joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468318
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x468320
push ebx
mov ebx, dword [0x48ea70]
xor eax, eax
push ebp
push 0x46854c
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebx]
push 0x468564
push dword [ebx + 4]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404e68
push dword [ebx]
push 0x468570
push dword [ebx + 0xc]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404e68
mov edx, dword [ebx]
lea eax, [ebp - 0xc]
mov ecx, 0x468580
call fcn.00404dec
mov edx, dword [ebx]
lea eax, [ebp - 0x10]
mov ecx, 0x468594
call fcn.00404dec
mov edx, dword [ebx]
lea eax, [ebp - 0x14]
mov ecx, 0x4685ac
call fcn.00404dec
mov eax, dword [ebx + 0x10]
dec eax
jne 0x4684c9
mov ecx, dword [ebx + 0xc]
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0xc]
call fcn.00404dec
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0xc]
call fcn.00467900
lea eax, [ebp - 0x28]
mov ecx, 0x4685c0
mov edx, dword [ebp - 0x10]
call fcn.00404dec
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.00467900
mov ecx, dword [ebx + 0xc]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.00404dec
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.00467900
lea eax, [ebp - 0x30]
mov ecx, 0x4685c0
mov edx, dword [ebp - 0x10]
call fcn.00404dec
mov eax, dword [ebp - 0x30]
call fcn.00404f64
push eax
call sub.kernel32.dll_DeleteFileA
mov dl, 1
mov eax, dword [0x41ea08]
call fcn.0041eb08
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4684c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x20]
call fcn.0041eba8
mov cl, 1
mov edx, 0x4685d0
mov eax, dword [ebp - 0x20]
call fcn.0041ec10
test al, al
je 0x468471
lea ecx, [ebp - 0x18]
mov edx, 0x4685f0
mov eax, dword [ebp - 0x20]
call fcn.0041f1ac
lea ecx, [ebp - 0x1c]
mov edx, 0x468600
mov eax, dword [ebp - 0x20]
call fcn.0041f1ac
mov eax, dword [ebp - 0x20]
call fcn.0041eb78
xor ecx, ecx
mov edx, 0x468614
mov eax, dword [ebp - 0x20]
call fcn.0041ec10
test al, al
je 0x4684ac
mov ecx, dword [ebp - 0x18]
mov edx, 0x468654
mov eax, dword [ebp - 0x20]
call fcn.0041f17c
mov ecx, dword [ebp - 0x1c]
mov edx, 0x46866c
mov eax, dword [ebp - 0x20]
call fcn.0041f17c
mov eax, dword [ebp - 0x20]
call fcn.0041eb78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4684c9
mov eax, dword [ebp - 0x20]
call fcn.00403bf4
ret
mov dl, 1
mov eax, dword [0x41ea08]
call fcn.0041eb08
mov dword [ebp - 0x20], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0x20]
call fcn.0041eba8
mov edx, 0x4685d0
mov eax, dword [ebp - 0x20]
call fcn.0041ef04
mov cl, 1
mov edx, 0x468684
mov eax, dword [ebp - 0x20]
call fcn.0041ec10
test al, al
je 0x46851a
mov edx, 0x4686bc
mov eax, dword [ebp - 0x20]
call fcn.0041f07c
mov eax, dword [ebp - 0x20]
call fcn.0041eb78
mov eax, dword [ebp - 0x20]
call fcn.00403bf4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468553
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00404af8
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404af8
ret
Function at 0x4688a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
push 0x20019
lea eax, [esp + 4]
push eax
mov eax, dword [0x48e818]
mov eax, dword [eax]
call eax
mov esi, eax
test esi, esi
je 0x4688f0
push 0
push 0
push 0
push 0
push 0x4688fc
push esi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete bl
push esi
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x46bbd0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x46bbfe
mov eax, ebx
call fcn.0046c684
cmp dword [ebx + 0x40], 0
je 0x46bbf7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x46bc6f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x46bc61
cmp dword [ebx + 8], 0
je 0x46bc20
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x46bc32
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46bc61
cmp dword [ebx + 8], 0
je 0x46bc13
cmp eax, 3
je 0x46bc45
dec eax
jne 0x46bc13
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46bc13
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x46bc13
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x46bc8d
cmp dword [ebx + 0x14], 0xcc
je 0x46bc8d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046bc98
pop ebx
ret
Function at 0x487d68
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x487d70
push ecx
push ebx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x487f8f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00466c88
test eax, eax
jl 0x487daa
mov ecx, 0x8000
mov edx, 0x487fa4
mov eax, dword [ebp - 0xc]
call fcn.00489fc4
jmp 0x487f67
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, dword [0x48ea70]
mov eax, dword [eax + 0x18]
call fcn.00467540
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x487eec
mov ecx, 0xff0000
mov edx, 0x487fb4
mov eax, dword [ebp - 0xc]
call fcn.00489fc4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0048841c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00404b6c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0048a024
xor eax, eax
push ebp
push 0x487ed8
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0xff0000
mov edx, 0x487fc8
mov eax, dword [ebp - 0xc]
call fcn.00489fc4
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xd], 0
je 0x487e34
call fcn.00404514
jmp 0x487ef9
mov edx, 3
mov eax, dword [ebp - 0xc]
call fcn.00489fa0
mov eax, dword [0x48ea70]
mov eax, dword [eax + 0x18]
call fcn.0040909c
test al, al
je 0x487e9d
