joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ea588
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5ea59a
add esp, 0xfffffff0
call fcn.004085d4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00477bf8
mov eax, dword [0x619d80]
mov dword [eax + 4], ebx
mov dword [eax], 0x5eaa54
mov eax, dword [0x619d90]
mov dword [eax + 4], ebx
mov dword [eax], 0x5eaa60
mov eax, ebx
call fcn.005eaa6c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x43f4b4]
call fcn.00407ef4
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x43f4b4]
call fcn.00407ef4
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x43f4b4]
call fcn.00407ef4
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x43f4b4]
call fcn.00407ef4
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x43f4b4]
call fcn.00407ef4
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5e4fa4
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x50a900]
call fcn.005110a0
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x50a900]
call fcn.005110a0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x50a900]
call fcn.005110a0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x50a900]
call fcn.005110a0
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x50a900]
call fcn.005110a0
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005eb048
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5eae78
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5eae78
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5eae78
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5eae78
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5eae78
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5ea71a
call fcn.0040862c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5eac18
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5eadc3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5eada4
mov dl, 1
mov eax, dword [0x442e70]
call fcn.00467854
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409d80
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5ead93
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0054631c
test al, al
je 0x5ead86
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5eadd4
lea eax, [ebp - 0x394]
call fcn.00425f60
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5ead86
xor eax, eax
push ebp
push 0x5ead7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5eae44
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5ead68
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a8d0
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5ead68
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a8d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ead86
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5eac89
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.0046777c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eadca
lea eax, [ebp - 0x3a0]
call fcn.00409d80
ret

Function at 0x5eb9d0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x62118c]
cmp byte [eax + 0xc5], 0
jne 0x5eba42
cmp dword [0x6211b0], 0
jne 0x5eba02
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x619b34]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x6211b0], eax
cmp dword [0x6211ac], 0
jne 0x5eba1d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x6211ac], eax
cmp dword [0x6211b4], 0
jne 0x5eba42
push esp
push 0
push 0
mov eax, dword [0x619b30]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x6211b4], eax
pop edx
ret
Function at 0x5ebe64
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5ebe7b
add esp, 0xfffffff0
call fcn.004085d4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00477bf8
mov eax, dword [0x619c10]
cmp byte [eax], 0
jne 0x5ebea8
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x619f94]
cmp word [eax + 2], 0
jne 0x5ebec2
mov eax, dword [0x619f94]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005ee2fc
mov eax, dword [0x61a0dc]
cmp word [eax + 2], 0
jne 0x5ebedc
mov eax, dword [0x61a0dc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005ee500
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x50a900]
call fcn.005110a0
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5eea78
mov dl, 1
mov eax, dword [0x43f4b4]
call fcn.00407ef4
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x43f4b4]
call fcn.00407ef4
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x50f914]
call fcn.0051b65c
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5ec0cc
mov eax, dword [0x619e34]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0051bb78
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5eed60
mov dl, 1
mov eax, dword [0x43f4b4]
call fcn.00407ef4
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x619e34]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00425d60
test eax, eax
je 0x5ebff6
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00425bb8
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00425d44
test eax, eax
je 0x5ec00e
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a8d0
push ebx
push 0x5edcdc
call fcn.005e10b0
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x619c10]
cmp byte [eax], 0
jne 0x5ec05f
mov eax, ebx
call fcn.005ec294
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005eef98
mov eax, ebx
call fcn.005efc20
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5ec0c3
call fcn.0040862c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ec5c0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5ec662
cmp dword [ebx + 0xac], 0
jne 0x5ec65c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5ec500
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5ec65c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5ec622
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5ec65c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.00462928
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5ec631
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5ec908
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x62118c]
cmp dword [eax + 0x188], 0
je 0x5eca71
test bl, bl
jne 0x5ec9c4
cmp dword [esi + 0xb4], 0
jne 0x5ec9b9
mov eax, esi
call fcn.005efa70
push eax
push 0x5ec808
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5ec98a
mov eax, dword [0x62118c]
cmp byte [eax + 0xeb], 0
je 0x5ec98a
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5ec96b
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5ec98a
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5ec973
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5ec9b9
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.00462928
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5ec999
inc dword [esi + 0xb4]
jmp 0x5eca71
cmp dword [esi + 0xb4], 0
jle 0x5eca71
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5eca71
cmp dword [esi + 0x58], 0
je 0x5eca26
mov eax, dword [0x62118c]
cmp byte [eax + 0xeb], 0
je 0x5eca26
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5eca07
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5eca26
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5eca0f
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5eca55
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.00462928
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5eca35
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5dd720]
call fcn.0040c60c
pop edi
pop esi
pop ebx
ret
Function at 0x5ed7f8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5ed855
cmp byte [ebx + 0xeb], 0
jne 0x5ed855
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409f08
mov eax, dword [esi]
test eax, eax
je 0x5ed842
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5ed862
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a160
jmp 0x5ed862
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a160
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5ef1ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5ef21d
mov eax, esi
call fcn.0053fe84
test al, al
je 0x5ef21d
mov eax, dword [ebx + 0x98]
call fcn.0053fab0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5ef21d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x140]
test al, al
je 0x5ef20e
push 0
mov eax, dword [ebx + 0x98]
call fcn.0053fab0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00536650
jmp 0x5ef21d
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005eefb8
pop esi
pop ebx
ret
Function at 0x5fa8d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5faa45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00409d80
mov eax, esi
mov edx, 0x5faa60
call fcn.0040ac18
jne 0x5fa91a
xor ebx, ebx
jmp 0x5fa9c3
mov eax, esi
mov edx, 0x5faa7c
call fcn.0040ac18
jne 0x5fa932
mov ebx, 0x1a
jmp 0x5fa9c3
mov eax, esi
mov edx, 0x5faa98
call fcn.0040ac18
jne 0x5fa947
mov ebx, 0x1c
jmp 0x5fa9c3
mov eax, esi
mov edx, 0x5faab8
call fcn.0040ac18
jne 0x5fa95c
mov ebx, 0x26
jmp 0x5fa9c3
mov eax, esi
mov edx, 0x5faae0
call fcn.0040ac18
jne 0x5fa971
mov ebx, 6
jmp 0x5fa9c3
mov eax, esi
mov edx, 0x5fab00
call fcn.0040ac18
jne 0x5fa986
mov ebx, 5
jmp 0x5fa9c3
mov eax, esi
mov edx, 0x5fab28
call fcn.0040ac18
jne 0x5fa99b
mov ebx, 0x28
jmp 0x5fa9c3
mov eax, esi
mov edx, 0x5fab6c
call fcn.0040ac18
jne 0x5fa9b0
mov ebx, 0x27
jmp 0x5fa9c3
mov eax, esi
mov edx, 0x5fab90
call fcn.0040ac18
jne 0x5fa9c3
mov ebx, 0x19
xor edx, edx
push ebp
push 0x5faa22
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x5faa18
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x5faa18
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.0040a8d0
mov eax, dword [ebp - 0x214]
mov edx, edi
call fcn.005fa80c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5faa2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5faa4c
lea eax, [ebp - 0x214]
call fcn.00409d80
ret

Function at 0x5facc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5fad57
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x61a0a0]
mov eax, dword [eax]
call fcn.005edeb8
cmp ebx, 1
jne 0x5facf8
push 1
call sub.kernel32.dll_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5fad61
test ebx, ebx
jg 0x5fad06
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5fad61
call sub.kernel32.dll_GetTickCount
mov esi, eax
push 1
call sub.kernel32.dll_Sleep
mov eax, dword [0x61a0a0]
mov eax, dword [eax]
call fcn.005edeb8
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, ebx
cdq
cmp edx, dword [esp + 4]
jne 0x5fad49
cmp eax, dword [esp]
pop edx
pop eax
ja 0x5fad0d
jmp 0x5fad4d
pop edx
pop eax
jg 0x5fad0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5fad61
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5fade0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5fae15
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5fae21
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x5ffe08
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x5ffe22
add esp, 0xfffffff0
call fcn.004085d4
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x5fff42
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00406e78
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x5fff2c
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.00525f38
xor eax, eax
push ebp
push 0x5fff19
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00525f38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea esi, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [esi], eax
lea eax, [esi + 4]
mov edx, dword [ebp - 4]
call fcn.0040a90c
jmp 0x5ffee4
lea eax, [esi + 4]
mov ecx, 1
mov edx, 1
call fcn.0040ac98
mov edi, dword [esi + 4]
mov ebx, edi
test ebx, ebx
je 0x5ffef2
sub ebx, 4
mov ebx, dword [ebx]
dec ebx
jle 0x5ffefe
mov eax, dword [esi + 4]
cmp word [eax], 0x5f
je 0x5ffed2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fff20
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fff49
lea eax, [ebp - 4]
call fcn.00409dc8
ret
Function at 0x1000b870
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x1008277b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x100aaad4]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x1000b9a8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x1000b8d6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.10077423
xor eax, eax
jmp 0x1000ba1f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.10077560
push esi
lea ecx, [esp + 0xc]
call fcn.100777ef
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x1000b9fd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.1000b800
test eax, eax
jne 0x1000b9fd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.1000b800
test eax, eax
jne 0x1000b9fd
lea eax, [esp + 0x14]
push 0x100a0cac
push eax
call fcn.100681a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000b9dc
lea ecx, [esp + 0x14]
push 0x100a0ca8
push ecx
call fcn.10068120
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000b9dc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x1000b9df
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.10077510
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1000b8ee
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.10077423
xor eax, eax
jmp 0x1000ba1f
mov byte [esi], 0
push 0x100a0ca4
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.10077423
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x10048300
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1004830b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x1004840e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x1008e2c0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1008e2c0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1008e2c0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1008e2c0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1008e2c0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1008e2c0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1008e2c0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1008e2c0]
xor eax, edx
inc ecx
dec edi
jne 0x10048326
pop edi
test esi, esi
je 0x10048430
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1008e2c0]
xor eax, edx
inc ecx
dec esi
jne 0x10048412
pop esi
pop ebx
not eax
ret