eax
jne 0x405c6e
invalid
call esi
pop esi
leave
ret 4
add bh, bh
je 0x405cc7
or bh, bh
adc eax, sym.imp.KERNEL32.dll_CreateDirectoryA
test eax, eax
je 0x405cb2
xor eax, eax
jmp 0x405cb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
ret 4
rol byte [ebp + 0x330474c0], 1
rol byte [eax - 0x3d], 0x33
rol bl, 0x55
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422e40], 0x44
push eax
xor eax, eax
push 0x422e40
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405d12
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x405d16
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
ret 4

Function at 0x405db4
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.004061fd
mov edi, eax
cmp edi, 0xffffffff
je 0x405df5
test byte [esp + 0x10], 1
push esi
je 0x405dd7
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x405ddd
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x405de6
xor eax, eax
inc eax
jmp 0x405df7
test byte [esp + 0x10], 4
jne 0x405df5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x430003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x7a9f7a9b
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x36dc5e7c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x7f9370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x7f938e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x822074
push ecx
mov edi, eax
call fcn.0080d198
mov esi, eax
add esp, 8
test esi, esi
jne 0x7f93cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0080d02e
push esi
call fcn.0080cfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x7fc850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x7fc8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x827720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x7fc8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0080d1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x7fc8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x827720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x7fc92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0080e082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x7fc957
mov word [eax], si
add eax, 2
push eax
call fcn.0080e030
add esp, 4
jmp 0x7fc959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x7fc8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x7fc8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x7fcff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x7fd080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x7fd0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x822458
push ecx
call fcn.0080d1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.0080d1e1
add esp, 0x10
jmp 0x7fd0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0080d20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.0080cdff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.007fd050
mov eax, dword [0x827728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x7fd13b
push esi
call fcn.007fcfb0
add esp, 4
mov dword [0x827728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x7fd14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.007fcff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x800440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x8004b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x80048e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x800471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x80047e
add edx, ecx
cmp ebx, edx
jb 0x80048a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x800467
xor ecx, ecx
jmp 0x8004a2
test eax, eax
jne 0x800492
xor ecx, ecx
jmp 0x8004a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.008003c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x8008f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x800921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x800946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x80096e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x800993
push ecx
push esi
call fcn.008004c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret