joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451622
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
ror ebx, cl
test cx, 0x5e8
stc
push edx
mov dh, bh
push eax
add al, dh
sbb dl, al
nop
adc bx, 0x324a
ror eax, cl
stc
test dx, 0x56a1
add al, 0x5e
sbb ch, 0x22
test ebx, 0x324876fc
or ecx, 0x2d7dd457
dec edx
dec ecx
sub ecx, 0x3ac4642f
add bh, 0x7d
rol ecx, cl
and ax, 0x2b1
push esi
mov esi, 0x2df3ebec
or ah, 9
xor bl, dl
inc bl
adc al, ch
dec cx
sbb bl, 0x6c
cmp bl, ah
sub edx, 0x1e9a51fd
sub edx, edx
push edi
add edi, ecx
shl esi, cl
adc esi, 0x51729f1a
dec ebx
shl esi, cl
inc ax
adc ebx, 0x34fca4ff
test ecx, edx
sub ecx, 0x113f5713
cmp bl, bl
rol cl, cl
dec eax
mov bx, 0x17ef
sub dl, 0x45
dec ah
not esi
inc cl
ror esi, cl
or dx, dx
stc
and bx, si
test al, 0x29
ror al, 1
xor edi, 0x187e4f35
shl al, cl
stc
rol di, cl
ror dh, cl
nop
shr dx, 4
sub cx, dx
cmp esi, esi
inc ebx
adc esi, 0x1ef8eda1
sub bx, si
rol ch, 8
add bx, 0x339b
rol cl, 7
dec esi
stc
xor ecx, 0x4411344b
rol di, cl
or edi, eax
and dh, al
stc
sub bl, 0x24
rol bl, 5
ror edi, cl
sbb dh, 0x5c
sub si, 0x6708
and dh, dh
dec cx
add bl, dh
mov edx, edx
ror eax, cl
cmp edi, 0x2d2d92cf
sub edi, 0x1ed97484
add bl, 0x4d
dec ecx
stc
add cx, si
xchg dl, ch
nop
test bx, di
mov di, dx
and edi, 0x7c0abdc8
xchg si, di
stc
shr ax, cl
pop edi
stc
stc
and al, 0x73
mov ah, 0x43
inc ch
inc si
add cx, 0x5d59
test cl, 0x5c
push edi
sub di, si
shl dl, 2
shl edi, 3
rol esi, 1
inc di
stc
add dh, 0x50
add bx, bx
shr ebx, 5
cmp al, 0x48
sub ch, al
sbb cl, cl
nop
and bl, bh
mov dh, 0x60
rol al, cl
cmp edi, esi
nop
stc
cmp ecx, ecx
test dx, 0x703
cmp esi, 0x6c6cbd8f
xor eax, 0x7e792267
not bx
mov ah, bl
not bh
mov di, bx
ror al, cl
add ax, 0x1617
shr al, cl
nop
mov cl, dh
mov cx, 0x2aff
stc
adc ch, 0x4c
test ecx, 0x23829c04
sbb si, 0x68dc
xchg bx, ax
sbb ebx, 0x2eac3338
ror ah, cl
cmp ebx, edi
rol cl, cl
adc dl, 0x51
nop
shl cl, cl
shl di, cl
xchg dl, al
inc di
not ecx
and ch, 0x47
not ah
shr eax, 5
sub dx, 0x6b0b
ror si, cl
ror bx, 6
adc ecx, 0x7d060721
stc
nop
not edx
mov bl, 0x54
not si
shr cl, cl
ror dl, cl
pop edi
pop esi
pop eax
pop edx
pop ecx
pop ebx
jne 0x451869
jb 0x451853
jge 0x451837
push edx
mov dh, dl
pop edx
push ebx
and ebx, 0x2adfb286
push ecx
ror cx, 5
pop ecx
pop ebx
jbe 0x451837
push ecx
cmp ch, 0x6c
push edi
not di
pop edi
pop ecx
js 0x451853
push ecx
sbb ecx, 0x322af815
nop
push edi
shr di, 8
pop edi
pop ecx
push esi
push edx
xchg si, dx
pop edx
pop esi
push edx
sub edx, 0x618122b2
push ecx
or cl, 0x5a
push ebx
push eax
mov bx, ax
not bl
pop eax
pop ebx
pop ecx
pop edx
je 0x45188a
push ebx
push edx
sub bx, dx
push ecx
inc cx
cmp dx, 0x38ea
and dx, 0x571f
push eax
adc al, dl
shr dl, 1
pop eax
pop ecx
pop edx
pop ebx
push edx
push edi
sbb edx, edi
push ebx
shl bh, 6
sub dl, 0x1e
push eax
xchg dx, ax
push ecx
dec ch
pop ecx
pop eax
pop ebx
pop edi
pop edx
pop ebp
ret
Function at 0x5465ed
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
nop
push ebx
mov bl, 0x53
push eax
push ecx
rol al, cl
xor ebx, 0xf3bfe3a
sbb eax, 0x7609bf1c
ror ch, cl
push edx
xchg edx, ebx
add cx, 0x72f3
and ecx, 0x5ea74fa8
add cx, 0x6fe9
push esi
test esi, 0x7bc839e7
rol eax, 7
test ecx, eax
sbb dx, 0x6c30
push edi
not di
or bl, 0x25
adc edx, 0x3708b312
rol bx, 2
ror ecx, 8
adc al, bl
add bh, dh
shl ch, 1
adc ebx, 0x31736a21
nop
ror si, cl
adc edi, edx
test bh, 0x3f
test bh, 0x18
rol bh, 3
stc
inc ecx
shl ax, cl
test ah, ah
sbb cx, 0x6e32
dec ecx
add cx, bx
shr cx, 7
xchg cl, dl
mov bh, 0xd
dec edi
ror dl, cl
and edx, edx
shr bx, cl
xchg cx, bx
shl ax, cl
rol eax, 2
dec ebx
cmp dh, 0x70
mov di, 0x7639
xor ch, 0x5c
nop
rol al, 7
inc eax
rol cx, 2
adc eax, ebx
ror dl, cl
shr bx, 1
sub ch, al
adc dh, 0x14
add bx, cx
test ch, 0x17
nop
adc eax, esi
or edx, esi
adc esi, 0x50d5ccb2
test dh, 0x37
or di, ax
shl esi, cl
add dx, 0x7105
xor dl, cl
cmp bx, 0xa69
rol cl, 7
xchg esi, ebx
shl bl, 5
xchg cl, ah
add ebx, ebx
or dx, dx
xor dl, 0x11
xchg al, bl
shl ax, cl
sub esi, eax
sbb bx, 0x16e2
adc dl, dh
xor bx, 0x1346
cmp dl, ah
nop
ror di, 3
ror si, cl
mov ax, 0xfe5
add bh, 0x52
rol eax, cl
and bx, 0x1a73
dec bl
nop
dec esi
add cx, 0x74bf
or cl, bl
add cl, al
xchg di, ax
dec ebx
pop edi
test dx, 0x52ea
push edi
inc di
test di, 0x7b16
and cx, bx
sub bh, 0x10
and eax, eax
ror bx, cl
adc bx, cx
stc
stc
stc
rol ax, 1
stc
test eax, 0x5507f464
shl si, 5
xchg dx, bx
sub cl, 0x7f
shl si, 4
or dh, 0x52
nop
rol edi, 1
dec edi
xchg dx, bx
shr ch, cl
test ah, 0x29
nop
shl eax, 7
shl cl, 3
mov cl, bh
mov bl, 0x56
xchg dh, dl
ror dx, cl
or edi, ebx
add al, dh
xchg esi, edx
shr dl, cl
stc
shl bh, 2
nop
adc si, 0x20c
shr di, 1
xor edx, 0x6971f9ec
ror cl, cl
mov ax, bx
test ebx, 0x2fbf923d
inc dl
nop
stc
shl cx, cl
dec edx
rol dl, cl
sub esi, edx
mov cl, 0x6e
rol dx, 6
not cl
or ax, dx
cmp eax, edx
adc ah, cl
shl edi, cl
stc
add ecx, 0x3bb8c068
stc
stc
inc al
shl bx, cl
stc
rol eax, 2
shr ecx, 2
and esi, edi
shr al, cl
not dl
stc
and si, cx
adc ax, di
shl esi, 4
or bx, 0x1cfa
sbb dh, 3
add ecx, esi
shr dx, 8
and ah, cl
sub eax, edi
stc
sub ch, ah
xchg edi, eax
ror cl, cl
sub bl, 0x38
nop
ror bx, cl
nop
xchg ebx, edi
test edx, 0x54f7dceb
rol ch, cl
or al, 0x7a
not ch
test edx, 0x322ca93c
test edx, edi
dec ax
rol ch, cl
not cx
sub ch, 0x30
pop edi
nop
push edi
mov di, si
xor di, 0x6df5
stc
shr ax, cl
dec dh
test dx, dx
shr ch, 7
not dx
dec si
ror ch, cl
ror al, cl
ror ah, cl
add dx, ax
xor eax, 0x27161953
dec ecx
shr dh, cl
and bh, al
sbb ch, 0x6a
adc di, ax
rol ch, 3
xor bh, 0x43
stc
sub esi, eax
shr edx, 8
shr ch, 8
xchg edx, edx
sub bx, 0x69c9
inc bx
test bl, cl
mov si, 0x5e52
inc eax
cmp ebx, 0x71b525f2
ror si, 1
test cl, dl
ror si, 8
inc cl
pop edi
pop esi
pop edx
pop ecx
pop eax
pop ebx
jbe 0x5468a6
jecxz 0x54688a
push esi
push eax
xor si, ax
pop eax
pop esi
push ebx
sub bx, bx
pop ebx
push edi
push ebx
sbb edi, ebx
pop ebx
pop edi
jb 0x54689f
push ecx
adc cl, ch
pop ecx
push esi
add si, 0x40ad
pop esi
pop ebp
ret
Function at 0x5ae699
Capabilities:
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
push eax
add ax, 0x774b
push ecx
adc ecx, 0x4eadcc9a
push ebx
xor bx, bx
and bl, 0x72
push edi
shr edi, 4
shl ah, cl
xor cx, bx
adc ecx, eax
push edx
sbb cl, dl
push esi
inc esi
shl eax, 5
sub dx, 0x50eb
stc
or eax, edx
stc
nop
dec di
stc
mov ecx, 0x4a63e181
add di, si
rol ebx, 2
stc
inc esi
shr bx, 5
sub dh, 0x68
or cx, cx
inc dx
xor cl, 0x41
not edx
ror di, cl
xor bh, 0x3e
stc
test al, 0x19
xor ah, cl
nop
xor edi, eax
adc cl, ch
nop
add ecx, 0x631a09d6
cmp ecx, edx
or cl, bh
and si, di
cmp si, dx
xor dh, 0x65
xchg al, bh
shl cl, 7
dec dl
sbb eax, 0x1c3ec2dc
ror bx, 4
xor cl, 0x2c
stc
not ecx
and edx, 0x63e25f8c
add bl, ch
shr edi, 6
add ecx, 0x21361631
nop
not di
cmp al, 0xb
sbb di, bx
or cx, ax
adc si, cx
shl cl, 1
rol dx, 4
adc ch, 0x1b
add esi, 0x61ad9c10
xchg di, cx
mov cx, 0x45bf
sbb si, 0x1bc1
sbb ah, 0x44
mov cl, 8
dec ax
sub ecx, esi
xchg bl, ch
mov esi, 0x48f14747
ror bl, cl
sbb edx, 0xa4c1d4c
xchg esi, ebx
sub dl, 0x6e
adc eax, 0x5a30f02d
add cl, 0x68
nop
xor ax, 0x1e4
adc cl, bh
sbb ax, ax
rol esi, cl
cmp bx, 0x3859
xor bx, 0x9b0
adc cl, bh
xchg edi, ecx
rol bx, cl
test di, si
rol dl, cl
or ah, 0x16
mov dh, 0x63
dec al
not dx
shr bl, 7
stc
not eax
pop esi
adc dx, 0x2795
sub cx, 0x43c7
sbb eax, 0x40ee97f7
push esi
sbb esi, ecx
rol esi, 7
cmp esi, eax
stc
mov ch, 0x2c
stc
adc bh, cl
shl al, 1
sbb ax, 0x67bc
dec al
sbb dx, 0xb0a
dec di
adc dl, 0x4a
not ecx
test esi, 0x1bbdf00
adc si, 0x312
sbb edx, eax
mov dx, 0x638e
mov cx, si
xor edx, ebx
inc ecx
mov ax, 0x7e03
or ah, bl
test ah, bl
inc edi
sbb bl, ah
sub ebx, 0x2a041cd0
shl ah, 6
adc bl, bl
sbb dl, 0x3e
mov si, 0x79db
test ecx, 0x68c2c937
xor dl, dh
rol eax, cl
ror cl, cl
shl edi, cl
sub esi, 0x4009745
add di, cx
dec dl
or dl, ch
add esi, 0x6515058c
mov ebx, edi
mov ah, 0x19
mov ah, 0x6c
and ecx, 0x315760d0
sbb bh, 0x64
shl di, 8
inc al
shr ch, 6
sub dh, ah
nop
ror al, 1
sbb di, 0x2cc7
sub esi, 0x6a959e38
add bl, 0x63
nop
sub si, ax
nop
not ch
adc cx, di
rol edx, 4
shl di, cl
mov ax, 0x2361
mov eax, edx
shl dx, cl
mov edx, edx
rol di, 4
test bl, dl
inc ebx
dec di
mov dl, bh
stc
shr ax, cl
rol bx, cl
mov ebx, 0x5dbb0365
or al, cl
sbb esi, edi
xor dx, 0xf0e
or dh, 0x61
nop
inc ax
pop esi
pop edx
pop edi
pop ebx
pop ecx
pop eax
push eax
adc eax, 0x5449db96
push edi
not edi
shr al, 2
push ecx
test ecx, 0x6c3966
stc
shl cl, 5
and ch, 0x1d
stc
dec eax
and cx, di
push edx
not dx
not ch
shl dl, 6
push esi
sub esi, 0x14e54e59
sbb dl, dl
pop esi
pop edx
pop ecx
pop edi
pop eax
push eax
not al
pop eax
pop ebp
ret
Function at 0x10048970
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10048b54
pushal
mov esi, section.UPX1
lea edi, [esi - 0x42000]
push edi
jmp 0x1004899a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100489a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10048990
mov eax, 1
add ebx, ebx
jne 0x100489b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100489c4
jne 0x100489e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100489e3
dec eax
add ebx, ebx
jne 0x100489d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100489a8
add ebx, ebx
jne 0x100489df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10048a35
xor ecx, ecx
sub eax, 3
jb 0x100489fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10048a6a
sar eax, 1
mov ebp, eax
jmp 0x10048a06
add ebx, ebx
jne 0x10048a06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100489d4
inc ecx
add ebx, ebx
jne 0x10048a14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100489d4
add ebx, ebx
jne 0x10048a21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10048a16
jne 0x10048a32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10048a16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10048a54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10048a46
jmp 0x10048996
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10048a54
add edi, ecx
jmp 0x10048996
pop esi
mov edi, esi
mov ecx, 0x20c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10048a72
cmp byte [edi], 7
jne 0x10048a72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10048a77
lea edi, [esi + 0x46000]
mov eax, dword [edi]
or eax, eax
je 0x10048ae6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x484d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x485d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10048aa4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x485d4]
or eax, eax
je 0x10048ae0
mov dword [ebx], eax
add ebx, 4
jmp 0x10048ac1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10048b17
cmp al, 0xef
ja 0x10048b0a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10048aec
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10048af9
mov ebp, dword [esi + 0x485d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10048b4b
sub esp, 0xffffff80
jmp 0x10007dc0
Function at 0x415100
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40e015
lea edi, [esi - 0xd015]
push edi
or ebp, 0xffffffff
jmp 0x415122
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415129
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415118
mov eax, 1
add ebx, ebx
jne 0x41513b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415130
jne 0x41514c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415130
xor ecx, ecx
sub eax, 3
jb 0x415160
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4151d2
mov ebp, eax
add ebx, ebx
jne 0x41516b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415178
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41519c
inc ecx
add ebx, ebx
jne 0x415188
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41517d
jne 0x415199
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41517d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4151bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4151ad
jmp 0x41511e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4151bc
add edi, ecx
jmp 0x41511e
pop esi
mov edi, esi
mov ecx, 0x266
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4151da
cmp byte [edi], 2
jne 0x4151da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4151df
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x41524e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41520c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15068]
or eax, eax
je 0x415248
mov dword [ebx], eax
add ebx, 4
jmp 0x415229
call dword [esi + 0x1506c]
popal
jmp 0x4033eb

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1f751691
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x156858b3
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4018d0
Capabilities:
Get common file path
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [0xc2b520], 0x400
push esi
push edi
jne 0x401907
push 0
push 0
call dword [sym.imp.KERNEL32.dll__lopen]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea esi, [ebp - 0x24]
call fcn.004019e0
mov ecx, esi
call fcn.00401a00
mov edi, dword [ebp - 4]
xor esi, esi
lea esp, [esp]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x2afe65
jle 0x401926
cmp edi, 0x78e90b55
jne 0x40192f
inc esi
cmp esi, 0x1c03
jl 0x401910
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
mov edi, edi
push 0
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp esi, 0x206d47
jg 0x40195d
inc esi
cmp esi, 0x4f6a4
jl 0x401940
mov ebx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
xor esi, esi
push 0
call edi
cmp esi, 0x2b259d
jle 0x40197c
cmp ebx, 0x785074d5
jne 0x401985
inc esi
cmp esi, 0x11915
jl 0x401968
mov eax, dword [0x80c39c]
mov ecx, dword [0x80c370]
mov dword [0xc2b520], eax
mov dword [0xc2b524], ecx
call fcn.00401620
mov esi, dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, 0x3078f
pop ebx
lea esp, [esp]
cmp dword [0xc2b520], 0x51f
jne 0x4019c2
lea edx, [ebp - 0x2c]
push edx
call esi
sub edi, 1
jne 0x4019b0
mov eax, dword [0xc2a474]
mov dword [0xc2aab4], eax
call eax
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4044ab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80b218]
jne 0x4044b5
repz ret
jmp fcn.0040909c
Function at 0x40a80f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004057f5
and dword [ebp - 4], 0
cmp dword [0x80d1e8], 0
mov ebx, eax
jne 0x40a8c0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a971
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a971
push eax
call fcn.00405783
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x80d1e8], eax
call esi
push eax
call fcn.00405783
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x80d1ec], eax
call esi
push eax
call fcn.00405783
