joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4554f4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404088
xor eax, eax
push ebp
push 0x4555fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.00454ad8
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4555c3
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004089f4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00455d9c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004088d0
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00455e10
jmp 0x4555d5
xor edx, edx
mov eax, ebx
call fcn.00455d9c
xor edx, edx
mov eax, ebx
call fcn.00455e10
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455604
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403c78
ret

Function at 0x45bb8c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x160]
mov edx, ebx
mov eax, edi
call fcn.0045bdc0
mov esi, eax
mov dword [edi + 0x160], esi
and esi, 0xff
add dword [edi + 0x164], esi
imul esi, dword [edi + 0x164], 0x8088405
inc esi
mov dword [edi + 0x164], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x168]
mov eax, edi
call fcn.0045bdc0
mov dword [edi + 0x168], eax
pop edi
pop esi
pop ebx
ret

Function at 0x45bc00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x45bc25
inc esi
mov eax, edi
call fcn.0045bbe4
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.0045bb8c
inc ebx
dec esi
jne 0x45bc0f
pop edi
pop esi
pop ebx
ret
Function at 0x45bcb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404088
xor eax, eax
push ebp
push 0x45bd29
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0045bc2c
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.0045bbe4
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.0045bb8c
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x45bcf4
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bd30
lea eax, [ebp - 4]
call fcn.00403c54
ret
Function at 0x45c914
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45caf8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x45cab4
mov eax, dword [ebp - 4]
call fcn.0045e484
cmp ebx, eax
jge 0x45cab4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x108]
mov edx, ebx
call fcn.004533ec
mov edx, dword [0x454e94]
call fcn.0040315c
mov esi, eax
mov eax, esi
call fcn.00455d30
test al, al
je 0x45caaa
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x45ca9e
xor eax, eax
push ebp
push 0x45ca97
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045d0ec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
call fcn.00452524
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 4]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xc]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00404208
mov eax, dword [ebp - 8]
call fcn.004040a4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x148]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045cc90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x148]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cae2
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x45ca96
mov eax, dword [ebp - 4]
call fcn.0045d170
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00408dac
jmp 0x45cae2
mov eax, dword [ebp - 8]
call fcn.00403c54
jmp 0x45cae2
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040841c
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x40ce2c]
call fcn.00409ecc
call fcn.00403724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45caff
lea eax, [ebp - 0x54]
call fcn.00403c54
ret
Function at 0x463008
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push esp
push 0xff
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.00408dac
add esp, 0x100
pop ebx
ret

Function at 0x463160
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4632b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403c54
lea eax, [ebp - 0x1c]
call fcn.00403c54
call fcn.00406640
mov esi, eax
mov eax, esi
and eax, 1
xor ebx, ebx
dec eax
jne 0x463286
mov eax, ebx
add al, 0x41
mov byte [ebp - 5], al
lea eax, [ebp - 0x20]
mov dl, byte [ebp - 5]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x24]
call fcn.00402b78
mov edx, 0x4632c4
lea eax, [ebp - 0x24]
mov cl, 2
call fcn.00402b48
lea edx, [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.00403e78
cmp byte [ebp - 5], 0
je 0x463286
mov eax, dword [ebp - 4]
call fcn.00404098
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
je 0x463286
mov eax, dword [ebp - 4]
call fcn.00404098
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x463286
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404098
push eax
call fcn.00406600
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x4632c8]
fdiv dword [0x4632c8]
fdiv dword [0x4632c8]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
fild qword [ebp - 0x34]
fmulp st(1)
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x38], eax
fild qword [ebp - 0x3c]
fmulp st(1)
fcomp dword [0x4632cc]
fnstsw ax
sahf
jbe 0x463286
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00403ca8
jmp 0x463297
shr esi, 1
mov eax, esi
and eax, 1
inc ebx
cmp ebx, 0x1b
jne 0x46319e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4632bc