push 0
mov eax, dword [0x48ea70]
push dword [eax + 8]
push 0x487fdc
mov eax, dword [0x48ea70]
push dword [eax + 0xc]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404e68
mov eax, dword [ebp - 0x18]
call fcn.00404f64
push eax
mov eax, dword [0x48ea70]
mov eax, dword [eax + 0x18]
call fcn.00404f64
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x487e9d
call fcn.00404514
jmp 0x487ef9
mov ecx, 0xff
mov edx, 0x487fec
mov eax, dword [ebp - 0xc]
call fcn.00489fc4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xa
jne 0x487ebf
call fcn.00404514
jmp 0x487ef9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487edf
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00488068
ret
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xd], 0
je 0x487dc7
cmp dword [ebp - 0x10], 0xa
jne 0x487f67
mov ebx, 1
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xd], 0
jne 0x487f51
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00489fa0
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xa
sub eax, ebx
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x488000
call fcn.004099e8
mov edx, dword [ebp - 0x1c]
mov ecx, 0xff
mov eax, dword [ebp - 0xc]
call fcn.00489fc4
inc ebx
cmp ebx, 0xb
jne 0x487f04
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xd], 0
jne 0x487f67
call fcn.00466d50
mov eax, dword [ebp - 0xc]
call fcn.0041b4b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487f96
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404af8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404af8
ret
Function at 0x48a11c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404f54
xor eax, eax
push ebp
push 0x48a1bb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.00403530
mov word [ebp - 0x28], si
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f64
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x48a1a5
cmp byte [ebp + 8], 0
je 0x48a1a5
push 0x64
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x48a1a1
cmp byte [ebx + 0xd], 0
jne 0x48a1a5
test eax, eax
jne 0x48a189
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a1c2
lea eax, [ebp - 4]
call fcn.00404ad4
ret
Function at 0x403e59
Capabilities:
Delete directory
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
cmp dword [0x4e2910], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
jne 0x403e92
push 0x4036a4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x4036b4
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov eax, dword [0x432438]
mov ebx, dword [0x43243c]
xor esi, esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x1c], 0x9e3779b9
call fcn.00403e52
mov eax, dword [0x432440]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x432444]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x4e2910], 0xc
mov dword [ebp - 4], eax
jne 0x403f25
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x444]
push eax
push esi
push 0x4036d4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push esi
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x30]
push eax
push esi
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x4e2910]
cmp eax, 0xfa9
jne 0x403f41
mov dword [0x4e1eac], 0xedeb2e40
cmp eax, 0x3eb
jne 0x403f4e
mov dword [0x4e185c], esi
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov edx, edi
shr edx, cl
add eax, edi
mov dword [ebp - 0x14], eax
mov dword [0x4e1ea8], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x4e2910], 0x213
mov dword [ebp - 0x14], edx
jne 0x403f8d
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
cmp dword [0x4e2910], 0xc
jne 0x403fca
push esi
lea eax, [ebp - 0x444]
push eax
push 0x403718
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push esi
lea eax, [ebp - 0xc44]
push eax
push 0x4036dc
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x10]
shr eax, cl
add eax, ebx
xor eax, edx
xor dword [ebp - 4], eax
sub edi, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
sub dword [ebp - 8], eax
dec dword [ebp - 0x18]
jne 0x403ed2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x404012
Capabilities:
Create pipe
Get common file path
Get system information on windows
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4e2910]
mov ecx, dword [0x4e1860]
sub esp, 0x44c
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x4040fa
mov edi, ecx
mov ebx, eax
cmp dword [0x4e2910], 0x959
jne 0x4040ea
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x403778
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0x4037c8
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x4037e4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x40381c
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.00403e59
add edi, 8
dec ebx
jne 0x40403a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4043f5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
push ebx
push esi
push edi
mov edi, 0x5d744c
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_CharToOemBuffA]
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
lea eax, [esp + 0xc]
push eax
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatW]
dec edi
jne 0x40440b
xor ebx, ebx
mov edi, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
cmp ebx, edi
jle 0x40445b
cmp dword [esp + 0x10], 0x785074d5
jne 0x404464
inc ebx
cmp ebx, 0x1c1b
jl 0x40443c
cmp dword [0x4e2910], 0x400
jne 0x4044b2
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push esi
push esi
call fcn.004058c7
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00403ded
fstp st(0)
push ecx
push ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00403e10
fstp st(0)
push esi
call fcn.00405dfe
pop ecx
push esi
call fcn.00405c4e
pop ecx
push esi
push esi
call fcn.004057bb
pop ecx
pop ecx
mov eax, dword [0x43280c]
mov dword [0x4e2910], eax
mov eax, dword [0x4327e0]
mov dword [0x4e2914], eax
call fcn.004041ce
xor ebx, ebx
push 0x4038e4
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp ebx, edi
jle 0x4044e6
cmp dword [esp + 0x10], 0x785074d5
jne 0x4044ef
inc ebx
cmp ebx, 0x11915
jl 0x4044cd
mov edi, 0x3078f
cmp dword [0x4e2910], 0x51f
jne 0x404520
push 0x4038ec
push esi
lea eax, [esp + 0x20]
push eax
push 0x403924
push 0x40393c
push 0x40397c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
jne 0x4044f4
mov eax, dword [0x4e1860]
mov dword [0x4e1ea4], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40661b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431178]
jne 0x406625
repz ret
jmp fcn.0040bb9c
Function at 0x40c170
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409bfc
and dword [ebp - 4], 0
cmp dword [0x4333fc], 0
mov ebx, eax
jne 0x40c221
push 0x4024f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c2d2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4024e4
push edi
call esi
test eax, eax
je 0x40c2d2
push eax
call fcn.00409b8a
mov dword [esp], 0x4024d4
push edi
mov dword [0x4333fc], eax
call esi
push eax
call fcn.00409b8a
mov dword [esp], 0x4024c0
push edi
mov dword [0x433400], eax
call esi
push eax
call fcn.00409b8a
mov dword [esp], 0x4024a4
push edi
mov dword [0x433404], eax
call esi
push eax
call fcn.00409b8a
pop ecx
mov dword [0x43340c], eax
test eax, eax
je 0x40c221
push 0x40248c
push edi
call esi
push eax
call fcn.00409b8a
pop ecx
mov dword [0x433408], eax
mov eax, dword [0x433408]
cmp eax, ebx
je 0x40c279
cmp dword [0x43340c], ebx
je 0x40c279
push eax
call fcn.00409c05
push dword [0x43340c]
mov esi, eax
call fcn.00409c05
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c279
test edi, edi
je 0x40c279
call esi
test eax, eax
je 0x40c270
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c270
test byte [ebp - 0xc], 1
jne 0x40c279
or dword [ebp + 0x10], 0x200000
jmp 0x40c2b2
mov eax, dword [0x433400]
cmp eax, ebx
je 0x40c2b2
push eax
call fcn.00409c05
pop ecx
test eax, eax
je 0x40c2b2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c2b2
mov eax, dword [0x433404]
cmp eax, ebx
je 0x40c2b2
push eax
call fcn.00409c05
pop ecx
test eax, eax
je 0x40c2b2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4333fc]
call fcn.00409c05
pop ecx
test eax, eax
je 0x40c2d2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c2d4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413470
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47adcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046f5a7
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4134f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046ccf0
mov eax, dword [eax]
push 0x576210
push eax
call fcn.0045f7c4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046f832
test bl, bl
je 0x4134f2
push 0x576210
lea ecx, [esp + 0xc]
call fcn.0046fbc2
push 0x579d9c
lea ecx, [esp + 0xc]
call fcn.0046fbc2
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41352e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046f832
jmp 0x4135f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4135b2
lea edx, [esp + 0x7c]
push 0x579d98
push edx
call fcn.0045f7c4
add esp, 8
test eax, eax
je 0x4135b2
lea eax, [esp + 0x7c]
push 0x579d94
push eax
call fcn.0045f7c4
add esp, 8
test eax, eax
je 0x4135b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x413542
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046f832
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x413df0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x413e52
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x413e60
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47ae4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x580394]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x413f98
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x413ec6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046f832
xor eax, eax
jmp 0x41400f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046f96f
push esi
lea ecx, [esp + 0xc]
call fcn.0046fbfe
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x579dd4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x413fed
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push bind
call fcn.00413df0
test eax, eax
jne 0x413fed
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push bind
mov ecx, edi
call fcn.00413df0
test eax, eax
jne 0x413fed
lea eax, [esp + 0x14]
push 0x579db0
push eax
call fcn.004608c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x413fcc
lea ecx, [esp + 0x14]
push 0x579dac
push ecx
call fcn.00460840
mov esi, eax
add esp, 8
test esi, esi
jne 0x413fcc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x413fcf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046f91f
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x413ede
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046f832
xor eax, eax
jmp 0x41400f
mov byte [esi], 0
push 0x579da8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046f832
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4