joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68a324f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov word [ebp - 0x20c], dx
mov esi, ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x210]
push edx
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x214], 0
push edx
lea edx, [ebp - 0x214]
mov dword [ebp - 0x210], 0x208
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x68a3265c
mov eax, dword [ebp - 0x210]
mov ecx, 0x103
shr eax, 1
cmp eax, 0x104
cmovne ecx, eax
add ecx, ecx
cmp ecx, 0x208
jae 0x68a32683
xor eax, eax
mov edx, 0x104
mov word [ebp + ecx - 0x20c], ax
lea eax, [ebp - 0x20c]
push ecx
push eax
push ecx
mov ecx, esi
call fcn.68a0c2f0
mov ecx, eax
test ecx, ecx
js 0x68a32671
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x68a32671
test esi, esi
je 0x68a32645
xor eax, eax
cmp ax, word [esi]
je 0x68a32645
xor ecx, ecx
cmp ax, word [ebx]
je 0x68a32671
mov edx, 0x104
mov eax, esi
nop dword [eax]
cmp word [eax], cx
je 0x68a325dd
add eax, 2
sub edx, 1
jne 0x68a325d0
xor eax, eax
mov ecx, 0x80070057
test edx, edx
push edi
cmovne ecx, eax
mov edi, edx
mov eax, 0x104
sub eax, edx
neg edi
sbb edi, edi
and edi, eax
test edx, edx
je 0x68a32632
movzx eax, word [esi + edi*2 - 2]
cmp eax, 0x5c
je 0x68a32623
cmp eax, 0x2f
je 0x68a32623
push 0x68a5ff9c
mov edx, 0x104
mov ecx, esi
call fcn.68a0c280
mov ecx, eax
test ecx, ecx
js 0x68a32632
push ebx
mov edx, 0x104
mov ecx, esi
call fcn.68a0c280
mov ecx, eax
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
mov ecx, 0x80070057
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
test ecx, ecx
jle 0x68a32671
movzx ecx, cx
or ecx, 0x80070000
mov eax, ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
call fcn.68a39bb7
int3
Function at 0x68a32a00
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push ecx
push ecx
lea ecx, [ebp - 0x210]
call fcn.68a32780
mov edi, eax
add esp, 8
test edi, edi
js 0x68a32c07
push 8
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x68ab3418], eax
test eax, eax
je 0x68a32bf2
push str.AavmRpcScanFile3
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x68ab340c], eax
test eax, eax
jne 0x68a32abc
push str.AavmRpcScanFile2
push dword [0x68ab3418]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x68ab3410], eax
test eax, eax
jne 0x68a32abc
push str.AavmRpcScanFile
push dword [0x68ab3418]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x68ab3414], eax
test eax, eax
jne 0x68a32abc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x68a32c09
movzx eax, ax
or eax, 0x80070000
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
push str.AavmRpcBrowserUrlChange
push dword [0x68ab3418]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AavmRpcReportEncryptClientHello
push dword [0x68ab3418]
mov dword [0x68ab33f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AavmRpcCreateBinding
push dword [0x68ab3418]
mov dword [0x68ab33f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x68ab3400], eax
test eax, eax
je 0x68a32a96
push str.AavmRpcDestroyBinding
push dword [0x68ab3418]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x68ab33fc], eax
test eax, eax
je 0x68a32a96
push str.AavmRpcGetObjectNamePrefix2
push dword [0x68ab3418]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x68ab3404], eax
test eax, eax
jne 0x68a32b58
push str.AavmRpcGetObjectNamePrefix
push dword [0x68ab3418]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x68ab3408], eax
test eax, eax
je 0x68a32a96
mov esi, dword [0x68ab3400]
mov ecx, esi
push str.localhost
call dword [0x68a57338]
call esi
add esp, 4
test eax, eax
jne 0x68a32b89
mov eax, 0x80070005
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
push str.AavmRpcGetProviderFromName
push dword [0x68ab3418]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x68a32bb7
push 0x68ab09a4
push str.FileSystemShield
mov ecx, esi
call dword [0x68a57338]
call esi
add esp, 8
mov ecx, dword [0x68ab3418]
mov edx, 0x68ab33e4
call fcn.68a31b00
mov ecx, dword [0x68ab3418]
call fcn.68a31fc0
test eax, eax
js 0x68a32c07
mov dword [0x68ab3418], 0
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x68a32c07
movzx edi, di
or edi, 0x80070000
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
Function at 0x68a33940
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x214], eax
mov ebx, edx
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec eax
cmp eax, 0x102
ja 0x68a33a2d
push esi
push edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
mov eax, 0x1000
test edi, edi
cmove edi, eax
push edi
call fcn.68a3fe40
mov esi, eax
add esp, 4
test esi, esi
je 0x68a33a17
push esi
push edi
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x68a339eb
mov eax, dword [ebp - 0x214]
mov dword [ebx], esi
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
push esi
call fcn.68a3fe50
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x68a339da
pop edi
movzx eax, ax
pop esi
or eax, 0x80070000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x8007000e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x8007000e
xor ecx, ebp
pop ebx
call fcn.68a3943b
mov esp, ebp
pop ebp
ret

Function at 0x68a34b50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
push ebx
push esi
xor bl, bl
lea esi, [ebp - 0x2c]
test eax, eax
push edi
mov edi, ecx
cmovne esi, eax
mov ecx, dword [ebp + 8]
movups xmmword [ebp - 0x2c], xmm0
test ecx, ecx
je 0x68a34c49
test esi, esi
je 0x68a34c49
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x68a34c49
cmp eax, dword [0x68ab09a8]
jbe 0x68a34baf
lea edx, [ebp - 0x1c]
push edx
mov edx, eax
call fcn.68a35e10
jmp 0x68a34bf8
mov edx, ecx
mov dword [ebp - 0x70], 0
push eax
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x84], 0x67452301
mov dword [ebp - 0x80], 0xefcdab89
mov dword [ebp - 0x7c], 0x98badcfe
mov dword [ebp - 0x78], 0x10325476
call fcn.68a36110
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x84]
call fcn.68a361c0
movups xmm0, xmmword [ebp - 0x1c]
add esp, 4
lea eax, [ebp - 0x14]
mov ecx, edi
movups xmmword [esi], xmm0
push esi
push eax
call fcn.68a35760
push esi
mov esi, dword [ebp - 0xc]
push esi
call fcn.68a35820
test al, al
je 0x68a34c49
cmp esi, dword [edi]
je 0x68a34c49
mov eax, dword [esi + 0x20]
mov ecx, dword [edi + 8]
inc eax
cmp eax, ecx
je 0x68a34c34
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi + 0x20], ecx
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.68a3943b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x68a34db0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
xor cl, cl
push ebx
mov ebx, dword [0x68ab33e0]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x29c], eax
mov byte [ebp - 0x295], cl
test edi, edi
je 0x68a34e0e
mov ecx, 0x7ffffffe
mov eax, edi
nop dword [eax + eax]
cmp word [eax], 0
je 0x68a34dfe
add eax, 2
sub ecx, 1
jne 0x68a34df0
xor edx, edx
mov eax, 0x80070057
test ecx, ecx
mov cl, dl
cmovne eax, edx
jmp 0x68a34e13
mov eax, 0x80070057
test eax, eax
js 0x68a34fe4
push 0x208
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.68a3b750
mov eax, dword fs:[0x2c]
add esp, 0xc
mov ecx, dword [0x68ab13e4]
mov dword [ebp - 0x228], 0x103
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x68ab3544]
cmp eax, dword [ecx + 4]
jle 0x68a34e96
push 0x68ab3544
call fcn.68a39824
add esp, 4
cmp dword [0x68ab3544], 0xffffffff
jne 0x68a34e96
push str.UrlGetPartW
push str.KERNELBASE.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x68ab3544
mov dword [0x68ab3548], eax
call fcn.68a397d3
add esp, 4
mov esi, dword [0x68ab3548]
test esi, esi
je 0x68a34fcb
push 0
push 2
lea eax, [ebp - 0x228]
mov ecx, esi
push eax
lea eax, [ebp - 0x224]
push eax
push edi
call dword [0x68a57338]
call esi
test eax, eax
js 0x68a34fcb
mov eax, dword [ebp - 0x228]
lea edi, [ebx + 0x10]
mov ecx, dword [ebp - 0x29c]
lea esi, [ebp - 0x238]
add eax, eax
xor bl, bl
test ecx, ecx
xorps xmm0, xmm0
movups xmmword [ebp - 0x238], xmm0
cmovne esi, ecx
test esi, esi
je 0x68a34fb6
test eax, eax
je 0x68a34fb6
cmp eax, dword [0x68ab09a8]
jbe 0x68a34f1c
lea ecx, [ebp - 0x1c]
mov edx, eax
push ecx
lea ecx, [ebp - 0x224]
call fcn.68a35e10
jmp 0x68a34f78
push eax
lea edx, [ebp - 0x224]
mov dword [ebp - 0x280], 0
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x294], 0x67452301
mov dword [ebp - 0x290], 0xefcdab89
mov dword [ebp - 0x28c], 0x98badcfe
mov dword [ebp - 0x288], 0x10325476
call fcn.68a36110
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x294]
call fcn.68a361c0
