joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b3f0
Capabilities:
Parse credit card information

Disassembly:
push 0xffffffffffffffff
push 0x422f70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
xor ebx, ebx
push esi
push ebx
lea ecx, [esp + 0x10]
call fcn.00407fd0
mov ebp, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
mov ecx, ebp
mov dword [esp + 0x1c], ebx
call fcn.0041d5f0
test al, al
je 0x41b5dc
lea ecx, [esp + 0xc]
call fcn.00408d70
cmp eax, 5
jl 0x41b5dc
push 1
lea ecx, [esp + 0x10]
call fcn.004093c0
cmp byte [eax], 0x3a
jne 0x41b5dc
push 2
lea ecx, [esp + 0x10]
call fcn.004093c0
cmp byte [eax], 0x22
jne 0x41b5dc
push edi
mov edi, dword [esp + 0x28]
mov ecx, edi
call fcn.00408dd0
lea ecx, [esp + 0x10]
mov esi, 3
call fcn.00408d70
cmp eax, esi
jle 0x41b4a6
push esi
lea ecx, [esp + 0x14]
call fcn.004093c0
cmp byte [eax], 0x22
je 0x41b4a6
lea ecx, [esp + 0x10]
inc esi
call fcn.00408d70
cmp esi, eax
jl 0x41b489
lea ecx, [esi - 3]
lea edx, [esp + 0x24]
push ecx
push 3
push edx
lea ecx, [esp + 0x1c]
call fcn.00408860
push eax
mov ecx, edi
mov byte [esp + 0x20], 1
call fcn.00408480
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.00408300
lea ecx, [esp + 0x10]
inc esi
call fcn.00408d70
cmp esi, eax
pop edi
jge 0x41b5dc
mov eax, esi
lea ecx, [esp + 0xc]
push eax
inc esi
call fcn.004093c0
cmp byte [eax], 0x3d
jne 0x41b5dc
push ebx
lea ecx, [esp + 0x10]
call fcn.004093c0
cmp byte [eax], 0x44
jne 0x41b524
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
push esi
push ecx
call fcn.0041b800
add esp, 0xc
jmp 0x41b5b5
push ebx
lea ecx, [esp + 0x10]
call fcn.004093c0
cmp byte [eax], 0x53
jne 0x41b548
mov edx, dword [esp + 0x28]
lea eax, [esp + 0xc]
push edx
push esi
push eax
call fcn.0041b9e0
add esp, 0xc
jmp 0x41b5b5
push ebx
lea ecx, [esp + 0x10]
call fcn.004093c0
cmp byte [eax], 0x42
jne 0x41b592
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0xc]
push ecx
push esi
push edx
push ebp
call fcn.0041be10
add esp, 0x10
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x18], 0xffffffff
call fcn.00408300
pop esi
mov al, bl
pop ebp
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push ebx
lea ecx, [esp + 0x10]
call fcn.004093c0
cmp byte [eax], 0x5a
jne 0x41b5dc
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
push esi
push ecx
push ebp
call fcn.0041c2a0
add esp, 0x10
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x18], 0xffffffff
call fcn.00408300
pop esi
mov al, bl
pop ebp
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.00408300
mov ecx, dword [esp + 0x10]
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x41c960
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
ret 0xc
Function at 0x41c990
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
xor eax, eax
mov edx, dword [esp + 0x24]
mov dword [esp], eax
push ebx
mov dword [esp + 8], eax
push ebp
mov dword [esp + 0x10], eax
push esi
mov dword [esp + 0x18], eax
mov esi, ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
mov eax, dword [0x42d4dc]
push edi
test eax, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jne 0x41c9d3
push 0x42d4d8
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x42d4e8], 2
je 0x41ca9f
mov ecx, dword [esi + 4]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x30]
push 1
push eax
push 0
push ecx
mov dword [esp + 0x40], 0
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x41ca1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41ca1a
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x14
ret 0x14
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x1c]
push 0
push edx
push eax
push ecx
call ebp
cmp edi, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x41ca4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41ca4b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x14
ret 0x14
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0041c960
lea edx, [esp + 0x30]
mov bl, al
mov eax, dword [esi + 4]
push 0
push edx
push edi
push eax
call ebp
test bl, bl
je 0x41ca93
cmp eax, 0xffffffff
jne 0x41ca84
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41ca93
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 0x14
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 4]
push edi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne bl
test bl, bl
jne 0x41cad9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x41cad9
mov bl, 1
mov dword [edi], 0
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x14
ret 0x14

Function at 0x41cb80
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
neg eax
ret 0xc
Function at 0x41cbb0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
xor eax, eax
mov edx, dword [esp + 0x24]
mov dword [esp], eax
push ebp
mov dword [esp + 8], eax
push esi
mov dword [esp + 0x10], eax
mov esi, ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov eax, dword [0x42d4dc]
test eax, eax
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
jne 0x41cbf2
push 0x42d4d8
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x42d4e8], 2
je 0x41ccbc
mov ecx, dword [esi + 4]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x2c]
push 1
push eax
push 0
push ecx
mov dword [esp + 0x3c], 0
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x41cc38
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41cc38
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x14
ret 0x14
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ecx
call ebp
cmp edi, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x41cc68
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41cc68
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x14
ret 0x14
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push ebx
push edx
push eax
push ecx
mov ecx, esi
call fcn.0041cb80
lea edx, [esp + 0x30]
mov bl, al
mov eax, dword [esi + 4]
push 0
push edx
push edi
push eax
call ebp
test bl, bl
pop ebx
je 0x41ccb1
cmp eax, 0xffffffff
jne 0x41cca3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41ccb1
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x14
ret 0x14
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret 0x14
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esi + 4]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
pop edi
pop esi
pop ebp
neg eax
add esp, 0x14
ret 0x14

Function at 0x41f160
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x18]
test esi, esi
mov dword [esp + 4], 0xc
je 0x41f181
mov ecx, esi
call fcn.0040f8f0
mov dword [esp + 8], eax
jmp 0x41f189
mov dword [esp + 8], 0
mov ecx, dword [esp + 0x14]
lea eax, [esp + 4]
neg esi
sbb esi, esi
mov dword [esp + 0xc], 0
and esi, eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
pop esi
add esp, 0xc
ret
Function at 0x40270e
Capabilities:
Access the windows event log
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
xor ebx, ebx
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp ebx, 0x58ce99d
jg 0x40273e
inc ebx
cmp ebx, 0x1f6502b0
jl 0x402724
cmp dword [0x43f264], 0x400
jne 0x4027c0
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push str.nojojatobajehivonafepuxefemi
push esi
call fcn.00402a88
push esi
push esi
call fcn.00402e34
fldz
add esp, 8
fstp qword [esp]
call fcn.00402cd0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00402860
fstp st(0)
push esi
call fcn.00402ee1
push esi
call fcn.00402ef0
add esp, 0x10
xor ebx, ebx
cmp ebx, 0xd0fe
jge 0x4027d1
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp ebx, 0x58bc6e
jg 0x4027eb
inc ebx
cmp ebx, 0xe52f
jl 0x4027c2
mov eax, dword [0x438304]
mov dword [0x43f264], eax
call fcn.0040249e
mov edi, 0x3078f
cmp dword [0x43f264], 0x51f
jne 0x402819
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x4027ff
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x4071ae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437d58]
jne 0x4071b8
repz ret
jmp fcn.00409aee
Function at 0x409718
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x437d58]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405b0c
and dword [ebp - 0x14], 0
cmp dword [0x439e24], 0
mov dword [ebp - 0x18], eax
jne 0x4097cb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409873
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409873
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x439e24], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x439e28], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x439e2c], eax
call edi
push eax
call esi
mov dword [0x439e34], eax
test eax, eax
je 0x4097cb
push 0x435d18
push ebx
call edi
push eax
call esi
mov dword [0x439e30], eax
mov eax, dword [0x439e30]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409824
cmp dword [0x439e34], ecx
je 0x409824
push eax
call esi
push dword [0x439e34]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409824
test ebx, ebx
je 0x409824
call edi
test eax, eax
je 0x40981b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40981b
test byte [ebp - 8], 1
jne 0x409824
or dword [ebp + 0x10], 0x200000
jmp 0x409857
mov eax, dword [0x439e28]
cmp eax, dword [ebp - 0x18]
je 0x409857
push eax
call esi
test eax, eax
je 0x409857
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x409857
mov eax, dword [0x439e2c]
cmp eax, dword [ebp - 0x18]
je 0x409857
push eax
call esi
test eax, eax
je 0x409857
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x439e24]
call esi
test eax, eax
je 0x409873
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x409875
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004071ae
leave
ret
Function at 0x401db6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x416b7c]
jne 0x401dc0
repz ret
jmp fcn.00402658

Function at 0x4077f3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004035a2
and dword [ebp - 4], 0
cmp dword [0x4184b4], 0
mov ebx, eax
jne 0x4078a4
push 0x414a80
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407955
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x414a74
push edi
call esi
test eax, eax
je 0x407955
push eax
call fcn.00403530
mov dword [esp], 0x414a64
push edi
mov dword [0x4184b4], eax
call esi
push eax
call fcn.00403530
mov dword [esp], 0x414a50
push edi
mov dword [0x4184b8], eax
call esi
push eax
call fcn.00403530
mov dword [esp], 0x414a34
push edi
mov dword [0x4184bc], eax
call esi
push eax
call fcn.00403530
pop ecx
mov dword [0x4184c4], eax
test eax, eax
je 0x4078a4
push 0x414a1c
push edi
call esi
push eax
call fcn.00403530
pop ecx
mov dword [0x4184c0], eax
mov eax, dword [0x4184c0]
cmp eax, ebx
je 0x4078fc
cmp dword [0x4184c4], ebx
je 0x4078fc
push eax
call fcn.004035ab
push dword [0x4184c4]
mov esi, eax
call fcn.004035ab
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4078fc
test edi, edi
je 0x4078fc
call esi
test eax, eax
je 0x4078f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4078f3
test byte [ebp - 0xc], 1
jne 0x4078fc
or dword [ebp + 0x10], 0x200000
jmp 0x407935
mov eax, dword [0x4184b8]
cmp eax, ebx
je 0x407935
push eax
call fcn.004035ab
pop ecx
test eax, eax
je 0x407935
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407935
mov eax, dword [0x4184bc]
cmp eax, ebx
je 0x407935
push eax
call fcn.004035ab
pop ecx
test eax, eax
je 0x407935
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4184b4]
call fcn.004035ab
pop ecx
test eax, eax
je 0x407955
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407957
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f383
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000f3c2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f3c2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000f3c2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000f3c2
cmp dword [ecx + 0x74], 0xe
jbe 0x1000f3c2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10012040
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100120dd
push ebx
push esi
call fcn.10012009
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10011f9d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001208a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100120dc
push edi
push eax
call fcn.10012ffb
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100120aa
call fcn.10010ae4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100120db
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10011f9d
add esp, 0x20
test eax, eax
jne 0x100120c9
push edi
call fcn.10010ae4
jmp 0x100120d1
push ebx
call fcn.10010ae4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001234a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019888
push 0x10019880
push str.FlsAlloc
push 0x1f
call fcn.10012266
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001237e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
jmp 0x10012384
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100123c8
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019898
push 0x10019890
push str.FlsGetValue
push 0x21
call fcn.10012266
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100123ff
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10012407
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100198a0
push 0x10019898
push str.FlsSetValue
push 0x22
call fcn.10012266
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012441
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10017ac0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10017aed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10017aed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x407590
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47e36b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004731e5
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x407612
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004710f7
mov eax, dword [eax]
push 0x49cc38
push eax
call fcn.00463e04
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00473470
test bl, bl
je 0x407612
push 0x49cc38
lea ecx, [esp + 0xc]
call fcn.00473800
push 0x49cc44
lea ecx, [esp + 0xc]
call fcn.00473800
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40764e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00473470
jmp 0x407719
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4076d2
lea edx, [esp + 0x7c]
push 0x49cc40
push edx
call fcn.00463e04
add esp, 8
test eax, eax
je 0x4076d2
lea eax, [esp + 0x7c]
push 0x49cc3c
push eax
call fcn.00463e04
add esp, 8
test eax, eax
je 0x4076d2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x407662
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00473470
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x407f10
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x407f72
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x407f80
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47e3eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4a6914]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4080b8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x407fe6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00473470
xor eax, eax
jmp 0x40812f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004735ad
push esi
lea ecx, [esp + 0xc]
call fcn.0047383c
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40810d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00407f10
test eax, eax
jne 0x40810d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00407f10
test eax, eax
jne 0x40810d
lea eax, [esp + 0x14]
push 0x49cc54
push eax
call fcn.00464e80
mov esi, eax
add esp, 8
test esi, esi
jne 0x4080ec
lea ecx, [esp + 0x14]
push 0x49cc50
push ecx
call fcn.00464e00
mov esi, eax
add esp, 8
test esi, esi
jne 0x4080ec
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4080ef
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047355d
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x407ffe
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00473470
xor eax, eax
jmp 0x40812f
mov byte [esi], 0
push 0x49cc4c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00473470
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4