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x80d1f0], eax
call esi
push eax
call fcn.00405783
pop ecx
mov dword [0x80d1f8], eax
test eax, eax
je 0x40a8c0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405783
pop ecx
mov dword [0x80d1f4], eax
mov eax, dword [0x80d1f4]
cmp eax, ebx
je 0x40a918
cmp dword [0x80d1f8], ebx
je 0x40a918
push eax
call fcn.004057fe
push dword [0x80d1f8]
mov esi, eax
call fcn.004057fe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a918
test edi, edi
je 0x40a918
call esi
test eax, eax
je 0x40a90f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a90f
test byte [ebp - 0xc], 1
jne 0x40a918
or dword [ebp + 0x10], 0x200000
jmp 0x40a951
mov eax, dword [0x80d1ec]
cmp eax, ebx
je 0x40a951
push eax
call fcn.004057fe
pop ecx
test eax, eax
je 0x40a951
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a951
mov eax, dword [0x80d1f0]
cmp eax, ebx
je 0x40a951
push eax
call fcn.004057fe
pop ecx
test eax, eax
je 0x40a951
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80d1e8]
call fcn.004057fe
pop ecx
test eax, eax
je 0x40a971
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a973
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xc11370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xc1138e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xc3a074
push ecx
mov edi, eax
call fcn.00c25198
mov esi, eax
add esp, 8
test esi, esi
jne 0xc113cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00c2502e
push esi
call fcn.00c24fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xc14850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xc148ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xc3f720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xc148ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00c251e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xc148ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xc3f720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xc1492a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00c26082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xc14957
mov word [eax], si
add eax, 2
push eax
call fcn.00c26030
add esp, 4
jmp 0xc14959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xc148ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xc148b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xc14ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xc15080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0xc150c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xc3a458
push ecx
call fcn.00c251e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00c251e1
add esp, 0x10
jmp 0xc150d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00c2520b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00c24dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00c15050
mov eax, dword [0xc3f728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0xc1513b
push esi
call fcn.00c14fb0
add esp, 4
mov dword [0xc3f728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0xc1514c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00c14ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0xc18440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0xc184b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xc1848e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xc18471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xc1847e
add edx, ecx
cmp ebx, edx
jb 0xc1848a
inc edi
add eax, 0x28
cmp edi, esi
jb 0xc18467
xor ecx, ecx
jmp 0xc184a2
test eax, eax
jne 0xc18492
xor ecx, ecx
jmp 0xc184a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.00c183c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret