joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4647f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov word [ebp - 2], ax
mov al, byte [0x464848]
mov byte [ebp - 3], al
test byte [ebp - 2], 4
je 0x46480a
or byte [ebp - 3], 1
test byte [ebp - 2], 8
je 0x464814
or byte [ebp - 3], 4
test byte [ebp - 2], 1
je 0x46481e
or byte [ebp - 3], 8
test byte [ebp - 2], 2
je 0x464828
or byte [ebp - 3], 0x10
test byte [ebp - 2], 0x10
je 0x464832
or byte [ebp - 3], 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x464842
or byte [ebp - 3], 2
mov al, byte [ebp - 3]
pop ecx
pop ebp
ret

Function at 0x46484c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov al, byte [0x464890]
mov byte [ebp - 5], al
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46486d
or byte [ebp - 5], 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46487d
or byte [ebp - 5], 4
test byte [ebp - 1], 0x20
je 0x464887
or byte [ebp - 5], 2
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x46c800
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
test dl, dl
je 0x46c812
add esp, 0xfffffff0
call fcn.00403bd8
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0041dae0
mov eax, dword [0x48207c]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x46cd70
mov eax, dword [0x482088]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x46cd90
mov eax, dword [ebp - 4]
call fcn.0046cdb0
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov dl, 1
mov eax, dword [0x413dc0]
call fcn.00403870
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
mov dl, 1
mov eax, dword [0x413dc0]
call fcn.00403870
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], eax
mov dl, 1
mov eax, dword [0x413dc0]
call fcn.00403870
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], eax
mov dl, 1
mov eax, dword [0x413dc0]
call fcn.00403870
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], eax
mov dl, 1
mov eax, dword [0x413dc0]
call fcn.00403870
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x10], eax
push 0x5a
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_GetDeviceCaps
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, 0x4681c0
push eax
push 0
push 0
mov eax, dword [0x4821e8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41fd40]
call fcn.00421668
mov edx, dword [ebp - 4]
mov dword [edx + 0x84], eax
mov dl, 1
mov eax, dword [0x41fd40]
call fcn.00421668
mov edx, dword [ebp - 4]
mov dword [edx + 0x88], eax
mov dl, 1
mov eax, dword [0x41fd40]
call fcn.00421668
mov edx, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov eax, dword [ebp - 4]
call fcn.0046d2fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x46d148
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x46d148
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x46d148
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x46c99a
call fcn.00403c30
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x46cf00
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
xor edx, edx
mov dword [ebp - 0x268], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46d0cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x46d0a9
mov dl, 1
mov eax, dword [0x4141dc]
call fcn.00403870
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004046b0
lea eax, [ebp - 0x11c]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x46d092
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
call fcn.004573e0
test al, al
je 0x46d086
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
lea ecx, [ebp - 0x264]
mov edx, 0x46d0dc
lea eax, [ebp - 0x25c]
call fcn.0040a0dc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46d086
xor eax, eax
push ebp
push 0x46d07f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], pe_nt_image_headers32
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x46d114
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46d068
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x21c]
mov ecx, pe_nt_image_headers32
call fcn.00404920
mov edx, dword [ebp - 0x268]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x46d068
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x21c]
mov ecx, pe_nt_image_headers32
call fcn.00404920
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d086
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x46cf75
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dl, 1
call fcn.00418b30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d0d2
lea eax, [ebp - 0x268]
call fcn.004046b0
ret
Function at 0x46dc04
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x483be0]
cmp byte [eax + 0xa5], 0
jne 0x46dc7b
cmp dword [0x483bf8], 0
jne 0x46dc39
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x46dbc0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x483bf8], eax
cmp dword [0x483bf4], 0
jne 0x46dc54
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x483bf4], eax
cmp dword [0x483bfc], 0
jne 0x46dc7b
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x46db60
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x483bfc], eax
pop ecx
pop ebp
ret

Function at 0x46dd44
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.0046dcdc
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x46dd65
xor eax, eax
call fcn.0046dd14
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x46dd7f
mov al, 1
call fcn.0046dd14
mov esp, ebp
pop ebp
ret

Function at 0x46e448
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x483be0]
cmp dword [eax + 0x30], 0
je 0x46e512
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x46e509
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x46e3c8
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
cmp dword [eax + 8], 0
je 0x46e509
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
push 0xffffffffffffffec
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46e4c3
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x46e509
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
call fcn.004166ac
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x46e4d8
mov eax, dword [ebp - 4]
inc dword [eax + 0x94]
mov esp, ebp
pop ebp
ret

Function at 0x46f228
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa4], 0
je 0x46f26d
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 8]
call fcn.004047a0
jmp 0x46f27e
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x8c]
call fcn.00404704
mov esp, ebp
pop ebp
ret
Function at 0x47070c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
je 0x47075f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00451748
test al, al
je 0x47075f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00451278
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47075f
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00451278
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret

Function at 0x472728
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b60
xor eax, eax
push ebp
push 0x472779
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b70
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x47275d
test al, 0x10
jne 0x472761
xor ebx, ebx
jmp 0x472763
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472780
lea eax, [ebp - 4]
call fcn.004046b0
ret

Function at 0x47305c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push 0x400
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004047a0
add esp, 0x400
pop ebx
ret
Function at 0x475410
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x475591
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47556c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x119], 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x105
lea eax, [ebp - 0x119]
push eax
lea eax, [ebp - 0x120]
mov dl, byte [ebp - 1]
call fcn.00404898
lea eax, [ebp - 0x120]
mov edx, 0x4755a4
call fcn.00404978
mov eax, dword [ebp - 0x120]
call fcn.00404b70
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4754d0
lea eax, [ebp - 0x119]
call fcn.004099ac
mov ecx, eax
lea edx, [ebp - 0x119]
mov eax, dword [ebp - 8]
call fcn.004047a0
jmp 0x4754d8
mov eax, dword [ebp - 8]
call fcn.004046b0
cmp byte [ebp - 1], 0x61
jae 0x4754fe
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040e13c
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 8]
call fcn.00404704
jmp 0x47551c
lea edx, [ebp - 0x128]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040e068
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 8]
call fcn.00404704
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x134], eax
mov byte [ebp - 0x130], 0xb
lea edx, [ebp - 0x134]
xor ecx, ecx
mov eax, 0x4755b0
call fcn.0040a190
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 8]
call fcn.00404704
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475573
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0xa84058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa841a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa8407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa8406a
add dl, dl
jne 0xa84089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa840dc
xor eax, eax
add dl, dl
jne 0xa84096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa8417d
add dl, dl
jne 0xa840a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa840b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa840bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa840c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa840d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa84075
mov eax, 1
add dl, dl
jne 0xa840ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa840f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa840e1
sub eax, ebx
mov ebx, 1
jne 0xa84128
mov ecx, 1
add dl, dl
jne 0xa8410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa84119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa84105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa84075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa8413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa8414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa84136
cmp eax, 0x7d00
jae 0xa8416d
cmp eax, 0x500
jb 0xa84168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa84075
cmp eax, 0x7f
ja 0xa84170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa84075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa8419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa84075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40331c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.00405b7a
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00405b7a
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
push 0x10
call fcn.00405b7a
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x4069e0
call fcn.00405b98
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
je 0x4033dc
mov eax, 0
jmp 0x403548
cmp dword [ebp + 0xc], 0
jne 0x403408
mov dword [ebp - 0x1c], esp
mov eax, 0x15
call fcn.00405b92
cmp dword [ebp - 0x1c], esp
je 0x403405
push 6
call fcn.00405b8c
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x403430
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x40342a
push ebx
call fcn.00405b74
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x16
call fcn.00405b92
cmp dword [ebp - 0x1c], esp
je 0x40345b
push 6
call fcn.00405b8c
add esp, 4
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x489e3d
mov eax, 0x17
call fcn.00405b92
cmp dword [ebp - 0x1c], esp
je 0x403487
push 6
call fcn.00405b8c
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 2
mov dword [ebp - 0x1c], esp
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x18
call fcn.00405b92
cmp dword [ebp - 0x1c], esp
je 0x40351b
push 6
call fcn.00405b8c
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 8]
mov eax, 0x19
call fcn.00405b92
cmp dword [ebp - 0x1c], esp
je 0x403540
push 6
call fcn.00405b8c
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x403548
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00405b74
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00405b74
add esp, 4
mov ebx, dword [ebp - 0x18]
push ebx
call fcn.00405b74
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40d950
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48294b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00475355
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40d9d2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00472bad
mov eax, dword [eax]
push 0x4b3210
push eax
call fcn.00465604
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004755e0
test bl, bl
je 0x40d9d2
push 0x4b3210
lea ecx, [esp + 0xc]
call fcn.004759bc
push 0x4b6d7c
lea ecx, [esp + 0xc]
call fcn.004759bc
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40da0e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004755e0
jmp 0x40dad9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40da92
lea edx, [esp + 0x7c]
push 0x4b6d78
push edx
call fcn.00465604
add esp, 8
test eax, eax
je 0x40da92
lea eax, [esp + 0x7c]
push 0x4b6d74
push eax
call fcn.00465604
add esp, 8
test eax, eax
je 0x40da92
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40da22
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004755e0
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40e2d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40e332
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40e340
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4829cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4c35e8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40e478
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40e3a6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004755e0
xor eax, eax
jmp 0x40e4ef
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00475769
push esi
lea ecx, [esp + 0xc]
call fcn.004759f8
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x4b6db4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40e4cd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040e2d0
test eax, eax
jne 0x40e4cd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040e2d0
test eax, eax
jne 0x40e4cd
lea eax, [esp + 0x14]
push 0x4b6d90
push eax
call fcn.004666e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e4ac
lea ecx, [esp + 0x14]
push 0x4b6d8c
push ecx
call fcn.00466660
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e4ac
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40e4af
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00475719
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40e3be
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004755e0
xor eax, eax
jmp 0x40e4ef
mov byte [esi], 0
push 0x4b6d88
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004755e0
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4