joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c00
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x41a450
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x34]
test al, al
je 0x401d1f
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString_2
mov edi, dword [esi + 0x1c8]
mov byte [esp + 0x1c], 1
test edi, edi
jne 0x401c68
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [esi + 0x1c8], edi
jmp 0x401c74
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x1c8], eax
mov eax, dword [esi + 0x1c8]
lea ecx, [esp + 0x28]
sub eax, edi
push eax
push str._r_nOUT__4d__:
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
xor edi, edi
test ebp, ebp
mov dword [esp + 0x24], ebp
jle 0x401cea
xor edx, edx
lea eax, [esp + 0x10]
mov dl, byte [edi + ebx]
push edx
push str._02X
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::operator
mov edx, edi
and edx, 0x8000000f
jns 0x401cce
dec edx
or edx, 0xfffffff0
inc edx
cmp edx, 0xf
jne 0x401ce1
push 0x42d790
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x24]
inc edi
cmp edi, eax
jl 0x401c99
mov eax, dword [esp + 0x28]
mov byte [esi + 0x35], 1
push eax
push esi
call fcn.00401760
add esp, 8
lea ecx, [esp + 0x10]
mov byte [esi + 0x35], 0
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov al, byte [esi + 0x36]
test al, al
je 0x401d52
mov edx, dword [esi + 0x18]
lea edi, [esi + 0x1810]
lea ecx, [esp + 0x24]
push edi
push ecx
push ebp
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0x24]
push 1
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x401d93
mov eax, dword [esi + 0x1ac]
test eax, eax
jne 0x401d71
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x24]
push 0
push edx
push ebp
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x401d93
xor edi, edi
test ebp, ebp
jle 0x401d93
mov eax, dword [esi + 0x18]
lea ecx, [esp + 0x24]
push 0
push ecx
lea edx, [edi + ebx]
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
cmp edi, ebp
jl 0x401d77
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x405c90
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x11c]
shl eax, 5
mov ecx, dword [eax + 0x41b448]
and ecx, 0x7f8000
cmp ecx, 0xc8000
jb 0x405e48
mov al, byte [esi + 0x22]
test al, al
je 0x405cce
mov ecx, esi
call fcn.00403470
pop edi
pop esi
pop ebx
add esp, 8
ret
mov edx, dword [esi + 0x670]
mov al, byte [edx + 0xf]
test al, 0x80
je 0x405e48
and al, 0x60
cmp al, 0x20
jne 0x405cf3
mov ecx, esi
call fcn.00403470
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp al, 0x40
jne 0x405d05
mov ecx, esi
call fcn.00403950
pop edi
pop esi
pop ebx
add esp, 8
ret
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x32d5
mov ecx, esi
mov ebx, eax
call fcn.00401720
push eax
push esi
call fcn.00401760
mov eax, dword [esi + 0x11c]
add esp, 8
shl eax, 5
mov eax, dword [eax + 0x41b448]
and eax, 0x7f8000
cmp eax, 0xc8000
je 0x405da9
cmp eax, 0xe0000
je 0x405da9
cmp eax, 0x1a8000
jb 0x405d5f
mov ecx, esi
call fcn.00405c70
jmp 0x405db0
cmp eax, 0x168000
je 0x405da0
cmp eax, 0x170000
je 0x405da0
cmp eax, 0x178000
je 0x405da0
cmp eax, 0x180000
je 0x405da0
cmp eax, 0x188000
je 0x405da0
cmp eax, 0x190000
je 0x405da0
cmp eax, 0x198000
je 0x405da0
cmp eax, 0x1a0000
je 0x405da0
mov ecx, esi
call fcn.00404240
jmp 0x405db0
mov ecx, esi
call fcn.00404c10
jmp 0x405db0
mov ecx, esi
call fcn.00403a60
test eax, eax
jne 0x405e4a
call edi
sub eax, ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
sub esp, 8
fild qword [esp + 0x14]
fmul dword [0x4244e0]
fstp qword [esp]
push 0x42d7c8
push esi
call fcn.00401760
fild dword [esi + 0x118]
fild dword [esi + 0xf8]
add esp, 8
mov ecx, esi
fld st(1)
fsub st(1)
sub esp, 8
fdiv st(1)
fmul dword [0x4244d0]
fstp qword [esp + 8]
fstp st(0)
fmul qword [0x4244d8]
fstp qword [esp]
push 0x32d7
call fcn.00401720
push eax
push esi
call fcn.00401760
fild dword [esi + 0xf8]
fild dword [esi + 0x118]
add esp, 0x18
mov byte [esi + 0x37], 1
fsub st(1)
fdiv st(1)
fmul dword [0x4244d0]
fstp dword [esi + 0x1dc]
fstp st(0)
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x410040
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov esi, dword [ebp + 0x194]
push esi
call sub.MFC42.DLL_operatornew
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
mov dword [esp + 0x14], 0
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x18]
lea eax, [esp + 0x18]
push eax
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4100f8
cmp dword [esp + 0x14], esi
jne 0x4100f8
cmp byte [ebx + 1], 0x46
jne 0x4100f8
cmp byte [ebx + 2], 0xb9
jne 0x4100f8
cmp byte [ebx + 3], 0x68
jne 0x4100f8
mov al, byte [ebx + 4]
test al, al
jne 0x4100f8
xor edx, edx
push 3
mov dl, byte [ebx + 5]
mov ecx, ebp
mov esi, edx
sub esi, 6
lea eax, [esi + 3]
push eax
push ebx
call fcn.004018f0
mov dl, byte [esi + ebx + 6]
xor ecx, ecx
mov cl, ah
cmp dl, cl
jne 0x4100f8
cmp byte [esi + ebx + 7], al
jne 0x4100f8
cmp byte [esi + ebx + 8], 0x16
jne 0x4100f8
mov edi, dword [esp + 0x1c]
mov ecx, esi
mov edx, ecx
mov dword [esp + 0x10], esi
lea esi, [ebx + 6]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0x14]
add esp, 4
mov dword [ebp + 0x1cc], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x410120
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [ecx + 0x198]
push edi
push esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
call sub.MFC42.DLL_operatornew
mov edi, eax
push 0x100
mov dword [esp + 0x18], edi
call sub.MFC42.DLL_operatornew
mov ecx, esi
mov ebp, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov ebx, dword [esp + 0x2c]
and ecx, 3
mov esi, dword [esp + 0x30]
rep stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
mov edi, ebp
add esp, 8
rep stosd dword es:[edi], eax
mov byte [ebp + 3], al
mov ecx, ebx
mov al, bl
mov edx, ecx
add al, 6
lea edi, [ebp + 5]
shr ecx, 2
mov byte [ebp], 0x46
mov byte [ebp + 1], 0xb9
mov byte [ebp + 2], 0x6a
mov byte [ebp + 4], al
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebx + 3]
and ecx, 3
push 2
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
push eax
push ebp
call fcn.004018f0
mov edx, dword [esp + 0x24]
xor ecx, ecx
mov cl, ah
mov byte [ebx + ebp + 5], cl
mov byte [ebx + ebp + 6], al
mov byte [ebx + ebp + 7], 0x16
lea eax, [edx + 8]
xor ebx, ebx
mov dword [esp + 0x24], eax
test eax, eax
jle 0x41021f
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
lea esi, [ebx + ebp]
push 0
lea ecx, [eax - 1]
lea edi, [edx + 1]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
push eax
mov eax, dword [esp + 0x20]
push edx
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x18]
mov esi, eax
lea eax, [edx - 1]
add ebx, eax
mov eax, dword [esp + 0x24]
cmp ebx, eax
jl 0x4101d0
jmp 0x410223
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push eax
call sub.MFC42.DLL_operatordelete
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x410250
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x5c
xor eax, eax
push ebx
mov dword [esp + 8], eax
push ebp
mov dword [esp + 0x10], eax
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x20], eax
mov ebp, ecx
push eax
push eax
push eax
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esp + 0x24], eax
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
stosb byte es:[edi], al
push ecx
mov ecx, dword [ebp + 0x18]
push edx
lea eax, [esp + 0x30]
push 0x41
push eax
push ecx
mov dword [ebp + 0x1cc], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41032f
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x3e5
je 0x4102cf
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x5c
ret 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebp
call fcn.004021e0
test al, al
jne 0x410318
mov al, byte [ebp + 0x23]
test al, al
je 0x410318
mov ecx, dword [ebp + 0x18]
lea edx, [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push edx
push eax
push ecx
call esi
test eax, eax
jne 0x41032f
call ebx
cmp eax, 0x3e4
jne 0x41032f
push 5
call edi
jmp 0x4102e1
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x5c
ret 4
mov eax, dword [esp + 0x2a]
mov ebx, dword [esp + 0x2b]
mov edi, dword [esp + 0x70]
and eax, 0xff
and ebx, 0xff
mov dword [ebp + 0x1c4], eax
test edi, edi
je 0x410364
mov ecx, ebx
lea esi, [esp + 0x2c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [ebp + 0x1cc], ebx
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x5c
ret 4
Function at 0x410390
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x5c
xor eax, eax
push ebx
mov dword [esp + 8], eax
push ebp
mov dword [esp + 0x10], eax
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x20], eax
mov ebp, ecx
push eax
push eax
push eax
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esp + 0x24], eax
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x70]
xor edx, edx
stosb byte es:[edi], al
mov byte [esp + 0x2a], cl
mov ecx, dword [esp + 0x74]
mov eax, ecx
mov byte [esp + 0x2e], cl
shr eax, 0x10
mov dl, ah
mov byte [esp + 0x2c], al
xor eax, eax
mov byte [esp + 0x29], 0x5a
mov al, ch
mov ecx, dword [esp + 0x78]
test cl, cl
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2d], al
mov byte [esp + 0x2f], cl
jbe 0x410425
mov esi, dword [esp + 0x7c]
test esi, esi
je 0x410425
and ecx, 0xff
lea edi, [esp + 0x30]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea eax, [esp + 0x2c]
push 0x40
push eax
mov ecx, ebp
call fcn.004018f0
neg al
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
mov byte [esp + 0x68], al
push ecx
mov ecx, dword [ebp + 0x18]
push edx
lea eax, [esp + 0x30]
push 0x41
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
jne 0x410492
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x3e5
jne 0x410492
mov edi, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, dword [ebp + 0x18]
lea edx, [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push edx
push eax
push ecx
call edi
mov esi, eax
test esi, esi
jne 0x410492
call ebx
cmp eax, 0x3e4
je 0x410471
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 0x10
Function at 0x419a60
Capabilities:
Get mac address on windows

Disassembly:
push ecx
push esi
push edi
mov ecx, 0x40
xor eax, eax
mov edi, 0x431d54
mov dword [esp + 8], eax
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0
call sub.iphlpapi.dll_GetAdaptersInfo
mov ecx, dword [esp + 8]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
lea edx, [esp + 8]
mov esi, eax
push edx
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x419aee
test esi, esi
je 0x419aee
mov al, byte [esi + 0x199]
xor ecx, ecx
mov cl, byte [esi + 0x198]
xor edx, edx
mov dl, byte [esi + 0x197]
push eax
push ecx
xor eax, eax
mov al, byte [esi + 0x196]
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + 0x195]
mov dl, byte [esi + 0x194]
push eax
push ecx
lea eax, [esi + 8]
push edx
push eax
push str.NET__s__02X_02X_02X_02X_02X_02X
push 0x431d54
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x24
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 0x431d54
pop edi
pop esi
pop ecx
ret

Function at 0x419c10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
mov cl, 0x4c
test eax, eax
mov byte [esp + 4], cl
mov byte [esp + 3], 0
jbe 0x419cad
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
sub edi, esi
mov dword [esp + 0x24], eax
mov al, byte [edi + esi]
mov ebp, dword [esp + 0x14]
mov byte [esp + 0x20], al
mov dl, cl
mov ebx, dword [esp + 0x20]
inc dl
and ebx, 0xff
and edx, 0xff
and ebp, 0xff
xor al, cl
mov bl, byte [ebx + 0x425af0]
sub bl, byte [edx + 0x425bf0]
xor edx, edx
mov dl, byte [ebp + 0x425bf0]
and ebx, 0xff
xor ebx, edx
mov dl, byte [esp + 0x13]
add al, dl
mov bl, byte [ebx + 0x425af0]
mov cl, al
mov eax, dword [esp + 0x24]
mov byte [esi], bl
mov bl, byte [esp + 0x28]
mov byte [esp + 0x14], cl
add dl, bl
inc esi
dec eax
mov byte [esp + 0x13], dl
mov dword [esp + 0x24], eax
jne 0x419c3c
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x419cc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x18]
mov cl, 0x4c
mov byte [esp + 7], 0
test edi, edi
mov byte [esp + 8], cl
jbe 0x419d3c
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x18]
sub esi, eax
mov ebx, dword [esp + 0x10]
xor edx, edx
mov dl, byte [esi + eax]
and ebx, 0xff
mov dl, byte [edx + 0x425bf0]
xor dl, byte [ebx + 0x425bf0]
mov bl, cl
inc bl
and ebx, 0xff
add dl, byte [ebx + 0x425bf0]
and edx, 0xff
mov dl, byte [edx + 0x425bf0]
mov bl, dl
mov byte [eax], dl
mov dl, byte [esp + 0x24]
xor bl, cl
mov cl, bl
mov bl, byte [esp + 0xf]
add cl, bl
add bl, dl
inc eax
dec edi
mov byte [esp + 0x10], cl
mov byte [esp + 0xf], bl
jne 0x419ce3
pop esi
pop ebx
pop edi
add esp, 8
ret
Function at 0x409510
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x43a348
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x64]
test eax, eax
jne 0x4095ba
mov eax, dword [0x44cb68]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.00430d2e
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.00430d7d
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.00430cda
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4095a1
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x4095a1
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x64], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.00430942
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4095d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x409632
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc

Function at 0x409840
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push str.open
mov edi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x409932
lea ecx, [esp + 0x10]
push ecx
push str..htm
push SysReAllocStringLen
mov ecx, edi
call fcn.004095d0
test eax, eax
jne 0x409932
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push SysReAllocStringLen
mov ecx, edi
call fcn.004095d0
test eax, eax
jne 0x409932
lea edx, [esp + 0x10]
push 0x44bda4
push edx
call fcn.0041c360
mov esi, eax
add esp, 8
test esi, esi
jne 0x409903
lea eax, [esp + 0x10]
push 0x44bda0
push eax
call fcn.0041c2e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x409903
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x409906
mov byte [esi], 0
push 0x44bd9c
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x40a940
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x404
lea eax, [esp]
lea ecx, [esp + 4]
push esi
push eax
push 0x400
push ecx
call sub.PSAPI.DLL_EnumProcesses
mov edx, dword [esp + 4]
mov eax, 0
shr edx, 2
je 0x40a980
mov esi, dword [esp + 0x40c]
lea ecx, [esp + 8]
cmp dword [ecx], esi
je 0x40a98a
inc eax
add ecx, 4
cmp eax, edx
jb 0x40a974
xor al, al
pop esi
add esp, 0x404
ret
mov al, 1
pop esi
add esp, 0x404
ret

Function at 0x40ada0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov eax, dword [0x44cb68]
push ebx
push ebp
push esi
push edi
push ecx
push 0
push 0x1f0fff
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x40
push 0x1000
mov esi, eax
push 0x1000
push 0
push esi
call ebx
mov ebp, dword [esp + 0x24]
push 0x40
push 0x1000
push ebp
push 0
push esi
mov edi, eax
call ebx
mov edx, dword [esp + 0x1c]
push 0
push 0x1000
push edx
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [esp + 0x20]
push 0
push ebp
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push ebx
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0x1000
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call edi
push 0x8000
push ebp
push ebx
push esi
call edi
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
push esi
call edi
lea ecx, [esp + 0x10]
call fcn.00430942
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40b390
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x1c
push esi
push edi
xor eax, eax
mov ecx, 6
lea edi, [esp + 0xc]
mov dword [esp + 8], 0
push eax
push 4
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40b402
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
push esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x40b3fb
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x40b3f1
lea ecx, [esp + 8]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x40b3fb
cmp dword [esp + 0x14], edi
jne 0x40b3dc
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0x1c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x40b410
Capabilities:
Create thread
Inject thread

Disassembly:
sub esp, 0x408
lea eax, [esp + 8]
push ebx
push esi
push edi
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x14]
push 0x5c
push ecx
call fcn.0041c3e0
mov edx, dword [esp + 0x424]
add esp, 8
mov byte [eax + 1], 0
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [esp + 0x418]
mov esi, eax
inc esi
push 4
push 0x1000
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
je 0x40b4af
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push esi
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x40b4af
cmp dword [esp + 0xc], esi
je 0x40b4c2
push 0x4000
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x408
ret
mov edx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp + 0x10]
push ecx
push 0
push ebx
push edx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x408
ret
Function at 0x40c0b0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43a6cb
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_GetTopWindow]
mov esi, eax
cmp esi, edi
je 0x40c17a
mov ebp, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edi
push eax
push esi
call ebp
cmp eax, edi
je 0x40c167
mov ecx, dword [esp + 0x128]
mov eax, dword [esp + 0x14]
cmp eax, ecx
jne 0x40c167
mov edx, dword [0x44cb68]
mov dword [esp + 0x10], edx
lea eax, [esp + 0x18]
push 0x104
push eax
push esi
mov dword [esp + 0x12c], edi
call ebx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push 0x44b160
push edx
call fcn.0042af88
add esp, 0xc
lea ecx, [esp + 0x10]
push 0x44c108
call fcn.0042ac02
or ecx, 0xffffffff
cmp eax, ecx
mov dword [esp + 0x120], ecx
lea ecx, [esp + 0x10]
jne 0x40c195
call fcn.00430942
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
cmp esi, edi
jne 0x40c0ee
xor eax, eax
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret
call fcn.00430942
mov eax, esi
jmp 0x40c17c