joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44593c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x445a14
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x474b58], 0
jne 0x4459f8
lea eax, [ebp - 4]
mov edx, 0x445a2c
call fcn.0045f2e0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0045f68c
mov esi, eax
push esi
call fcn.0046cffe
mov ebx, eax
test ebx, ebx
je 0x4459f8
mov eax, ebx
call fcn.0045df54
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4459f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call fcn.0046cff8
test eax, eax
je 0x4459db
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x445a3c
mov eax, dword [ebp - 0xc]
push eax
call fcn.0046d004
test eax, eax
je 0x4459db
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x474b58], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4459f8
mov eax, dword [ebp - 0xc]
call fcn.0045df6c
ret
mov ebx, dword [0x474b58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445a1b
lea eax, [ebp - 4]
call fcn.0045f248
ret

Function at 0x44b9e8
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x474b7c], 0
jne 0x44ba0b
call fcn.0046ce20
push eax
push 0
mov eax, 0x44b96c
push eax
push 3
call fcn.0046d58c
mov dword [0x474b7c], eax
ret

Function at 0x459a70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call fcn.0046ce56
test eax, eax
jle 0x459aa9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0045f330
jmp 0x459ab2
mov eax, ebx
mov edx, esi
call fcn.0045f29c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x459abc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call fcn.0046ce56
test eax, eax
jle 0x459add
mov al, byte [esp]
jmp 0x459adf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x45e0e4
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x45e121
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x108]
push eax
push 0x104
call fcn.0046ce14
push esp
call fcn.0046cf58
lea eax, [esp + 4]
push eax
push 0x104
call fcn.0046ce14
test bl, bl
je 0x45e141
lea eax, [esp + 0x108]
push eax
call fcn.0046cf58
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.0045f478
add esp, 0x20c
pop esi
pop ebx
ret
Function at 0x45e2a0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x45e2cf
push 0x105
lea eax, [esp + 4]
push eax
push 0
call fcn.0046ce62
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0045f330
jmp 0x45e2ed
call fcn.0046ce0e
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0045e228
mov edi, eax
test ebx, ebx
je 0x45e2ed
cmp dword [esi], 0
je 0x45e2ed
dec ebx
jmp 0x45e2d6
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x45e650
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x471130]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x45e6e8
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x45e6c8
xor eax, eax
push ebp
push 0x45e6c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x45e704
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e6c8
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x471130]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x471130], ax
mov esp, ebp
pop ebp
ret
Function at 0x4607c0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call fcn.0046ce62
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x46097c
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x460821
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x460998
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x460893
xor eax, eax
push ebp
push 0x46088c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00460618
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x460875
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4609b8
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460893
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call fcn.0046cfdc
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call fcn.0046ce98
push eax
call fcn.0046ce56
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x460974
cmp byte [ebp - 0xd], 0
jne 0x4608d5
cmp byte [ebp - 0x12], 0
je 0x460974
lea eax, [ebp - 0x11d]
push eax
call fcn.0046cfe8
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4608ee
dec ebx
cmp byte [ebx], 0x2e
je 0x4608fd
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4608ed
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x460974
inc ebx
cmp byte [ebp - 0x12], 0
je 0x46092a
lea eax, [ebp - 0x12]
push eax
push ebx
call fcn.0046cfdc
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.0046cf10
mov esi, eax
test esi, esi
jne 0x460974
cmp byte [ebp - 0xd], 0
je 0x460974
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.0046cfdc
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.0046cf10
mov esi, eax
test esi, esi
jne 0x460974
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.0046cfdc
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.0046cf10
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460d68
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x460e50
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x4751f0], 1
jae 0x460e42
xor eax, eax
mov dword [0x474dfc], eax
xor eax, eax
mov dword [0x474e04], eax
xor eax, eax
mov dword [0x474e08], eax
mov byte [0x474e0e], 2
mov byte [0x474e0f], 2
mov byte [0x474e10], 3
mov word [0x4751b8], 0
mov word [0x4751c8], 1
mov word [0x4751d8], 0xa
mov dword [0x4751e0], 0x80020004
mov dword [0x4751ac], 0x45ff54
mov dword [0x4751b0], 0x45ff4c
mov dword [0x4751b4], 0x45ff54
call fcn.0045e620
test al, al
je 0x460e01
call fcn.0045e650
call fcn.0045e714
mov eax, 0x474e14
mov edx, 0x460e5c
call fcn.0045bcaa
mov eax, 0x474fe0
mov edx, 0x460e5c
call fcn.0045bcaa
call fcn.0046ce0e
mov dword [0x474df4], eax
call fcn.0045cc10
mov dword [0x474df0], eax
call fcn.0046ce20
mov dword [0x474de8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460e57
ret

Function at 0x462a38
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call fcn.0046ce38
mov ebx, eax
cmp eax, 0xffffffff
jne 0x462a54
call fcn.00463dbc
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x462a70
test bl, 1
je 0x462a70
call fcn.00467740
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x462c54
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00463958
test byte [ebp + 0xd], 0xc0
jne 0x462c78
mov eax, dword [0x471efc]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x462c85
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x462cb2
je 0x462cc4
sub ecx, 0x100
je 0x462cd2
sub ecx, 0x100
je 0x462cd9
sub ecx, 0x100
je 0x462ccb
jmp 0x462ce0
sub ecx, 0x600
je 0x462cd9
sub ecx, 0x100
je 0x462cc4
jmp 0x462ce0
mov edi, 1
jmp 0x462ce5
mov edi, 2
jmp 0x462ce5
mov edi, 4
jmp 0x462ce5
mov edi, 5
jmp 0x462ce5
mov edi, 3
test byte [ebp + 0xd], 1
je 0x462d0c
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x471974]
test al, 0x80
je 0x462d05
mov ebx, 0x80
jmp 0x462d1e
mov ebx, 1
jmp 0x462d1e
mov eax, dword [ebp + 8]
push eax
call fcn.0046ce38
mov ebx, eax
cmp eax, 0xffffffff
jne 0x462d1e
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x462d30
je 0x462d39
dec eax
je 0x462d42
jmp 0x462d4b
mov dword [ebp - 4], 0x80000000
jmp 0x462d5a
mov dword [ebp - 4], 0x40000000
jmp 0x462d5a
mov dword [ebp - 4], 0xc0000000
jmp 0x462d5a
push 1
call fcn.00463d50
pop ecx
mov ebx, eax
jmp 0x462e4a
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x462d76
sub eax, 0x10
je 0x462d7d
sub eax, 0x10
je 0x462d86
sub eax, 0x10
je 0x462d8f
jmp 0x462d8f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x462d96
mov dword [ebp - 8], 1
jmp 0x462d96
mov dword [ebp - 8], 2
jmp 0x462d96
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0046cda2
mov esi, eax
cmp eax, 0xffffffff
jne 0x462e03
call fcn.0046ce4a
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x462df8
test byte [ebp + 0xd], 1
je 0x462df3
mov ebx, 0x50
jmp 0x462df8
mov ebx, 2
push ebx
call fcn.00463d50
pop ecx
mov ebx, eax
jmp 0x462e4a
mov edi, esi
push edi
call fcn.00462bb8
pop ecx
test eax, eax
je 0x462e17
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x462e23
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00463a78
add esp, 8
mov ebx, eax
inc eax
jne 0x462e4a
push 4
call fcn.00463d50
pop ecx
push esi
call fcn.0046cd90
call fcn.0046398c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4676d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call fcn.0046cda2
mov ebx, eax
test eax, eax
je 0x46773a
call fcn.00467688
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00461948
pop ecx
push eax
push esi
push ebx
call fcn.0046cfd0
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00461948
pop ecx
push eax
push edi
push ebx
call fcn.0046cfd0
push ebx
call fcn.0046cd90
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4677b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x472d9c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x467892
cmp dword [0x472d98], 0
jne 0x467892
cmp dword [0x472f7c], 0
je 0x46784c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call fcn.0046ce62
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00467588
add esp, 8
mov ebx, eax
test eax, eax
jne 0x467832
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00467588
add esp, 8
mov ebx, eax
test eax, eax
jne 0x467832
lea ebx, [ebp - 0x84]
jmp 0x467833
inc ebx
call fcn.00467774
or eax, 0x10010
push eax
push ebx
push esi
push 0
call fcn.0046d4b4
jmp 0x4678cd
push 0xfffffffffffffff4
call fcn.0046ce86
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x472da0
push ebx
call fcn.0046cfd0
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00461948
pop ecx
push eax
push esi
push ebx
call fcn.0046cfd0
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x472da3
push ebx
call fcn.0046cfd0
jmp 0x4678cd
cmp dword [0x472d98], 0
je 0x4678ac
cmp dword [0x472d98], 0xffffffff
je 0x4678cd
push esi
call dword [0x472d98]
pop ecx
mov eax, dword [0x472d9c]
test eax, eax
je 0x4678cd
cmp dword [0x472d9c], 0xffffffff
je 0x4678cd
cmp byte [eax], 0
je 0x4678cd
push esi
push eax
call fcn.004676d8
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468064
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x475af8], 0
jne 0x4680e5
cmp dword [0x475b18], 0
jne 0x468094
call fcn.0046ce32
mov dword [0x475b18], eax
test eax, eax
jne 0x468094
push str.GetEnvironmentStrings_failed
call fcn.004678e4
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x475b18]
jmp 0x4680a8
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00461948
pop ecx
mov edi, eax
test eax, eax
jne 0x4680a0
lea edi, [ebp + 1]
push edi
call fcn.00461388
pop ecx
mov ebx, eax
mov dword [0x475afc], ebx
test ebx, ebx
jne 0x4680d2
xor eax, eax
jmp 0x4681a8
push edi
mov edx, dword [0x475b18]
push edx
push ebx
call fcn.004617f8
add esp, 0xc
jmp 0x468105
xor esi, esi
mov ebx, dword [0x475af8]
jmp 0x4680ff
push eax
call fcn.00461948
pop ecx
test eax, eax
jne 0x4680fb
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4680ef
lea ebx, [esi + 4]
push 4
mov dword [0x475b00], ebx
inc ebx
push ebx
call fcn.00460e60
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x468128
xor eax, eax
jmp 0x4681a8
cmp dword [0x475af8], 0
jne 0x468159
xor esi, esi
mov ebx, dword [0x475afc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x46814a
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00461948
pop ecx
mov edi, eax
test eax, eax
jne 0x468140
jmp 0x46818a
xor esi, esi
mov ebx, dword [0x475af8]
mov eax, dword [esp]
mov edi, eax
jmp 0x468184
push eax
call fcn.00461948
pop ecx
test eax, eax
je 0x468179
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x46817d
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x468168
mov eax, dword [0x475af8]
test eax, eax
je 0x46819a
push eax
call fcn.00461398
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x475af8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4686f8
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
and eax, 1
mov dword [0x472f7c], eax
call fcn.00465a54
mov edx, dword [esi + 0x20]
push edx
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.00465e04
add esp, 8
mov eax, dword [esi + 0x28]
push eax
call fcn.0046347c
pop ecx
mov edx, dword [esi + 0x44]
push edx
call fcn.0046348c
pop ecx
mov dword [0x475b40], 1
mov dword [0x475b44], esi
lea ecx, [ebp - 8]
mov dword [0x475b28], ecx
call fcn.004629b8
call fcn.0046ce32
mov dword [0x475b18], eax
call fcn.0046ce0e
mov dword [0x475b14], eax
mov eax, dword [esi + 0x30]
push eax
mov edx, dword [esi + 0x2c]
push edx
call fcn.004679e0
add esp, 8
mov ecx, dword [esi + 0x40]
push ecx
mov eax, dword [esi + 0x3c]
push eax
mov edx, dword [esi + 0x38]
push edx
mov ecx, dword [esi + 0x34]
push ecx
call fcn.00467a24
add esp, 0x10
call fcn.0046857c
mov edi, eax
test eax, eax
je 0x4687d7
mov edx, dword [edi]
mov dword [edi + edx*4 + 4], 0xffffffff
push 0
push edi
call fcn.00468584
add esp, 8
xor ecx, ecx
mov dword [ebp - 0xc], ecx
lea ebx, [edi + 4]
jmp 0x4687d0
mov eax, dword [ebx]
mov edx, dword [eax + 0x14]
push edx
push 0
call dword [eax + 0x18]
add esp, 8
inc dword [ebp - 0xc]
add ebx, 4
mov ecx, dword [edi]
cmp ecx, dword [ebp - 0xc]
jg 0x4687bc
push 0
push 0x475b40
call fcn.00468584
add esp, 8
test byte [esi + 0x10], 1
je 0x468853
mov ebx, dword [0x475b14]
jmp 0x4687f5
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x4687f4
cmp al, 9
je 0x4687f4
cmp byte [ebx], 0x22
jne 0x468809
mov dl, 0x22
inc ebx
jmp 0x46880e
mov dl, 0x20
jmp 0x46880e
inc ebx
mov al, byte [ebx]
test al, al
je 0x46881c
cmp dl, al
je 0x46881c
cmp al, 9
jne 0x46880d
cmp byte [ebx], 0x22
jne 0x468825
inc ebx
jmp 0x468825
inc ebx
mov al, byte [ebx]
test al, al
je 0x46882f
cmp al, 0x20
je 0x468824
cmp al, 9
je 0x468824
call fcn.0046887c
push eax
push ebx
push 0
push 0
call fcn.0046ce68
push eax
call dword [esi + 0x18]
add esp, 0x10
push eax
call fcn.00467990
pop ecx
jmp 0x468874
mov edx, dword [0x475b10]
push edx
mov ecx, dword [0x475b0c]
push ecx
mov eax, dword [0x475b08]
push eax
call dword [esi + 0x18]
add esp, 0xc
push eax
call fcn.00467990
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413f60
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47168b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00466069
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x413fe2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00463ee0
mov eax, dword [eax]
push 0x4921f0
push eax
call fcn.00456b14
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004662f4
test bl, bl
je 0x413fe2
push 0x4921f0
lea ecx, [esp + 0xc]
call fcn.00466684
push 0x495d6c
lea ecx, [esp + 0xc]
call fcn.00466684
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41401e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004662f4
jmp 0x4140e9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4140a2
lea edx, [esp + 0x7c]
push 0x495d68
push edx
call fcn.00456b14
add esp, 8
test eax, eax
je 0x4140a2
lea eax, [esp + 0x7c]
push 0x495d64
push eax
call fcn.00456b14
add esp, 8
test eax, eax
je 0x4140a2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x414032
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004662f4
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x415340
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4153a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4153b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4717eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x49c2a0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4154e8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x415416
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004662f4
xor eax, eax
jmp 0x41555f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00466431
push esi
lea ecx, [esp + 0xc]
call fcn.004666c0
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x495da4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41553d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00415340
test eax, eax
jne 0x41553d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00415340
test eax, eax
jne 0x41553d
lea eax, [esp + 0x14]
push 0x495d80
push eax
call fcn.00457b50
mov esi, eax
add esp, 8
test esi, esi
jne 0x41551c
lea ecx, [esp + 0x14]
push 0x495d7c
push ecx
call fcn.00457ad0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41551c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41551f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004663e1
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41542e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004662f4
xor eax, eax
jmp 0x41555f
mov byte [esi], 0
push 0x495d78
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004662f4
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4