joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4167b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
or eax, 0xffffffff
mov edx, ecx
dec ecx
test edx, edx
je 0x4167e7
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [esp + 0xc]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x41cc18]
xor eax, edx
inc ecx
dec esi
jne 0x4167c7
pop esi
pop ebx
not eax
ret

Function at 0x416850
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
mov ecx, dword [esp + 0x28]
xor eax, eax
cmp ecx, 0xffffffff
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
je 0x41687a
lea eax, [esp + 4]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp]
neg eax
sbb eax, eax
and eax, ecx
add esp, 0x18
ret

Function at 0x4168b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x24]
xor ecx, ecx
xor eax, eax
cmp edx, 0xffffffff
mov dword [esp], ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
je 0x4168d8
lea eax, [esp]
mov edx, dword [esp + 0x1c]
push eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x24]
neg eax
sbb eax, eax
and eax, ecx
add esp, 0x14
ret

Function at 0x416920
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
jne 0x41692b
pop esi
ret
push 3
push 1
push 0x80000000
push eax
call fcn.004167f0
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x416948
xor eax, eax
pop esi
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call fcn.004169c0
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x416b20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
je 0x416b4b
mov edi, dword [esp + 0x14]
test edi, edi
je 0x416b4b
xor eax, eax
test edi, edi
jle 0x416b4b
mov cl, byte [esp + 0xc]
mov dl, byte [eax + esi]
add dl, al
xor dl, cl
mov byte [eax + esi], dl
inc eax
cmp eax, edi
jl 0x416b3c
pop edi
pop esi
ret

Function at 0x416b50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
je 0x416b7b
mov edi, dword [esp + 0x14]
test edi, edi
je 0x416b7b
xor eax, eax
test edi, edi
jle 0x416b7b
mov cl, byte [esp + 0xc]
mov dl, byte [eax + esi]
xor dl, cl
sub dl, al
mov byte [eax + esi], dl
inc eax
cmp eax, edi
jl 0x416b6c
pop edi
pop esi
ret

Function at 0x416b80
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x416ba6
mov edx, dword [esp + 8]
test edx, edx
je 0x416ba6
xor eax, eax
test edx, edx
jle 0x416ba6
push ebx
mov bl, byte [eax + ecx]
xor bl, 0xa5
mov byte [eax + ecx], bl
inc eax
cmp eax, edx
jl 0x416b97
pop ebx
ret
Function at 0x416bd0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x417840
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
jne 0x41785e
xor eax, eax
pop esi
add esp, 0x104
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
push 0x104
push esi
push ecx
call ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x10]
push esi
push eax
call ebx
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
pop edi
pop ebx
pop esi
add esp, 0x104
ret 4
Function at 0x417da0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x124
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0xb5]
mov byte [esp + 0xb4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x75]
mov byte [esp + 0x74], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x74]
push 0x40
push eax
mov eax, dword [esp + 0x140]
lea ecx, [esp + 0xbc]
push 0x40
push ecx
lea edx, [esp + 0x44]
push 0x40
push edx
push eax
mov ecx, esi
mov dword [esp + 0x2c], esi
call fcn.00417af0
test eax, eax
je 0x417f4d
push esi
lea ecx, [esp + 0x18]
push 0x20
lea edx, [esp + 0xbc]
push ecx
lea eax, [esp + 0x40]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
test eax, eax
je 0x417f4d
mov eax, dword [esp + 0x13c]
mov ebp, dword [esp + 0x140]
test eax, eax
mov eax, dword [esp + 0x1c]
je 0x417f3f
cmp dword [ebp], eax
jb 0x417f3f
xor esi, esi
mov dword [ebp], eax
test eax, eax
jbe 0x417f02
cmp ebx, dword [esp + 0x28]
jae 0x417f02
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0xf5]
mov byte [esp + 0xf4], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x74]
push ebx
stosw word es:[edi], ax
push ecx
push str._s_d
lea edx, [esp + 0x100]
push 0x3f
push edx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, dword [ebp]
add esp, 0x14
sub eax, esi
mov edi, 0x4000
cmp eax, 0x4000
jg 0x417ecc
mov edi, eax
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 0x10]
push eax
push edi
lea edx, [esi + ecx]
lea eax, [esp + 0xfc]
push edx
lea ecx, [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
test eax, eax
je 0x417f02
mov eax, dword [ebp]
add esi, edi
inc ebx
cmp esi, eax
jb 0x417e76
mov edx, dword [ebp]
mov esi, dword [esp + 0x13c]
mov eax, dword [esp + 0x20]
push edx
push esi
push eax
call fcn.00416b50
mov ecx, dword [ebp]
push ecx
push esi
call fcn.004167b0
mov ecx, dword [esp + 0x38]
add esp, 0x14
cmp eax, ecx
jne 0x417f5c
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x124
ret 0xc
push 0xea
mov dword [ebp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x124
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x124
ret 0xc
Function at 0x417f70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x120
push ebp
mov ebp, ecx
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
mov byte [esp + 0x68], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x69]
mov byte [esp + 0xa8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0xa9]
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xac]
lea ecx, [esp + 0x6c]
push eax
mov eax, dword [esp + 0x134]
push 0x40
push ecx
lea edx, [esp + 0x38]
push 0x40
push edx
push eax
mov ecx, ebp
call fcn.00417af0
test eax, eax
jne 0x417ff5
pop edi
pop ebp
add esp, 0x120
ret 4
push ebp
lea ecx, [esp + 0xc]
push 0x20
lea edx, [esp + 0x70]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
test eax, eax
jne 0x41801c
pop edi
pop ebp
add esp, 0x120
ret 4
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
push esi
xor esi, esi
test eax, eax
jbe 0x418087
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0xf1]
mov byte [esp + 0xf0], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb0]
push esi
stosw word es:[edi], ax
push ecx
push str._s_d
lea edx, [esp + 0xfc]
push 0x3f
push edx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [esp + 0xf0]
lea ecx, [esp + 0x30]
push ebp
push 0
push 0
push eax
push ecx
call ebx
mov eax, dword [esp + 0x24]
inc esi
cmp esi, eax
jb 0x41802e
push ebp
push 0
lea edx, [esp + 0x78]
push 0
lea eax, [esp + 0x3c]
push edx
push eax
call ebx
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x120
ret 4
Function at 0x418100
Capabilities:
Set registry value

Disassembly:
sub esp, 0x64
push ebx
mov ebx, dword [esp + 0x70]
push ebp
push esi
mov esi, ecx
push edi
test ebx, ebx
mov dword [esp + 0x10], esi
je 0x4181f5
mov ebp, dword [esp + 0x80]
test ebp, ebp
je 0x4181f5
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x78]
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x38]
push eax
push ecx
mov ecx, esi
call fcn.004180b0
test eax, eax
je 0x4181f5
push ebp
lea edx, [esp + 0x18]
push ebx
push edx
mov ecx, esi
call fcn.00417a90
add ebp, 0x20
push ebp
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4181f5
mov ecx, 8
lea esi, [esp + 0x14]
mov edi, ebx
push ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x84]
mov esi, dword [esp + 0x80]
mov eax, ecx
lea edi, [ebx + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x28]
push eax
mov esi, eax
call fcn.00416b20
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x34]
mov dword [ebx + 0xc], esi
push ebp
push ebx
push 3
lea edx, [eax + 0x108]
mov eax, dword [eax + 0x104]
push ecx
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push ebx
mov esi, eax
call fcn.00402178
add esp, 4
xor eax, eax
test esi, esi
pop edi
pop esi
pop ebp
pop ebx
sete al
add esp, 0x64
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret 0xc
Function at 0x418210
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
push esi
mov esi, ecx
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x40
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x54]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.004180b0
test eax, eax
jne 0x41824b
pop edi
pop esi
add esp, 0x44
ret 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x60]
mov dword [esp + 0x10], 0
mov eax, dword [ebp]
add eax, 0x20
push eax
mov dword [esp + 0x5c], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x418316
lea edx, [esp + 0x58]
lea eax, [esp + 0x60]
push edx
push ebx
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esi + 0x104]
lea edx, [esi + 0x108]
push ecx
push edx
push eax
mov dword [esp + 0x78], 3
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x41830d
mov ecx, dword [esp + 0x58]
mov edx, dword [ebx + 0xc]
push ecx
push ebx
push edx
call fcn.00416b50
mov edi, dword [esp + 0x68]
add esp, 0xc
test edi, edi
je 0x4182fc
mov eax, dword [ebx + 8]
mov ecx, dword [ebp]
cmp eax, ecx
ja 0x4182fc
lea esi, [ebx + 0x20]
push eax
push esi
mov dword [ebp], eax
call fcn.004167b0
mov ecx, dword [ebx + 0x10]
add esp, 8
cmp eax, ecx
jne 0x41830d
mov ecx, dword [ebp]
mov dword [esp + 0x10], 1
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41830d
mov ecx, dword [ebx + 8]
push 0xea
mov dword [ebp], ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call fcn.00402178
add esp, 4
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x44
ret 0xc

Function at 0x418330
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x40
push esi
mov esi, ecx
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push 0x40
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x50]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.004180b0
test eax, eax
jne 0x41836b
pop edi
pop esi
add esp, 0x40
ret 4
mov ecx, dword [esi + 0x104]
lea edx, [esp + 8]
lea eax, [esi + 0x108]
push edx
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x40
ret 4
Function at 0x418430
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d028
push 0x418c4a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp ax, 0x454e
je 0x418496
cmp ax, 0x454c
je 0x418496
cmp ax, 0x5a4d
je 0x418496
cmp eax, 0x4550
mov dword [ebp - 4], 0xffffffff
jne 0x4184c3
mov eax, 0x4550
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
and eax, 0xffff
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419350
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x419d50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push esi
mov esi, ecx
mov cl, 0xcf
mov al, 0xd4
mov byte [esp + 0x3b], cl
mov byte [esp + 0x44], al
mov byte [esp + 0x4a], al
mov byte [esp + 0x4c], cl
mov byte [esp + 0x52], al
mov byte [esp + 0x5c], al
push edi
mov cl, 0xfe
lea eax, [esp + 0x3c]
push 0x29
mov dl, 0xf4
mov byte [esp + 0x5d], cl
mov byte [esp + 0x5f], cl
mov byte [esp + 0x63], cl
push eax
push 6
lea ecx, [esp + 0x38]
mov byte [esp + 0x48], 0xf5
mov byte [esp + 0x49], 0xc3
mov byte [esp + 0x4a], 0xce
mov byte [esp + 0x4c], 0xf1
mov byte [esp + 0x4d], 0xcd
mov byte [esp + 0x4e], 0xda
mov byte [esp + 0x4f], 0xde
mov byte [esp + 0x50], 0xfa
mov byte [esp + 0x51], 0xc1
mov byte [esp + 0x52], 0xe1
mov byte [esp + 0x53], pe_nt_image_headers32
mov byte [esp + 0x55], 0xe3
mov byte [esp + 0x56], 0xfb
mov byte [esp + 0x57], dl
mov byte [esp + 0x58], 0xc0
mov byte [esp + 0x59], pe_nt_image_headers32
mov byte [esp + 0x5b], 0xcc
mov byte [esp + 0x5d], 0xe2
mov byte [esp + 0x5e], 0xec
mov byte [esp + 0x5f], dl
mov byte [esp + 0x60], 0xd1
mov byte [esp + 0x61], 0xff
mov byte [esp + 0x63], 0xd8
mov byte [esp + 0x64], 0xd3
mov byte [esp + 0x66], 0xfa
mov byte [esp + 0x68], 0xc8
mov byte [esp + 0x69], pe_nt_image_headers32
mov byte [esp + 0x6a], 0xde
mov byte [esp + 0x6d], 0xff
mov byte [esp + 0x6e], 0xe1
mov byte [esp + 0x6f], dl
mov byte [esp + 0x70], 0xc8
call fcn.00404870
lea ecx, [esp + 0x10]
push 9
mov al, 0xe8
push ecx
push 0xc
lea ecx, [esp + 0x28]
mov dword [esp + 0x7c], 0
mov byte [esp + 0x1c], 0xef
mov byte [esp + 0x1d], 0xe7
mov byte [esp + 0x1e], 0xfd
mov byte [esp + 0x1f], 0xd5
mov byte [esp + 0x20], 0xc3
mov byte [esp + 0x21], 0xff
mov byte [esp + 0x22], 0xd1
mov byte [esp + 0x23], al
mov byte [esp + 0x24], al
call fcn.00404870
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70], 1
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x10
call fcn.00404900
lea edx, [esp + 8]
mov edi, eax
push edx
lea eax, [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x28]
call fcn.00404900
push eax
push edi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4194e2
mov eax, dword [esp + 8]
test eax, eax
je 0x4194e2
mov esi, 1
jmp 0x4194e4
xor esi, esi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x70], 0
call fcn.004048c0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x70], 0xffffffff
call fcn.004048c0
mov ecx, dword [esp + 0x68]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x6c
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409b71
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00409d21
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x409c6f
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x409c12
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x409c55
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x409c29
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x409c44
test al, 0x40
je 0x409c3b
mov ecx, dword [edi + 0x20]
jmp 0x409c42
test al, 0x80
je 0x409c55
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x409c55
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x409be1
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x424150
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c31fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004b5349
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4241d2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004b28c3
mov eax, dword [eax]
push 0x509d60
push eax
call fcn.004a35b4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004b55d4
test bl, bl
je 0x4241d2
push 0x509d60
lea ecx, [esp + 0xc]
call fcn.004b59b0
push 0x509d6c
lea ecx, [esp + 0xc]
call fcn.004b59b0
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42420e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004b55d4
jmp 0x4242d9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x424292
lea edx, [esp + 0x7c]
push 0x509d68
push edx
call fcn.004a35b4
add esp, 8
test eax, eax
je 0x424292
lea eax, [esp + 0x7c]
push 0x509d64
push eax
call fcn.004a35b4
add esp, 8
test eax, eax
je 0x424292
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x424222
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004b55d4
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x425550
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4255b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4255c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c335b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x516bdc]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4256f8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x425626
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004b55d4
xor eax, eax
jmp 0x42576f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004b575d
push esi
lea ecx, [esp + 0xc]
call fcn.004b59ec
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x509db0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x42574d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push bind
call fcn.00425550
test eax, eax
jne 0x42574d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push bind
mov ecx, edi
call fcn.00425550
test eax, eax
jne 0x42574d
lea eax, [esp + 0x14]
push 0x509d8c
push eax
call fcn.004a47d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x42572c
lea ecx, [esp + 0x14]
push 0x509d88
push ecx
call fcn.004a4750
mov esi, eax
add esp, 8
test esi, esi
jne 0x42572c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x42572f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004b570d
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x42563e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004b55d4
xor eax, eax
jmp 0x42576f
mov byte [esi], 0
push 0x509d84
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004b55d4
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4