lea eax, [ebp - 0x1c]
call fcn.00403c54
lea eax, [ebp - 4]
call fcn.00403c54
ret

Function at 0x463848
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffff54
mov ebx, eax
mov dword [esp + 8], 0x94
lea eax, [esp + 8]
push eax
call fcn.00406690
cmp dword [esp + 0x18], 2
jne 0x4638ce
push esp
push 0x28
call fcn.004065e0
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 0xa0]
push eax
push 0x4638d8
push 0
call fcn.00406500
mov dword [esp + 0x9c], 1
test bl, bl
je 0x4638a8
mov dword [esp + 0xa8], 2
jmp 0x4638b1
xor eax, eax
mov dword [esp + 0xa8], eax
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0xa8]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
add esp, 0xac
pop ebx
ret
Function at 0x463eac
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x463eb5
mov eax, dword [ebp - 4]
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
push 0
push 0
push 0
push 0
push 0x463ff0
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x463fe9
xor edx, edx
push ebp
push 0x463fe2
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x80000000
push 0
push 0
mov eax, esi
call fcn.00404098
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00447c34
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x463fcb
xor edx, edx
push ebp
push 0x463fc4
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x10000
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10014]
push eax
push 0x16
mov eax, dword [ebp - 8]
push eax
call fcn.00447c1c
neg eax
sbb eax, eax
neg eax
test al, al
je 0x463fad
lea edx, [ebp - 0x10014]
mov ecx, 0x10000
mov eax, edi
mov esi, dword [eax]
call dword [esi + 8]
lea eax, [ebp - 0xc]
push eax
push 0x3e8
lea eax, [ebp - 0x10014]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x463fad
cmp dword [ebp - 0xc], 0
je 0x463fa7
lea edx, [ebp - 0x10014]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 8]
cmp dword [ebp - 0xc], 0
jne 0x463f74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463fcb
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463fe9
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46408c
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x464095
mov eax, dword [ebp - 4]
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404088
xor eax, eax
push ebp
push 0x4641cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 0
push 0
push 0
push 0x4641dc
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4641b5
xor eax, eax
push ebp
push 0x4641ae
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x84000040
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404098
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00447c34
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x464197
xor eax, eax
push ebp
push 0x464190
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 0x3e8
lea eax, [ebp - 0x10014]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x464160
cmp dword [ebp - 0x14], 0
je 0x46415a
lea edx, [ebp - 0x10014]
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 8]
cmp dword [ebp - 0x14], 0
jne 0x464127
mov eax, ebx
call fcn.00452558
cmp edx, 0
jne 0x464173
cmp eax, 0
jbe 0x464179
jmp 0x464175
jle 0x464179
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464197
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4641b5
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4641d2
lea eax, [ebp - 4]
call fcn.00403c54
ret
Function at 0x6df560
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x6df66c
test eax, eax
je 0x6df66c
push esi
push edi
mov ecx, 0x10
mov esi, 0x6fb008
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x6df653
lea edi, [eax + 4]
jmp 0x6df5b7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x6df5cc
mov dword [ebp - 4], 2
jmp 0x6df5ed
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x6df5e3
mov dword [ebp - 4], 1
jmp 0x6df5ed
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x6df663
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x6df626
mov byte [ecx], 0x3d
jmp 0x6df632
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x6df63d
mov byte [ecx], 0x3d
jmp 0x6df643
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x6df5b4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6e2fb0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, eax
mov ebx, ecx
jne 0x6e2fd9
push esi
call fcn.006e2920
test al, al
jne 0x6e2fd9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x48]
push eax
push ecx
call fcn.006dd150
mov edi, eax
call fcn.006dd510
add esp, 4
push eax
mov eax, 0x40
call fcn.006e0fc0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc0]
push edx
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 4], 0x40
call fcn.006df560
mov ecx, dword [ebp - 4]
add esp, 0x10
xor eax, eax
push 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x80], al
push 0x10
mov eax, esi
mov byte [ebp + ecx - 0xc0], 0
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
mov dword [ebp - 0x20], 0xc3d2e1f0
call fcn.006df2d0
test al, al
je 0x6e306b
mov edi, dword [ebp - 4]
jmp 0x6e306e
or edi, 0xffffffff
push 4
lea eax, [ebp - 4]
push eax
push 0xc
mov eax, esi
call fcn.006df2d0
test al, al
je 0x6e3086
mov eax, dword [ebp - 4]
jmp 0x6e3089
or eax, 0xffffffff
push edi
push eax
push esi
lea esi, [ebp - 0x80]
call fcn.006df7e0
cmp byte [ebp - 0x80], 0
mov dword [ebp - 4], 0x40
jne 0x6e30aa
call fcn.006dfd10
mov byte [ebp - 0x80], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x30]
bswap ecx
mov dword [ebp + eax*4 - 0x1c], ecx
inc eax
cmp eax, 5
jb 0x6e30b0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x1c]
push 0x14
push ecx
call fcn.006df560
mov edx, dword [ebp - 4]
add esp, 0x10
cmp byte [ebp + 0xc], 0
mov byte [ebp + edx - 0x100], 0
mov eax, 0x6fb3dc
jne 0x6e30f4
mov eax, 0x6fb3f4
push 0
push eax
mov edi, ebx
call fcn.006e2e30
mov eax, dword [ebp + 8]
push 1
push eax
call fcn.006e2e30
push 0
push 0x6fb40c
call fcn.006e2e30
push 1
lea ecx, [ebp - 0xc0]
push ecx
call fcn.006e2e30
push 0
push 0x6fb414
call fcn.006e2e30
push 1
lea edx, [ebp - 0x100]
push edx
call fcn.006e2e30
cmp byte [ebp + 0xc], 0
je 0x6e3148
call fcn.006e2f10
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6e3350
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
jne 0x6e336f
mov ebx, dword [ebp + 8]
push eax
call fcn.006e2920
test al, al
je 0x6e33a9
mov ebx, dword [ebp + 0xc]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6e3377
sub eax, edx
mov esi, eax
push esi
mov dword [ebp + 0xc], esi
call fcn.006e9d64
lea ecx, [ebp + 0xc]
push ecx
mov edi, eax
push edi
push esi
push ebx
call fcn.006df680
add esp, 0x14
test al, al
jne 0x6e33b4
push edi
call fcn.006ea454
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
xor ebx, ebx
push edx
push edi
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x2c], 0x67452301
mov dword [ebp - 0x28], 0xefcdab89
mov dword [ebp - 0x24], 0x98badcfe
mov dword [ebp - 0x20], 0x10325476
mov dword [ebp - 0x1c], 0xc3d2e1f0
mov byte [ebp - 0x7c], bl
call fcn.006df790
mov dword [ebp + 0xc], 0x40
cmp byte [ebp - 0x7c], bl
jne 0x6e3407
call fcn.006dfd10
mov byte [ebp - 0x7c], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x2c]
bswap ecx
mov dword [ebp + eax*4 - 0x18], ecx
inc eax
cmp eax, 5
jb 0x6e3410
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x18]
push 0x14
push ecx
call fcn.006df560
mov edx, dword [ebp + 0xc]
push edi
mov byte [ebp + edx - 0xbc], bl
call fcn.006ea454
mov bl, byte [ebp + 0x10]
add esp, 0x14
mov eax, 0x6fb438
test bl, bl
jne 0x6e345a
mov eax, 0x6fb450
mov edi, dword [ebp + 8]
push 0
push eax
call fcn.006e2e30
push 1
lea eax, [ebp - 0xbc]
push eax
call fcn.006e2e30
test bl, bl
je 0x6e347c
call fcn.006e2f10
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4089f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46533b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00459f57
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x408a72
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00457ccd
mov eax, dword [eax]
push 0x4ca1c0
push eax
call fcn.0044aaa4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045a1e2
test bl, bl
je 0x408a72
push 0x4ca1c0
lea ecx, [esp + 0xc]
call fcn.0045a572
push 0x4cdd34
lea ecx, [esp + 0xc]
call fcn.0045a572
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x408aae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045a1e2
jmp 0x408b79
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x408b32
lea edx, [esp + 0x7c]
push 0x4cdd30
push edx
call fcn.0044aaa4
add esp, 8
test eax, eax
je 0x408b32
lea eax, [esp + 0x7c]
push 0x4cdd2c
push eax
call fcn.0044aaa4
add esp, 8
test eax, eax
je 0x408b32
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408ac2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045a1e2
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x409370
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4093d2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4093e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4653bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4d41d8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x409518
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x409446
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045a1e2
xor eax, eax
jmp 0x40958f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045a31f
push esi
lea ecx, [esp + 0xc]
call fcn.0045a5ae
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40956d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00409370
test eax, eax
jne 0x40956d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00409370
test eax, eax
jne 0x40956d
lea eax, [esp + 0x14]
push 0x4cdd48
push eax
call fcn.0044bae0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40954c
lea ecx, [esp + 0x14]
push 0x4cdd44
push ecx
call fcn.0044ba60
mov esi, eax
add esp, 8
test esi, esi
jne 0x40954c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40954f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045a2cf
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40945e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045a1e2
xor eax, eax
jmp 0x40958f
mov byte [esi], 0
push 0x4cdd40
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045a1e2
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4