joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [0x10043a6c]
mov eax, ecx
mov dword [ebp - 8], eax
push edi
mov dword [esi + 0x2d34], 0
test eax, eax
je 0x10016ff8
lea edi, [esi + 0x2d38]
mov dword [esi + 0x2d34], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10016f58
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10017c50
mov ecx, dword [edi + 4]
xor edx, edx
mov dword [edi], 0
test ecx, ecx
jne 0x10016f6f
push 8
mov ecx, edi
call fcn.10017c50
mov edx, dword [edi]
mov eax, dword [edi + 8]
mov dword [ebp - 4], 0
mov byte [edx + eax], 0
inc dword [edi]
cmp dword [esi + 0x2d44], 0
mov ebx, dword [edi]
jle 0x10016fb7
xor ebx, ebx
nop dword [eax]
mov eax, dword [esi + 0x2d4c]
add eax, ebx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x2d44]
jl 0x10016f90
mov ebx, dword [edi]
mov ecx, dword [ebp - 8]
lea eax, [ebx - 1]
neg ebx
mov edi, 0x10043a74
mov edx, 0x1003f8b0
sbb ebx, ebx
and ebx, eax
mov eax, dword [esi + 0x2d40]
test eax, eax
cmovne edi, eax
call fcn.10007820
mov esi, eax
test esi, esi
je 0x10016ff8
push esi
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026770
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x1004300c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [0x10043a6c]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push dword [0x10043aa4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
movd xmm1, eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x30]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x30]
mov ecx, edi
sub ecx, dword [0x10043aa8]
mov esi, dword [esp + 0x34]
mov edx, esi
sbb edx, dword [0x10043aac]
call fcn.1003a250
mov edx, dword [0x10043ab4]
mov ecx, dword [0x10043ab0]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x28], xmm0
call fcn.1003a250
movss xmm1, dword [esp + 0x28]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x10043aac], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x10043aa8], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0x100], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0x101], al
call esi
mov esi, dword [0x10043a6c]
shr eax, 0xf
and al, 1
mov byte [ebx + 0x103], 0
mov byte [ebx + 0x102], al
cmp byte [esi + 0x35b], 0
je 0x100268a8
cvttss2si eax, dword [esi + 0xe8]
mov dword [esp + 0x28], eax
cvttss2si eax, dword [esi + 0xec]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
push dword [0x10043aa4]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xe8], 0xff7fffff
mov dword [esi + 0xec], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x10026922
mov ecx, dword [0x10043aa4]
cmp eax, ecx
je 0x100268dc
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x10026922
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10026922
lea eax, [esp + 0x10]
push eax
push dword [0x10043aa4]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x10026922
movd xmm0, dword [esp + 0x10]
movd xmm1, dword [esp + 0x14]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xe8], xmm0
movss dword [esi + 0xec], xmm1
cmp byte [ebx + 0xb0], 0
je 0x10026930
or eax, 0xffffffff
jmp 0x1002693b
mov eax, dword [0x10043a6c]
mov eax, dword [eax + 0x1d38]
cmp dword [0x10043370], eax
je 0x1002694d
mov dword [0x10043370], eax
call fcn.100263c0
call fcn.100264f0
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10038f5a
mov esp, ebp
pop ebp
ret
Function at 0x10038590
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003868a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10038683
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x10038669
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10038669
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10038669
mov edx, dword [esi]
test edx, edx
jne 0x10038632
push 0x200
push edx
push dword [0x10043a7c]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10038683
jmp 0x1003865d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1003865d
shl eax, 3
push eax
push edx
push 0
push dword [0x10043a7c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10038683
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100385f1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x100386cf
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x100386cf
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100386c9
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.10038420
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10038696
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038f5a
mov esp, ebp
pop ebp
ret
Function at 0x100386e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1004300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x10043bb0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10038741
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038f5a
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10038762
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10038783
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10038783
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1003877d
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10038783
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [esi + 0x14]
and bl, 1
mov cl, bl
and al, 0xfd
add cl, cl
shl bl, 2
or cl, al
xor eax, eax
and cl, 0xfb
or cl, bl
mov byte [esi + 0x14], cl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038f5a
mov esp, ebp
pop ebp
ret
Function at 0x100387e0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x10043bb8]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x100388d1
mov eax, dword [0x10043bb0]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x10038825
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10038808
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x100388d1
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.10038590
mov ecx, dword [0x10043bb8]
add esp, 4
cmp esi, ecx
jae 0x10038885
imul edi, esi, 0x2c
mov eax, dword [0x10043bb0]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x1003887a
mov edx, ebx
mov ecx, esi
call fcn.100386e0
mov dword [ebp - 4], eax
test eax, eax
jne 0x10038882
mov ecx, dword [0x10043bb8]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10038851
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100388d1
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x100388c2
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100388b6
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10038895
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x10043a7c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10001130
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
push dword [esp + 0x14]
call fcn.1000e3e0
mov esi, eax
add esp, 4
test esi, esi
jns 0x10001161
push 0x44d
push str.hprof_check.c
push str.fd_0
push 0
push 1
call fcn.10005090
add esp, 0x14
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call fcn.1000e430
mov ebx, eax
add esp, 0xc
mov ecx, ebx
and ecx, edx
cmp ecx, 0xffffffff
jne 0x10001194
push 0x44f
push str.hprof_check.c
push str.Cannot_md_seek___to_end_of_file
push 0
push 1
call fcn.10005090
add esp, 0x14
cmp ebx, 0x200
jg 0x100011b7
push 0x451
push str.hprof_check.c
push str.__jint_nbytes__512
push 0
push 1
call fcn.10005090
add esp, 0x14
push 0
push 0
push esi
call fcn.1000e430
add esp, 0xc
or eax, edx
je 0x100011e3
push 0x453
push str.hprof_check.c
push str.Cannot_md_seek___to_start_of_file
push 0
push 1
call fcn.10005090
add esp, 0x14
lea eax, [ebx + 1]
push eax
call fcn.10016960
mov edi, eax
add esp, 4
test edi, edi
jne 0x1000120f
push 0x456
push str.hprof_check.c
push str.image_NULL
push eax
push 1
call fcn.10005090
add esp, 0x14
push ebp
push ebx
push edi
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
mov ebp, eax
add esp, 0xc
test ebp, ebp
jg 0x1000123c
push 0x45b
push str.hprof_check.c
push str.System_read_failed.
push 0
push 1
call fcn.10005090
add esp, 0x14
cmp ebx, ebp
pop ebp
je 0x1000125c
push 0x45d
push str.hprof_check.c
push str.__jint_nbytes_nread
push 0
push 1
call fcn.10005090
add esp, 0x14
push esi
call fcn.1000e010
add esp, 4
test edi, edi
jne 0x10001280
mov eax, dword [esp + 0x14]
push eax
push str.No_file_image:__s_n
call fcn.10002c50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [0x1001f83c]
mov ecx, dword [eax + 0x10]
mov eax, edi
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100012b0
test dl, dl
je 0x100012ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100012b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001290
xor eax, eax
jmp 0x100012b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100012d4
push 0x474
push str.hprof_check.c
push str.strcmp__char_p__gdata__header_0
push 0
push 1
call fcn.10005090
add esp, 0x14
mov eax, dword [esp + 0x14]
push edi
push ebx
push eax
push str.Filename_s__nbytes_d__header__s__n
call fcn.10002c50
mov ecx, edi
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100012f0
sub ecx, edx
lea esi, [ecx + edi]
lea eax, [esi + 1]
sub eax, ecx
sub eax, edi
lea ecx, [esp + eax + 0xb]
mov eax, dword [esi + 1]
mov dword [ecx], eax
push dword [esp + 0xc]
call fcn.1000e2a0
add esp, 4
cmp eax, 4
je 0x10001338
push 0x479
push str.hprof_check.c
push str.idsizesizeof_HprofId_
push 0
push 1
call fcn.10005090
add esp, 0x14
mov eax, dword [esi + 5]
push eax
call fcn.1000e2a0
mov eax, dword [esi + 9]
add esi, 0xd
push eax
call fcn.1000e2a0
mov eax, edi
sub eax, esi
add eax, ebx
push eax
push esi
call fcn.10017fde
push ebx
push eax
push str._d_total_records_found_in__d_bytes_n
call fcn.10002c50
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0x20
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10017fde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10017fed
pop dword [ebp - 0x48]
mov eax, 0x1e1ee88b
sub eax, 0xe1d689e
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xfa8f73aa
sub dword [ebp - 0x58], 0xac3d2e5f
mov dword [ebp - 0x54], 0xd41ba9df
add dword [ebp - 0x54], 0x5e17a266
mov dword [ebp - 0x50], 0x381243d1
sub dword [ebp - 0x50], 0xebc5ffa3
mov dword [ebp - 0x4c], 0x54486f72
sub dword [ebp - 0x4c], 0x54486f72
lea eax, [ebp - 0x58]
push eax
mov eax, 0x24bdbac0
add eax, 0xeb43d57c
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xb5a668fd
sub dword [ebp - 0x58], 0x4133ffa7
mov dword [ebp - 0x54], 0x646790fa
add dword [ebp - 0x54], 0xdd04d07b
mov dword [ebp - 0x50], 0x3e96fee2
add dword [ebp - 0x50], 0x24d86d8a
mov dword [ebp - 0x4c], 0xfcce6284
sub dword [ebp - 0x4c], 0xfcce6284
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x34a02
push 0
call eax
mov ecx, 0x4070
mov esi, eax
mov edx, 0xff9e020f
sub edx, 0xef9bda0f
add edx, dword [ebp - 0x48]
mov edi, 0xf0af410d
add edi, 0xd3dc235e
mov ebx, dword [edx]
add dword [ebp - 0x28], 0x4e859357
xor ebx, edi
mov dword [esi], ebx
mov dword [ebp - 0x44], 0x90f6bf52
add esi, 0x8d780926
sub esi, 0x8d780922
add edx, 0x91333012
add edx, 0x6ecccff2
loop 0x10018104
add eax, 0xfbf02394
sub eax, 0xfbef2f01
mov ebx, eax
add eax, 0x543d881
sub eax, 0x543d87c
mov ecx, 0x440a1f6c
sub ecx, 0x340a1f6c
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401d20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401d6b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401d64
test esi, esi
je 0x401d64
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401d40
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401f50
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401fa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402078
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401fde
cmp eax, 4
jne 0x402000
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401fee
cmp edx, 4
je 0x401fee
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401f50
Function at 0x48ea30
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5b64ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.005a584c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x48eab2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.005a2484
mov eax, dword [eax]
push 0x801fb8
push eax
call fcn.0057d454
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.005a5ad7
test bl, bl
je 0x48eab2
push 0x801fb8
lea ecx, [esp + 0xc]
call fcn.005a5eb3
push 0x801fc4
lea ecx, [esp + 0xc]
call fcn.005a5eb3
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x48eaee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.005a5ad7
jmp 0x48ebb9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x48eb72
lea edx, [esp + 0x7c]
push 0x801fc0
push edx
call fcn.0057d454
add esp, 8
test eax, eax
je 0x48eb72
lea eax, [esp + 0x7c]
push 0x801fbc
push eax
call fcn.0057d454
add esp, 8
test eax, eax
je 0x48eb72
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x48eb02
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.005a5ad7
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x48fe20
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x48fe82
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x48fe90
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5b660b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x814328]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x48ffc8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x48fef6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005a5ad7
xor eax, eax
jmp 0x49003f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.005a5c60
push esi
lea ecx, [esp + 0xc]
call fcn.005a5eef
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x802008
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x49001d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push bind
call fcn.0048fe20
test eax, eax
jne 0x49001d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push bind
mov ecx, edi
call fcn.0048fe20
test eax, eax
jne 0x49001d
lea eax, [esp + 0x14]
push 0x801fe4
push eax
call fcn.0057e800
mov esi, eax
add esp, 8
test esi, esi
jne 0x48fffc
lea ecx, [esp + 0x14]
push 0x801fe0
push ecx
call fcn.0057e780
mov esi, eax
add esp, 8
test esi, esi
jne 0x48fffc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x48ffff
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.005a5c10
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x48ff0e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005a5ad7
xor eax, eax
jmp 0x49003f
mov byte [esi], 0
push 0x801fdc
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.005a5ad7
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4