movups xmm0, xmmword [ebp - 0x1c]
add esp, 4
lea eax, [ebp - 0x14]
mov ecx, edi
movups xmmword [esi], xmm0
push esi
push eax
call fcn.68a35760
push esi
mov esi, dword [ebp - 0xc]
push esi
call fcn.68a35820
test al, al
je 0x68a34fb6
cmp esi, dword [edi]
je 0x68a34fb6
mov eax, dword [esi + 0x20]
mov ecx, dword [edi + 8]
inc eax
cmp eax, ecx
je 0x68a34fb4
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi + 0x20], ecx
mov bl, 1
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret 0xc
mov al, byte [ebp - 0x295]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret 0xc
mov al, cl
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.68a3943b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x68a36b70
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68a55fcd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x60
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
movups xmmword [ebp - 0x6c], xmm0
movq qword [ebp - 0x5c], xmm0
mov dword [ebp - 4], 2
movups xmmword [ebp - 0x6c], xmm0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 7
mov word [ebp - 0x6c], ax
mov dword [ebp - 4], 3
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 4
push ecx
lea ecx, [ebp - 0x6c]
call fcn.68a36600
add esp, 4
cmp eax, 1
jne 0x68a36cfd
push ecx
push str.Scanner
lea ecx, [ebp - 0x6c]
call fcn.68a39010
cmp dword [ebp - 0x58], 7
lea eax, [ebp - 0x4c]
push 0
push 0
push eax
lea edx, [ebp - 0x6c]
mov dword [ebp - 0x4c], 0
cmova edx, dword [ebp - 0x6c]
mov ecx, str.HKEY_LOCAL_MACHINE
push 1
call fcn.68a253b0
add esp, 0x10
test eax, eax
jne case.0x68a36cbf.6
push 0x30
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.68a3b750
mov esi, dword [ebp - 0x4c]
add esp, 0xc
mov dword [ebp - 0x70], 0
test esi, esi
je 0x68a36c9b
test edi, edi
je 0x68a36c9b
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x30
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
jmp 0x68a36ca0
mov edi, 0x57
test esi, esi
je 0x68a36cab
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne case.0x68a36cbf.6
mov eax, dword [ebp - 0x70]
dec eax
cmp eax, 0xa
ja case.0x68a36cbf.6
movzx eax, byte [eax + 0x68a36da4]
jmp dword [eax*4 + 0x68a36d90]
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x4c], 0
jmp 0x68a36d1a
mov esi, dword [ebp - 0x44]
bswap esi
mov dword [ebp - 0x4c], 0
jmp 0x68a36d1a
mov esi, dword [ebp - 0x44]
jmp 0x68a36d1a
push 0xa
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.68a41139
add esp, 0xc
jmp 0x68a36d18
mov eax, dword [ebx + 8]
cdq
jmp 0x68a36d18
cmp dword [ebp - 0x58], 7
lea eax, [ebp - 0x6c]
cmova eax, dword [ebp - 0x6c]
push eax
push dword [ebx + 8]
push edi
push str.Scanner
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x68a36d31
push eax
call fcn.68a39891
add esp, 4
mov dword [ebp - 4], 6
cmp dword [ebp - 0x58], 7
jbe 0x68a36d55
mov edi, dword [ebp - 0x6c]
test edi, edi
je 0x68a36d55
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 7
mov word [ebp - 0x6c], ax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x68a38cc0
Capabilities:
Get common file path
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp dword [0x68ab3484], esi
jne 0x68a38cfd
sub esp, 8
lea ecx, [esi + 1]
call fcn.68a38a90
mov esi, eax
add esp, 8
test esi, esi
jne 0x68a38dcf
or dword [0x68ab3480], 2
mov eax, dword [0x68ab3484]
test eax, eax
je 0x68a38d0d
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x68ab347c]
mov ecx, eax
inc eax
mov dword [0x68ab347c], eax
test ecx, ecx
jne 0x68a38dbd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.68a416ec
add esp, 4
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
push str._SystemRoot_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ax, word [ebp - 0x210]
xor ecx, ecx
cmp cx, ax
je 0x68a38d69
mov ecx, 0x25
cmp cx, ax
jne 0x68a38d8d
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x210]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call fcn.68a24210
mov esi, eax
test esi, esi
jne 0x68a38db8
or dword [0x68ab3480], 1
mov cl, 1
call fcn.68a37380
mov esi, eax
test esi, esi
jne 0x68a38db8
call fcn.68a37e30
call fcn.68a38930
jmp 0x68a38dbd
call fcn.68a38de0
mov eax, dword [0x68ab3484]
test eax, eax
je 0x68a38dcd
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.68a3943b
mov esp, ebp
