joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
mov esi, eax
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
push edi
mov dword [ebp - 8], ecx
jb 0x41101e
mov esi, dword [eax]
lea edi, [ecx + ecx]
mov edx, 0x811c9dc5
xor ecx, ecx
test edi, edi
je 0x411041
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x411030
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edx
mov ebx, dword [ebx + 4]
mov edx, dword [eax + ecx*8]
mov eax, dword [eax + ecx*8 + 4]
mov dword [ebp - 4], edx
cmp edx, ebx
je 0x411120
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
lea esi, [edx + 8]
mov edx, ecx
jb 0x41106e
mov edx, dword [ecx]
cmp dword [esi + 0x14], 8
mov edi, esi
jb 0x411078
mov edi, dword [esi]
mov esi, dword [esi + 0x10]
cmp esi, dword [ecx + 0x10]
jne 0x41110f
test esi, esi
je 0x4110a1
sub edi, edx
nop word [eax + eax]
mov cx, word [edi + edx]
cmp cx, word [edx]
jne 0x41110c
add edx, 2
sub esi, 1
jne 0x411090
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx]
cmp ecx, eax
je 0x411122
nop word [eax + eax]
cmp dword [ebx + 0x1c], 8
lea ecx, [ebx + 8]
mov dword [ebp - 0xc], ebx
jb 0x4110bf
mov ecx, dword [ebx + 8]
mov esi, dword [ebp + 0xc]
mov edi, esi
cmp dword [esi + 0x14], 8
jb 0x4110cc
mov edi, dword [esi]
mov esi, dword [ebp - 8]
cmp esi, dword [ebx + 0x18]
jne 0x4110f8
mov edx, esi
test edx, edx
je 0x4110f1
sub edi, ecx
nop dword [eax]
mov dx, word [edi + ecx]
cmp dx, word [ecx]
jne 0x4110f8
add ecx, 2
sub esi, 1
jne 0x4110e0
mov ebx, dword [ebx]
cmp dword [ebp - 0xc], eax
jne 0x4110b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax + 4], ebx
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
cmp edx, eax
je 0x411120
mov edx, dword [edx]
mov dword [ebp - 4], edx
jmp 0x411061
mov ecx, ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax + 4], ebx
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4164e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492e60
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4be130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00466cc9
mov edi, eax
add esp, 4
test edi, edi
je 0x41658b
push 1
mov dword [ebp - 4], 0
call fcn.00450763
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x420dc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x420ef1
test al, 3
jne 0x420ef1
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x420eac
cmp edi, 8
jb 0x420e75
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x420e24
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x420eb0
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x420e92
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x420eb4
xor edi, edi
jmp 0x420eb4
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x420ec8
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x420fb4
cmp ecx, 0x20
jb 0x420f95
mov esi, ecx
add eax, 0x10
and esi, 0xffffffe0
xorps xmm3, xmm3
mov dword [esp + 0x1c], esi
xorps xmm2, xmm2
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
nop dword [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edi + ebx]
add edi, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x420f30
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x420fb4
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x420fa4
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x42fe20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495598
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4be130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00466cc9
mov edi, eax
add esp, 4
test edi, edi
je 0x42febd
push 1
mov dword [ebp - 4], 0
call fcn.00450763
add esp, 4
mov dword [edi + 4], eax
jmp 0x42febf
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.00405e10
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x42ff1a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x42ff1a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x42ff36
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x42ff59
cmp byte [ebp + 0xc], 0
je 0x42ff45
push esi
call fcn.00450f87
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x42ff65
mov esi, str.ios_base::badbit_set
jmp 0x42ff75
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.00408910
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.00406890
push 0x4b560c
lea eax, [ebp - 0x28]
push eax
call fcn.00468650
int3

Function at 0x435330
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x4c3be0], 0
jne 0x43533e
call fcn.00437740
cmp byte [0x4c3be9], 0
je 0x43535c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00437de0
add esp, 0x10
ret
jmp fcn.004336a0
Function at 0x43ade0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495e50
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4be130]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x43ae21
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 0x38], esi
cmp esi, 0xffffffff
jne 0x43ae44
push dword [ebp - 0x2c]
push ebx
push edi
call fcn.0043acb0
add esp, 0xc
jmp 0x43af60
push esi
push ebx
call fcn.0043a960
add esp, 8
mov ecx, eax
mov dword [ebp - 0x30], ecx
test esi, 0x400
je 0x43af25
cmp dword [ebx + 0x14], 8
mov edx, ebx
jb 0x43ae69
mov edx, dword [ebx]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43ae82
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040acb0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040a630
cmp esi, 0xffffffff
jne 0x43aee8
push dword [ebp - 0x2c]
push ebx
push edi
call fcn.0043acb0
add esp, 0xc
jmp 0x43af60
push ebx
call fcn.0043a880
add esp, 4
test al, al
jne 0x43af11
mov eax, dword [ebp - 0x30]
mov dword [edi], 9
mov dword [edi + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43af60
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x43af3d
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x49e550
and esi, 0x10
je 0x43af47
mov edx, dword [ebp - 0x34]
jmp 0x43af4c
mov edx, ecx
mov ecx, dword [ebp - 0x34]
xor eax, eax
test esi, esi
setne al
add eax, 2
test esi, esi
mov dword [edi], eax
cmove ecx, edx
mov dword [edi + 4], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret
Function at 0x44ff20
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4985d8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x4be130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.004504ff
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov byte [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], 0
mov word [ebp - 0x58], ax
mov dword [ebp - 0x54], eax
mov word [ebp - 0x50], ax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], al
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], al
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 7
push 0x49b1a0
push eax
call fcn.00450863
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 8
push eax
call fcn.00450b2e
add esp, 0xc
lea ecx, [ebp - 0x70]
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
call fcn.00406c40
mov dword [esi], vtable.boost::program_options::detail::utf8_codecvt_facet.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x483703
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004833b4

Function at 0x48370e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048353e

Function at 0x488321
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00487e74
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1030c1ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10339cf0]
jne 0x1030c1b6
repz ret
jmp fcn.1030c45d

Function at 0x1030d250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], esi
mov dword [0x10339ccc], 0
mov dword [0x10339cd0], 0
mov dword [0x10339cdc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [0x10339cc4], 0x145d
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x18]
jb 0x1030d2c8
mov dword [0x10339cc8], 0x2692
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0x100
mov ecx, dword [0x10339cc4]
add ecx, 0x21fe
mov dword [0x10339cc4], ecx
mov ecx, dword [0x10339ccc]
add ecx, 1
mov dword [ebp - 0x28], eax
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x28]
idiv ecx
mov dword [0x10339ccc], edx
mov edx, dword [0x10339cc4]
add edx, 0xf93
mov dword [0x10339cc8], edx
mov edx, dword [0x10339cd0]
mov esi, dword [0x10339ccc]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x10339cd0], edx
mov edx, dword [0x10339ccc]
mov dword [ebp - 0x2c], edx
mov eax, 0x100
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov bl, byte [ecx + edx]
mov byte [0x10339cd4], bl
mov ecx, dword [0x10339cd0]
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [0x10339ccc]
mov esi, dword [ebp - 0x1c]
mov byte [esi + ecx], bl
mov dword [0x10339cc8], 0x2b4
mov bl, byte [0x10339cd4]
mov ecx, dword [0x10339cd0]
mov esi, dword [ebp - 0x1c]
mov byte [esi + ecx], bl
mov ecx, dword [0x10339ccc]
mov esi, dword [ebp - 0x1c]
movzx ecx, byte [esi + ecx]
mov esi, dword [0x10339cd0]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add ecx, esi
mov dword [ebp - 0x14], ecx
mov dword [0x10339cc8], 0xdf3
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x30]
idiv ecx
mov dword [0x10339cdc], edx
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
movzx edx, byte [esi + edx]
mov esi, dword [0x10339cdc]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
xor edx, esi
mov bl, dl
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x10]
mov byte [esi + edx], bl
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
jmp 0x1030d2ae
Function at 0x1030db60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [0x10339cc4], 0x1c6a
mov dword [ebp - 8], 0
mov dword [0x10339cc8], 0x2f2
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [0x10339cc4], 0xb29
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x1030dc31
jmp 0x1030dbb1
mov eax, dword [0x10339cc8]
sub eax, 0x94b
mov dword [0x10339cc8], eax
mov dword [ebp - 4], 0
jmp 0x1030dcf8
jmp 0x1030dcef
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
je 0x1030dcb6
jmp 0x1030dcef
jmp 0x1030dc67
jmp 0x1030dc5a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax - 0x16]
cmp ecx, 0x61
je 0x1030dc98
jmp 0x1030dcf3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
je 0x1030dce1
jmp 0x1030dcea
cmp dword [ebp - 0x10], 0x104
setl al
mov byte [ebp - 0x15], al
mov al, byte [ebp - 0x15]
test al, 1
jne 0x1030dc47
jmp 0x1030dc67
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
je 0x1030dbec
jmp 0x1030dbee
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x1030dc31
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
jne 0x1030dbb1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + eax*2 - 0x18]
cmp eax, 0x6f
je 0x1030dbf0
jmp 0x1030dbaf
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx + eax*2 - 0x14]
cmp eax, 0x64
je 0x1030dbd1
jmp 0x1030dcf1
mov dword [0x10339cc8], 0xa81
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
movzx eax, word [ecx + eax*2 - 0x10]
cmp eax, 0x6c
je 0x1030dc16
jmp 0x1030dbcc
mov dword [ebp - 4], 1
jmp 0x1030dcf8
jmp 0x1030dbcc
jmp 0x1030dcf1
jmp 0x1030dcf3
jmp 0x1030dbaf
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esp, 0x24
pop ebp
ret
Function at 0x1030e090
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.1030e090]
mov dword [0x10339cc4], 0x2e
mov dword [ebp - 8], eax
jmp 0x1030e0d2
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov eax, dword [0x10339cc8]
sub eax, 0x8d4
mov dword [0x10339cc4], eax
jmp 0x1030e10c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x1030e0f0
jmp 0x1030e0ab
mov eax, dword [ebp - 4]
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax], 0x4550
jne 0x1030e10a
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x1030e0e8
jmp 0x1030e0ab
mov al, 1
test al, 1
jne 0x1030e0d2
jmp 0x1030e114
mov dword [ebp - 4], 0
jmp 0x1030e0e8
Function at 0xc7c370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xc7c38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xca5074
push ecx
mov edi, eax
call fcn.00c90198
mov esi, eax
add esp, 8
test esi, esi
jne 0xc7c3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00c9002e
push esi
call fcn.00c8ffb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xc7f850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xc7f8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xcaa720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xc7f8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00c901e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xc7f8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xcaa720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xc7f92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00c91082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xc7f957
mov word [eax], si
add eax, 2
push eax
call fcn.00c91030
add esp, 4
jmp 0xc7f959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xc7f8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xc7f8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xc7fff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xc80080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0xc800c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xca5458
push ecx
call fcn.00c901e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00c901e1
add esp, 0x10
jmp 0xc800d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00c9020b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00c8fdff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00c80050
mov eax, dword [0xcaa728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0xc8013b
push esi
call fcn.00c7ffb0
add esp, 4
mov dword [0xcaa728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0xc8014c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00c7fff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0xc83440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0xc834b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xc8348e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xc83471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xc8347e
add edx, ecx
cmp ebx, edx
jb 0xc8348a
inc edi
add eax, 0x28
cmp edi, esi
jb 0xc83467
xor ecx, ecx
jmp 0xc834a2
test eax, eax
jne 0xc83492
xor ecx, ecx
jmp 0xc834a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.00c833c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret