joyce8/EMBER2024-capa huggingface dataset:
Function at 0x22917363
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x229190a0
call fcn.229178a4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x2291a8d4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x22917178
cmp eax, esi
jne 0x2291716b
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x2291717b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x22917152
xor esi, esi
inc esi
mov eax, dword [0x2291a8d0]
cmp eax, esi
jne 0x2291718e
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x229171c9
mov eax, dword [0x2291a8d0]
test eax, eax
jne 0x229171c3
mov dword [0x2291a8d0], esi
push 0x229111c8
push 0x229111bc
call fcn.229170cf
pop ecx
pop ecx
test eax, eax
je 0x229171c9
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x22917293
mov dword [0x2291a374], esi
mov eax, dword [0x2291a8d0]
cmp eax, esi
jne 0x229171ed
push 0x229111b8
push 0x229111b0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x2291a8d0], 2
cmp dword [ebp - 0x1c], ebx
jne 0x229171fa
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x2291a8dc], ebx
je 0x2291721b
push 0x2291a8dc
call fcn.22917819
pop ecx
test eax, eax
je 0x2291721b
push ebx
push 2
push ebx
call dword [0x2291a8dc]
push dword [0x2291a35c]
push dword [0x2291a360]
push dword [0x2291a358]
call fcn.22916e3f
add esp, 0xc
mov dword [0x2291a370], eax
cmp dword [0x2291a364], ebx
jne 0x22917279
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x2291a374], ebx
jne 0x22917287
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x2291a370]
call fcn.229178e9
ret
call fcn.229179f1
jmp 0x22917130
Function at 0x22917e45
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x2291a01c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x2291a6a4], edi
jne 0x22917f61
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x22917eac
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x2291a6a4], edi
pop esi
je 0x22917f34
dec eax
jne 0x22917f61
cmp dword [ebp - 0x11c], 5
jne 0x22917f21
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x22917f15
dec eax
je 0x22917f02
dec eax
je 0x22917ee8
mov dword [0x2291a6a4], 0x14
jmp 0x22917f61
cmp word [ebp - 0xc], 1
jb 0x22917ef9
mov dword [0x2291a6a4], 0x10
or dword [0x2291a6a4], 4
jmp 0x22917f61
cmp word [ebp - 0xc], 2
jb 0x22917ef9
mov dword [0x2291a6a4], 8
jmp 0x22917ef9
mov dword [0x2291a6a4], 4
jmp 0x22917f61
cmp dword [ebp - 0x11c], 4
ja 0x22917f73
mov dword [0x2291a6a4], 2
cmp dword [ebp - 0x11c], 4
jne 0x22917f61
cmp dword [ebp - 0x118], edi
je 0x22917f57
cmp dword [ebp - 0x118], 0xa
je 0x22917f57
cmp dword [ebp - 0x118], 0x5a
jne 0x22917f61
mov dword [0x2291a6a4], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x2291a6a4]
xor ecx, ebp
pop edi
call fcn.22917372
leave
ret
mov dword [0x2291a6a4], 0x20
jmp 0x22917f61

Function at 0x22917f84
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x2291a01c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x22917fd8
push 3
lea eax, [ebp - 0x44]
push 0x229117d8
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.22917372
leave
ret
Function at 0x22917fed
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x2291a01c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x2291a6a8]
jne 0x22918088
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x22911708
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x22918087
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x229117c0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x22918087
push 3
push dword [esi*8 + 0x22911558]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x22918079
inc esi
cmp esi, 0x1c
jb 0x22918058
jmp 0x22918087
mov ax, word [esi*8 + 0x2291155c]
mov word [0x2291a6a8], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x2291a6a8]
xor ecx, ebp
call fcn.22917372
leave
ret
Function at 0x1001795
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10017a7
mov eax, 0x3f2
jmp 0x1001806
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
shr eax, 1
cmp eax, 2
jge 0x10017b9
push 4
pop ecx
jmp 0x10017de
lea ecx, [eax + eax]
cmp word [ecx + edx - 2], si
je 0x10017ce
inc eax
inc eax
lea ecx, [eax + eax]
mov word [ecx + edx], si
jmp 0x10017d9
cmp word [edx + eax*2 - 4], si
je 0x10017de
inc eax
lea ecx, [eax + eax]
mov word [ecx + edx + 2], si
cmp eax, 2
jg 0x10017f3
push 0x10014c8
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1001806
push ecx
push edx
push 7
push esi
push 0x10014c8
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop ebp
ret 0xc
Function at 0x1001b85
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
mov dword [eax], esi
mov eax, dword [ebp + 8]
cmp eax, esi
push edi
je 0x1001cfe
cmp word [eax], si
je 0x1001cfe
lea ecx, [ebp - 4]
push ecx
push 0x80000002
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
jne 0x1001be5
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp + 8]
push eax
push 1
push esi
push dword [0x1004008]
push dword [ebp - 4]
call edi
test eax, eax
je 0x1001bee
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x8c]
push eax
push esi
push esi
push dword [0x100400c]
mov dword [ebp - 8], 0x40
push dword [ebp + 8]
call ebx
test eax, eax
je 0x1001c1c
push dword [ebp + 8]
jmp 0x1001c38
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x4c]
push eax
push esi
push esi
push dword [0x1004010]
push dword [ebp + 8]
call ebx
test eax, eax
push dword [ebp + 8]
je 0x1001c47
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
jmp 0x1001be5
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 8]
push eax
push 1
push esi
push dword [0x100401c]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1001c89
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
push eax
push esi
push esi
mov dword [eax], esi
push dword [0x1004020]
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x1001c84
cmp dword [ebp - 8], 4
je 0x1001c89
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov ebx, dword [sym.imp.msvcrt.dll__wtoi]
lea eax, [ebp - 0x8c]
push eax
call ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x4c]
push eax
call ebx
cmp eax, 5
pop ecx
pop ecx
jb 0x1001cf5
cmp dword [ebp - 0xc], 0x893
jbe 0x1001cf5
lea eax, [ebp + 8]
push eax
push 1
push esi
push dword [0x100401c]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1001cf5
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push edi
push esi
push esi
push dword [0x1004020]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001cea
cmp dword [ebp - 8], 4
je 0x1001cec
mov dword [edi], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1a0]
push eax
mov dword [ebp - 0x1a0], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1001be5
cmp dword [ebp - 0x19c], 5
jb 0x1001be5
cmp dword [ebp - 0x198], esi
jbe 0x1001be5
cmp dword [ebp - 0x194], 0x893
jbe 0x1001be5
xor eax, eax
inc eax
jmp 0x1001be7
Function at 0x1001d4e
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 0x80000002
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
cmp eax, edi
jne 0x1001dcd
cmp dword [ebp - 4], edi
jne 0x1001d80
push 0x57
pop eax
jmp 0x1001dcd
push esi
lea eax, [ebp + 8]
push eax
push 3
push edi
push dword [0x100401c]
mov dword [ebp + 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1001da8
mov edi, eax
jmp 0x1001dc5
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
push dword [0x1004020]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call esi
push dword [ebp - 4]
call esi
mov eax, edi
pop esi
pop edi
leave
ret 4
Function at 0x1001fe4
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x409
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
cmp dword [0x1004650], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov ebx, dword [sym.imp.ntdll.dll_RtlUnicodeStringToInteger]
mov dword [ebp - 0x14], eax
jne 0x100208c
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
test eax, eax
mov dword [ebp - 0xc], eax
je 0x100208c
push 0x10
lea ecx, [ebp - 0x44]
push ecx
push 0x1004
push eax
call esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x24]
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0xa
lea eax, [ebp - 0x24]
push eax
call ebx
push 0x10
lea eax, [ebp - 0x44]
push eax
push 0xb
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x24]
push eax
call edi
push 0x1004654
push 0xa
lea eax, [ebp - 0x24]
push eax
call ebx
mov eax, dword [ebp - 0xc]
and eax, 0x3ff
mov dword [0x100464c], eax
cmp word [ebp - 8], 0
je 0x10020e0
movzx eax, word [ebp - 8]
push 0x10
lea ecx, [ebp - 0x44]
push ecx
push 0x1004
push eax
call esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x24]
push eax
call edi
lea eax, [ebp - 0x10]
push eax
push 0xa
lea eax, [ebp - 0x24]
push eax
call ebx
push 0x10
lea eax, [ebp - 0x44]
push eax
movzx eax, word [ebp - 8]
push 0xb
push eax
call esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x24]
push eax
call edi
lea eax, [ebp - 0x18]
push eax
push 0xa
lea eax, [ebp - 0x24]
push eax
call ebx
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1002121
mov eax, dword [0x100464c]
cmp eax, 1
je 0x1002121
cmp eax, 0xd
je 0x1002121
cmp eax, 0x2a
je 0x1002121
cmp eax, 0x1e
je 0x1002121
cmp ecx, dword [0x1004650]
je 0x1002110
cmp ecx, dword [0x1004654]
jne 0x1002121
cmp ecx, dword [ebp - 0x10]
je 0x100211a
cmp ecx, dword [ebp - 0x18]
jne 0x1002121
movzx eax, word [ebp - 8]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 0x1c]
cmp dword [ebp - 4], esi
je 0x1002139
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
test eax, eax
jne 0x1002139
mov dword [ebp - 4], esi
mov ax, word [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10023cb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
xor edx, edx
cmp esi, ebx
push edi
lea eax, [ebp - 0x58]
je 0x1002408
cmp word [esi], bx
je 0x1002403
mov ecx, esi
lea edi, [ebp - 0x58]
sub ecx, edi
mov di, word [ecx + eax]
mov word [eax], di
inc eax
inc eax
inc edx
cmp edx, 0x20
jge 0x1002403
cmp word [ecx + eax], bx
jne 0x10023ee
mov word [eax], bx
jmp 0x100241a
push 0x65
call fcn.010015fc
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.01001b85
test eax, eax
je 0x1002445
cmp dword [ebp - 0xc], ebx
lea eax, [ebp - 0x58]
push eax
je 0x1002435
push 8
jmp 0x1002437
push 4
push 1
call fcn.01002236
xor eax, eax
jmp 0x100250b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.010016a7
mov esi, eax
cmp esi, ebx
je 0x1002479
push 0x193
call fcn.0100165b
push eax
call fcn.01002144
pop ecx
mov eax, esi
jmp 0x100250b
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.010018a8
mov esi, eax
push 4
pop eax
mov ecx, esi
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffc
add ecx, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push dword [0x1004028]
mov dword [ebp - 0x14], ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, ebx
je 0x10024cc
push 0x192
call fcn.0100165b
push eax
call fcn.01002144
pop ecx
jmp 0x10024d8
lea eax, [ebp - 0x58]
push eax
push esi
push 1
call fcn.01002236
push dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0x18]
call esi
cmp edi, ebx
je 0x1002509
push edi
push 0x198
call fcn.0100165b
push eax
call fcn.01002144
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1002979
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x10015c8
xor esi, esi
push esi
call dword [sym.imp.msvcrt.dll_setlocale]
pop ecx
pop ecx
push esi
call fcn.01001fe4
mov ebp, dword [esp + 0x18]
mov ebx, dword [sym.imp.msvcrt.dll_malloc]
mov eax, ebp
shl eax, 2
push eax
call ebx
mov edi, eax
cmp edi, esi
pop ecx
je 0x1002a17
cmp ebp, esi
mov dword [esp + 0x18], esi
jle 0x10029f6
mov eax, dword [esp + 0x1c]
sub eax, edi
mov esi, edi
mov dword [esp + 0x10], eax
jmp 0x10029c7
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10029cd
sub eax, ecx
lea eax, [eax*4 + 4]
push eax
call ebx
test eax, eax
pop ecx
mov dword [esi], eax
je 0x1002a17
inc dword [esp + 0x18]
add esi, 4
cmp dword [esp + 0x18], ebp
jl 0x10029c3
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.01001b47
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp ebp, 1
mov dword [0x1004648], eax
jne 0x1002a1f
push esi
jmp 0x1002a2e
push 1
call dword [sym.imp.msvcrt.dll_exit]
cmp ebp, 2
jl 0x1002a54
mov eax, dword [edi + 4]
cmp word [eax], 0x5c
jne 0x1002a35
push eax
call fcn.010023cb
jmp 0x1002a59
cmp ebp, 2
jne 0x1002a3d
push esi
jmp 0x1002a45
cmp ebp, 3
jne 0x1002a4d
push dword [edi + 8]
push eax
call fcn.01002512
jmp 0x1002a59
call fcn.0100215f
jmp 0x1002a59
call fcn.010021c8
push 0x10015c4
call fcn.01002144
test ebp, ebp
mov ebx, dword [sym.imp.msvcrt.dll_free]
pop ecx
jle 0x1002a7d
push dword [edi + esi*4]
call ebx
and dword [edi + esi*4], 0
inc esi
cmp esi, ebp
pop ecx
jl 0x1002a6e
push edi
call ebx
pop ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x1002a89
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10015d0
call fcn.01002c28
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1002ac4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002ac4
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1002adc
cmp eax, 0x20b
je 0x1002ac9
mov dword [ebp - 0x1c], edi
jmp 0x1002af0
cmp dword [ecx + 0x84], 0xe
jbe 0x1002ac4
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1002aea
cmp dword [ecx + 0x74], 0xe
jbe 0x1002ac4
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100466c], 0xffffffff
or dword [0x1004670], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1004664]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1004660]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1004674], eax
call fcn.01002c22
cmp dword [0x1004038], edi
jne 0x1002b4b
push fcn.01002c22
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01002c10
push 0x100111c
push 0x1001118
call sub.msvcrt.dll__initterm
mov eax, dword [0x100465c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1004658]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001114
push 0x1001110
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01002979
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x1002bc2
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1002bf7
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01002c61
ret
Function at 0x408b90
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49432b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048916b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x408c12
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004870ba
mov eax, dword [eax]
push 0x5121f0
push eax
call fcn.004790d4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004893f6
test bl, bl
je 0x408c12
push 0x5121f0
lea ecx, [esp + 0xc]
call fcn.00489786
push 0x515d4c
lea ecx, [esp + 0xc]
call fcn.00489786
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x408c4e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004893f6
jmp 0x408d19
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x408cd2
lea edx, [esp + 0x7c]
push 0x515d48
push edx
call fcn.004790d4
add esp, 8
test eax, eax
je 0x408cd2
lea eax, [esp + 0x7c]
push 0x515d44
push eax
call fcn.004790d4
add esp, 8
test eax, eax
je 0x408cd2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408c62
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004893f6
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x409510
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x409572
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x409580
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4943ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x526b40]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4096b8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4095e6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004893f6
xor eax, eax
jmp 0x40972f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00489533
push esi
lea ecx, [esp + 0xc]
call fcn.004897c2
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40970d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00409510
test eax, eax
jne 0x40970d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00409510
test eax, eax
jne 0x40970d
lea eax, [esp + 0x14]
push 0x515d60
push eax
call fcn.0047a150
mov esi, eax
add esp, 8
test esi, esi
jne 0x4096ec
lea ecx, [esp + 0x14]
push 0x515d5c
push ecx
call fcn.0047a0d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4096ec
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4096ef
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004894e3
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4095fe
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004893f6
xor eax, eax
jmp 0x40972f
mov byte [esi], 0
push 0x515d58
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004893f6
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4