pop ebp
ret

Function at 0x68a47beb
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x68a5ac38
push 0x68a5ac30
push str.FlsAlloc
push 0x1e
call fcn.68a47a35
mov esi, eax
add esp, 0x10
test esi, esi
je 0x68a47c1f
push dword [ebp + 8]
mov ecx, esi
call dword [0x68a57338]
call esi
jmp 0x68a47c25
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x68a47c69
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x68a5ac48
push 0x68a5ac40
push str.FlsGetValue
push 0x20
call fcn.68a47a35
mov esi, eax
add esp, 0x10
test esi, esi
je 0x68a47ca0
push dword [ebp + 8]
mov ecx, esi
call dword [0x68a57338]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x68a48b57
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.68a48ad9
Function at 0x68a4d4d7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x68a4d574
push ebx
push esi
call fcn.68a4d4a0
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.68a4d3e9
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x68a4d521
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x68a4d573
push edi
push eax
call fcn.68a45322
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x68a4d541
call fcn.68a452e8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x68a4d572
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.68a4d3e9
add esp, 0x20
test eax, eax
jne 0x68a4d560
push edi
call fcn.68a452e8
jmp 0x68a4d568
push ebx
call fcn.68a452e8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x68a53b70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x68a53b9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x68a53b9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40e900
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x490cab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048541e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40e982
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004830c0
mov eax, dword [eax]
push 0xb93cf8
push eax
call fcn.004751a4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004856a9
test bl, bl
je 0x40e982
push 0xb93cf8
lea ecx, [esp + 0xc]
call fcn.00485a39
push 0xb93d04
lea ecx, [esp + 0xc]
call fcn.00485a39
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40e9be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004856a9
jmp 0x40ea89
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40ea42
lea edx, [esp + 0x7c]
push 0xb93d00
push edx
call fcn.004751a4
add esp, 8
test eax, eax
je 0x40ea42
lea eax, [esp + 0x7c]
push 0xb93cfc
push eax
call fcn.004751a4
add esp, 8
test eax, eax
je 0x40ea42
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e9d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004856a9
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40f290
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40f2f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40f300
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x490d2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0xb9ddd8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40f438
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40f366
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004856a9
xor eax, eax
jmp 0x40f4af
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004857e6
push esi
lea ecx, [esp + 0xc]
call fcn.00485a75
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0xb93d38
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40f48d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040f290
test eax, eax
jne 0x40f48d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040f290
test eax, eax
jne 0x40f48d
lea eax, [esp + 0x14]
push 0xb93d14
push eax
call fcn.00476220
mov esi, eax
add esp, 8
test esi, esi
jne 0x40f46c
lea ecx, [esp + 0x14]
push 0xb93d10
push ecx
call fcn.004761a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40f46c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40f46f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00485796
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40f37e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004856a9
xor eax, eax
jmp 0x40f4af
mov byte [esi], 0
push 0xb93d0c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004856a9
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4