joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100374eb
Capabilities:
Create pipe
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov byte [ebp - 4], dl
mov dword [ebp - 8], 0x1415
cmp dword [ebp - 8], 0x14dc
push 0
pop ebx
jle 0x1003754b
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x20]
or eax, esi
cdq
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037527
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.10001f32
inc edi
cmp edi, 0x738c
jl 0x1003750e
inc esi
cmp esi, 0x1284
jl 0x1003750c
cmp byte [ebp - 4], 0
push ebx
je 0x1003755a
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x1003757f
push 0x2057
push 0x1a12
push 0xfb6
push 0x2165
push 0x2663
push 0x1a3a
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp dword [ebp - 8], 0x116d
jge 0x10037593
push str.qyo_lhszpwxd_emclscxh_cvedm_ivwbvye_vqkzqhp
call fcn.100430bc
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10037ee3
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1005b05a
call fcn.10059860
sub esp, 0xc
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], cl
je 0x10037f2f
cmp byte [ebp + 8], 0
je 0x10037f20
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
mov eax, dword [ebp + 0x14]
mov byte [eax], cl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edx], 0
je 0x10037f0f
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x10037f0f
test cl, cl
je 0x10037f42
push 0xcba
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x10037f0f
mov ebx, dword [ebp + 0x20]
mov dword [ebx], 0
jmp 0x10037fb8
mov dword [ebp + 0x18], 0xfffffff6
mov dword [ebp - 0x18], 0xdad816f9
mov esi, dword [ebp + 0x18]
mov eax, dword [ebp - 0x18]
neg esi
mov eax, dword [ebp + 0x10]
sbb esi, esi
xor edx, edx
neg esi
mov eax, dword [eax]
imul ecx, eax, 0x7863
mov eax, dword [ebp + 0x18]
cmp ecx, eax
setg dl
imul eax, edx, 0xd3b0
inc eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xa05d
setne cl
xor eax, eax
cmp esi, ecx
sete al
cmp eax, 0x270e7ad5
je 0x10037fa9
cmp dword [ebx], 0
jne 0x10037fa9
xor ecx, ecx
jmp 0x10037fac
xor ecx, ecx
inc ecx
mov eax, dword [ebp + 0x18]
add eax, ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
dec dword [ebx]
cmp dword [ebx], 0xfffffff6
jle 0x10037f4d
mov dword [ebp + 0x18], 0x3f0
cmp dword [ebp + 0x18], 0x6f9
jle 0x10037ff4
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10075ef8
or eax, esi
cdq
push edx
push eax
call fcn.10001a90
inc ebx
cmp ebx, 0x7337
jl 0x10037fd1
inc esi
cmp esi, 0x5a7e
jl 0x10037fcf
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0x3ab
jge 0x10037f0f
mov edx, str.npuulnwc_hyrwlfqlo_ubque_sgwhag_bjgvn_vyl_nbe
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x10037f0f
Function at 0x10038218
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
mov eax, 0x1005b064
call fcn.10059860
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x2c], 0x6be0
xor ebx, ebx
cmp dword [ebp - 0x2c], 0x6d57
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], edx
jle 0x10038286
push ebx
push ebx
call dword [sym.imp.USER32.dll_CopyRect]
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov eax, edi
mov ecx, 0x10075ef8
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10001a90
inc ebx
cmp ebx, 0x570c
jl 0x1003824d
inc edi
push 0
pop ebx
cmp edi, 0x737e
jl 0x1003824a
push ebx
push 0xf99
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp byte [ebp + 8], 0
je 0x100382a5
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10038378
mov cl, 1
call fcn.100360dc
jmp 0x10038378
mov dword [ebp - 0x28], 0x545f
cmp dword [ebp - 0x28], 0x57d9
jle 0x1003831f
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov ecx, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
shl edi, cl
mov ecx, ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov eax, ebx
sar eax, cl
mov ecx, 0x10075ef8
xor eax, edi
cdq
push edx
push eax
call fcn.10001a90
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x69de
jl 0x100382d1
inc ebx
push 0
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x1370
pop ebx
jl 0x100382c9
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x681d
jl 0x100382bf
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x56f1
jl 0x100382ba
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x28], 0x5221
jge 0x10038358
mov edx, str.wbmucre_hkhfs_onwblk_muw_cqgzpsm_vgeyenak_ivq_qaridi_rkzhuywt
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x10038358
mov edx, dword [ebp - 0x30]
mov edx, dword [edx]
mov ecx, dword [edx + 8]
lea eax, [ecx - 1]
mov dword [edx + 8], eax
cmp ecx, 0xcb8ce3e
je 0x10038371
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [eax], ebx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x2c], 0x6b31
jge 0x10038397
mov edx, str.mevfybax_fxegncyl_hedojhjwk_ugl_she_dyx_nqeo_gqohgeen_vjq_asnkuqd_dpr_hmdp_lzxidpz
mov ecx, 0x10075ef8
call fcn.1000350c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100384a8
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1005b06e
call fcn.10059860
sub esp, 0x10
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
je 0x10038515
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100385b6
push 0x52b8
push 0x7b12
push 1
push 0x4ed6
push 1
push 0xef9
push 0x32d2
push 0x6516
push 0x3e4c
push 0x71ea
mov edx, 0x30e8
mov ecx, 0x6dd6
call fcn.100362d4
add esp, 0x28
jmp 0x100385b6
mov dword [ebp - 0x14], 0x5291
cmp dword [ebp - 0x14], 0x544c
jle 0x10038569
xor esi, esi
xor ebx, ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10075ef8
cdq
push edx
push eax
call fcn.10001a90
inc ebx
cmp ebx, 0x5f77
jl 0x10038529
inc esi
cmp esi, 0x4073
jl 0x10038527
push 0x429
push 0
push 0xb87
push 0x1cc5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x4fdd
jge 0x100385a4
mov edx, str.umlhkjmx_rer_flrmjz_rbfisenw_bdrtuhqpu_hotcqtrax_xkpjnipqz_afwkwc_qmy_ujoklo_iwju_wczxnl_mcsvmg
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x100385a4
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov eax, dword [ebp + 0x14]
mov edx, dword [eax]
mov ecx, dword [edi]
mov eax, dword [ecx + esi*4]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100385c7
Capabilities:
Create pipe
Set thread local storage value

Disassembly:
mov eax, 0x1005b078
call fcn.10059860
sub esp, 0x2c
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100386e8
mov dword [ebp - 0x1c], 0x7faa
cmp dword [ebp - 0x1c], 0x80f6
jle 0x10038632
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10075ef8
cdq
push edx
push eax
call fcn.10001a90
inc edi
cmp edi, 0x4809
jl 0x10038600
inc esi
cmp esi, 0x396
jl 0x100385fe
push 0
push 0x24cd
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x100386ad
mov dword [ebp - 0x18], 0x7d14
cmp dword [ebp - 0x18], 0x7fa0
jle 0x10038691
xor esi, esi
xor edi, edi
mov eax, esi
lea ecx, [ebp - 0x34]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003866c
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.10001f32
inc edi
cmp edi, 0x1d72
jl 0x10038650
inc esi
cmp esi, 0x568a
jl 0x1003864e
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
cmp dword [ebp - 0x18], 0x79b4
jge 0x100386ad
push str.vmgtva_zogg_xficg_iqcpvf_zatgj_amexi
call fcn.100430bc
pop ecx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x7f9f
jge 0x100386cc
mov edx, str.thlosbq_bfqyyzxa_wmzykemyu_tjlce
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x10038710
push 0
push 0x2057
push 0x1a12
push 0xfb6
push 0x2165
push 0x2663
push 0x1a3a
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038be0
Capabilities:
Log keystrokes
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005b09e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov byte [esp + 0x14], dl
je 0x10038d25
test dl, dl
je 0x10038c33
cmp byte [ecx], 0
je 0x10038d8f
push 0x735
push 0x236d
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x10038d8f
push 4
lea ecx, [esp + 0x28]
call fcn.10001ba5
and dword [esp + 0x54], 0
mov dword [esp + 0x1c], 0x6960f57a
mov dword [esp + 0x18], 0x4ea1
cmp dword [esp + 0x18], 0x4f19
jle 0x10038ca8
xor esi, esi
xor edi, edi
mov ebx, 0x3394
mov eax, edi
lea ecx, [esp + 0x30]
cdq
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10038c7e
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.10001f32
add edi, esi
dec ebx
jne 0x10038c66
inc esi
cmp esi, 0x7900
jl 0x10038c5f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [esp + 0x18], 0x4b9f
jge 0x10038cbd
push str.hhqv_tybabcy_nwx_cxihknt_wkfkgu_yvju_zlfnk_skigco_vfeavh_emoqti
call fcn.100430bc
pop ecx
and dword [esp + 0x54], 0
lea eax, [esp + 0x20]
push 1
push eax
lea eax, [esp + 0x2c]
mov dl, 1
push 0x6e8f
push eax
xor cl, cl
call fcn.10037cac
add esp, 0x10
lea eax, [esp + 0x1c]
lea edx, [esp + 0x24]
push eax
push ecx
push 0x146d
mov cl, 1
call fcn.1003637d
add esp, 0xc
mov byte [esp + 0x13], 0
lea eax, [esp + 0x13]
mov dl, 1
mov cl, dl
push 0
push 0x1154
push eax
push 0x12a3
call fcn.10037cac
add esp, 0x10
lea ecx, [esp + 0x24]
call fcn.10001c28
jmp 0x10038d8f
cmp byte [ebp + 0x18], 0
je 0x10038d7d
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
cmp dword [edx], 0
je 0x10038d46
inc dword [ecx]
mov eax, dword [ecx]
mov eax, dword [edx]
mov eax, dword [edi]
mov eax, dword [ebx]
mov esi, dword [ebp + 0x20]
xor edx, edx
mov eax, dword [esi]
mov eax, dword [edi]
mov eax, dword [ecx]
test eax, eax
mov eax, dword [ebx]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 0x24]
setg cl
xor edx, edx
add ecx, 0x11f3
mov eax, dword [eax]
cmp ecx, 1
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esi], ecx
jmp 0x10038d8f
push 1
push 0x13f3
push 0x1a6a
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038dc2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005b0a8
call fcn.10059860
sub esp, 0x14
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x10038eee
mov dword [ebp - 0x18], 0x55f6
cmp dword [ebp - 0x18], 0x59a4
jle 0x10038e43
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [eax + ebx]
mov eax, edi
sar eax, cl
mov ecx, 0x10075ef8
xor eax, esi
cdq
push edx
push eax
call fcn.10001a90
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x47ad
jl 0x10038e04
inc ebx
cmp ebx, 0x3911
jl 0x10038dff
inc edi
cmp edi, 0x6a2
jl 0x10038dfd
inc esi
cmp esi, 0x31e3
jl 0x10038dfb
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x54b0
jge 0x10038e5f
mov edx, str.yzwvpcgqe_wxjwon_tupxtdtfr_bwnaffhh_ulqbwc_lgg_bfxwws_xvdjlxudv_joimkmskx_kywp
mov ecx, 0x10075ef8
call fcn.1000350c
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x18], 0
je 0x10038ed3
mov esi, dword [ebp + 0x10]
mov dword [esi], 0x12
jmp 0x10038ec9
push 0x5da
push 0x3cf0
push 0x6412
push 0x7699
lea eax, [ebp + 0xb]
mov dword [ebp - 0x18], 0x23ed15de
push eax
mov dl, 1
mov byte [ebp + 0xb], 0
push 1
push 0x106
mov cl, dl
call fcn.10036432
add esp, 0x1c
inc dword [ebp - 0x18]
dec dword [esi]
cmp dword [esi], 0xfffffffb
jg 0x10038e8e
jmp 0x10038f55
push 0x196a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
jmp 0x10038f55
cmp byte [ebp + 0x14], 0
je 0x10038f10
mov dword [edx], 0
jmp 0x10038f09
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [edx]
cmp dword [edx], 2
jl 0x10038efc
jmp 0x10038f55
mov esi, dword [ebp + 0xc]
mov dword [esi], 0xffffffee
jmp 0x10038f50
push 1
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xaa9ac70c
push eax
push 0x3528
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0xb6084edc
push 0x27f4
push eax
mov edx, 0x1099
mov ecx, esi
call fcn.10035aef
add esp, 0x18
inc dword [esi]
cmp dword [esi], 0xfffffff2
jne 0x10038f1b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039214
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov byte [ebp - 0xc], dl
push ebx
push esi
push edi
test dl, dl
je 0x100393d4
mov dword [ebp - 0x1c], 0x55cc25b
xor esi, esi
push 9
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0x37f4a7d2
mov dword [ebp - 0x18], 0x131dda87
mov dword [ebp - 0x10], esi
jmp 0x10039258
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2c], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003924a
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], esi
jl 0x100393eb
mov dword [ebp - 0x10], 0x7e6aa165
mov dword [ebp - 0x18], 0x2f90
cmp dword [ebp - 0x18], 0x3087
jle 0x100392dc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, esi
mov ebx, esi
mov eax, esi
mov dword [ebp - 0x14], esi
and eax, ebx
lea ecx, [ebp - 0x60]
xor eax, edi
cdq
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100392aa
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push esi
push 1
lea ecx, [ebp - 0x60]
call fcn.10001f32
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x3469
jl 0x10039291
inc ebx
cmp ebx, 0x5a11
jl 0x1003928c
inc edi
cmp edi, 0x77ab
jl 0x1003928a
push dword [ebp - 0x24]
movdqa xmm0, xmmword [0x10068650]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x38], esi
push eax
push esi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x34], esi
movdqu xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x30], esi
call fcn.10003a4f
cmp dword [ebp - 0x18], 0x2de3
jge 0x1003931a
push str.hlafprad_cfxeigf_uhz_zqcnw_koo_qhftmphc_pqtp_ynj_rbzgi_yitcvfis_hsk_jygmipn_qtm
call fcn.100430bc
pop ecx
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x18], 0xffffffff
cmp dword [ebp - 0x1c], esi
je 0x10039397
mov ecx, dword [ebp - 0x10]
xor edx, edx
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setle cl
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 5
imul ecx, dword [ebp - 0x14], 0xb1a0
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
jne 0x10039387
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], 0xfffffffc
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, 0xb0d5
setle cl
cmp ecx, 0x898d
jle 0x100393b5
cmp dword [ebp - 0x24], esi
jne 0x100393b5
mov ecx, esi
jmp 0x100393b8
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
imul eax, ecx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x18], eax
call fcn.10001c28
dec dword [ebp - 0x2c]
jns 0x1003926a
jmp 0x100393eb
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x100393eb
push ecx
push 1
push ecx
push ecx
call fcn.100375c4
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x496a40
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x56e70b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00561d0e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x496ac2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0055f3e0
mov eax, dword [eax]
push 0x676284
push eax
call fcn.0053eef4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00561f99
test bl, bl
je 0x496ac2
push 0x676284
lea ecx, [esp + 0xc]
call fcn.00562329
push 0x679e44
lea ecx, [esp + 0xc]
call fcn.00562329
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x496afe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00561f99
jmp 0x496bc9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x496b82
lea edx, [esp + 0x7c]
push 0x679e40
push edx
call fcn.0053eef4
add esp, 8
test eax, eax
je 0x496b82
lea eax, [esp + 0x7c]
push 0x679e3c
push eax
call fcn.0053eef4
add esp, 8
test eax, eax
je 0x496b82
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x496b12
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00561f99
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4
Function at 0x4982e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x56e8ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x68f6fc]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x498418
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x498346
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00561f99
xor eax, eax
jmp 0x49848f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.005620d6
push esi
lea ecx, [esp + 0xc]
call fcn.00562365
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x679e8c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x49846d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push 0x679e84
push 0x80000000
call fcn.00503120
test eax, eax
jne 0x49846d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push 0x679e70
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x80000000
mov ecx, edi
call fcn.00503120
test eax, eax
jne 0x49846d
lea eax, [esp + 0x14]
push 0x679e68
push eax
call fcn.0053ff80
mov esi, eax
add esp, 8
test esi, esi
jne 0x49844c
lea ecx, [esp + 0x14]
push 0x679e64
push ecx
call fcn.0053ff00
mov esi, eax
add esp, 8
test esi, esi
jne 0x49844c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x49844f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00562086
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x49835e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00561f99
xor eax, eax
jmp 0x49848f
mov byte [esi], 0
push 0x679e60
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00561f99
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x4a030a
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x56f348
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00563587
xor ebp, ebp
mov dword [esi], 0x65b858
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x40], ebp
lea edi, [esi + 0x44]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x14], edi
lea ecx, [edi + 0x18]
mov dword [edi], fcn.004f8760
call fcn.0048b830
lea ecx, [edi + 0x30]
mov byte [esp + 0x38], 1
call fcn.00561013
lea ebx, [edi + 0x44]
mov ecx, ebx
call fcn.0048b830
mov dword [ebx], 0x65908c
mov dword [edi], 0x65b77c
mov dword [esi + 0xa0], ebp
mov dword [esi + 0x9c], 0x65aa48
lea ecx, [esi + 0xb0]
call fcn.0048b830
lea edi, [esi + 0xc8]
mov dword [edi + 4], ebp
mov dword [edi], vtable.CBitmap.0
mov byte [esp + 0x38], 5
mov dword [esi], 0x65b784
mov dword [esi + 0xac], ebp
call fcn.0056c3be
mov eax, dword [eax + 0xc]
push 0x40e
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
mov ecx, edi
call fcn.00568c23
mov ecx, dword [esi + 0xcc]
lea eax, [esp + 0x18]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [esp + 0x1c]
mov eax, 0x55555556
imul ecx
mov ecx, dword [esp + 0x20]
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esi + 0xd4], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0xd0], edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x4a04c0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x56f3d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x65b784
mov dword [esp + 0x18], 0
lea ecx, [esi + 0xc8]
mov dword [esp + 0xc], ecx
mov dword [ecx], vtable.CGdiObject.0
mov byte [esp + 0x18], 4
call fcn.00568c7a
lea ecx, [esi + 0xb0]
mov byte [esp + 0x18], 2
mov dword [ecx], 0x659088
call fcn.0048ba30
lea ecx, [esi + 0x9c]
mov dword [esp + 0xc], ecx
mov dword [ecx], vtable.CGdiObject.0
mov byte [esp + 0x18], 5
call fcn.00568c7a
lea edi, [esi + 0x44]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x44]
mov byte [esp + 0x18], 7
mov dword [ecx], 0x659088
call fcn.0048ba30
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 6
call fcn.00561046
lea ecx, [edi + 0x18]
mov byte [esp + 0x18], 0
mov dword [ecx], 0x659088
call fcn.0048ba30
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.0056a23d
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret