joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403860
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x4ab6f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004839e0
push str.CODE_CRAFTERS_ABILITYMAILSERVER2
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0
call fcn.00483a90
test al, al
je 0x4038a9
mov eax, dword [esi + 0x1c]
push 5
push 0x3f4
push eax
jmp 0x4038b4
mov ecx, dword [esi + 0x1c]
push 0
push 0x3f4
push ecx
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_ShowWindow]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.00483a10
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x406ec0
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4abaa8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [esp + 0x40]
mov ebx, ecx
push esi
call fcn.00485230
add esp, 4
test al, al
je 0x406f0d
push esi
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x406f0d
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 4
lea ecx, [esp + 8]
call fcn.00489cd0
push 0
push 1
push 1
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], 0
call fcn.00489d20
test al, al
jne 0x406f58
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.00489d10
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 4
push edi
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push 0x18
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 1
call fcn.00489f00
test al, al
pop edi
jne 0x406fa9
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.00489d10
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 4
add ebx, 4
push 0x62d
push ebx
lea ecx, [esp + 0x10]
call fcn.00489f00
test al, al
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 8]
jne 0x406fe5
call fcn.00489d10
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 4
call fcn.00489d10
mov ecx, dword [esp + 0x30]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x4071f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4abafe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0048a660
mov al, byte [esp + 0x20]
xor edi, edi
mov dword [esp + 0x14], edi
mov byte [esi + 0x1c], al
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov al, byte [esp + 0x20]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edx
push 0xc
mov byte [esp + 0x18], 1
mov byte [esi + 0x38], al
call fcn.004a2a14
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov cl, byte [esp + 0x20]
mov byte [esp + 0x14], 2
mov byte [esi + 0x48], cl
lea ecx, [esi + 0x50]
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
call fcn.0048a6e0
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x4b49e0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x40acb0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4abea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov al, byte [esp + 0x24]
push ebx
xor ebx, ebx
push esi
push edi
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov edi, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov ecx, edi
xor esi, esi
call fcn.00414960
test eax, eax
jle 0x40ae1e
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov ecx, edi
call fcn.004148c0
mov ecx, eax
call fcn.00440420
test al, al
je 0x40ae0b
test ebp, ebp
je 0x40ad3f
push esi
mov ecx, edi
call fcn.004148c0
mov ecx, eax
call fcn.00441930
push eax
push ebp
call fcn.0047f7d0
add esp, 8
test eax, eax
jne 0x40ae0b
push esi
mov ecx, edi
call fcn.004148c0
mov ecx, eax
call fcn.00440440
push eax
call fcn.00485230
add esp, 4
mov ecx, edi
test al, al
push esi
je 0x40adc8
call fcn.004148c0
mov ecx, eax
call fcn.00440440
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
cmp eax, 1
jne 0x40adb5
push esi
mov ecx, edi
call fcn.004148c0
mov ecx, eax
call fcn.00441960
mov edx, dword [ebx + 8]
lea ecx, [esp + 0x34]
push ecx
push 1
push edx
mov ecx, ebx
mov dword [esp + 0x40], eax
call fcn.004167b0
push esi
mov ecx, edi
call fcn.004148c0
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
push 1
push ecx
jmp 0x40ae02
push 0
push esi
mov ecx, edi
call fcn.004148c0
mov ecx, eax
call fcn.00440450
jmp 0x40ae0b
call fcn.004148c0
mov ecx, eax
call fcn.00441960
lea edx, [esp + 0x38]
mov dword [esp + 0x38], eax
mov eax, dword [ebx + 8]
push edx
push 1
push eax
mov ecx, ebx
call fcn.004167b0
push esi
mov ecx, edi
call fcn.004148c0
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push 1
mov dword [esp + 0x18], eax
push edx
lea ecx, [esp + 0x20]
call fcn.004167b0
mov ecx, edi
inc esi
call fcn.00414960
cmp esi, eax
jl 0x40ad03
xor ebx, ebx
pop ebp
xor esi, esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40ae43
mov ecx, dword [esp + 0x18]
sub ecx, eax
sar ecx, 2
cmp esi, ecx
jae 0x40ae43
mov edx, dword [eax + esi*4]
mov ecx, edi
push edx
call fcn.00415ad0
inc esi
jmp 0x40ae20
push eax
call fcn.004a2a3d
mov ecx, dword [esp + 0x24]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 0xc
Function at 0x40cb70
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ac17e
push eax
mov dword fs:[0], esp
sub esp, 0x24c
lea eax, [esp + 4]
push ebx
push esi
push edi
mov ebx, ecx
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
push 0
lea ecx, [esp + 0x14]
push 1
lea edx, [esp + 0x198]
push ecx
push edx
call fcn.00488fc0
push 0x4c9020
push 0x4c901c
lea eax, [esp + 0x1a8]
push 0xc8
push eax
call fcn.00485a40
push 0x4c9020
push 0x4c9018
lea ecx, [esp + 0x1b8]
push 0xc8
push ecx
call fcn.00485a40
mov ecx, dword [ebx + 0x30]
push ecx
lea eax, [ecx + 1]
mov ecx, 0x1a
mov dword [ebx + 0x30], eax
cdq
idiv ecx
add edx, 0x41
push edx
lea edx, [esp + 0x58]
push str._c_d
push edx
call fcn.0047ac80
add esp, 0x40
lea eax, [esp + 0x190]
lea ecx, [esp + 0x20]
push 0x33
push eax
push ecx
call fcn.00486350
mov edi, dword [esp + 0x278]
add esp, 0xc
mov ecx, edi
call fcn.00414ce0
push eax
lea edx, [esp + 0x58]
push str.__d.dta
push edx
call fcn.0047ac80
push 0x105
lea eax, [esp + 0x98]
push str.mails_
push eax
call fcn.00486310
add esp, 0x18
mov ecx, edi
push 0x105
call fcn.00414d30
lea ecx, [esp + 0x8c]
push eax
push ecx
call fcn.00486350
lea edx, [esp + 0x60]
push 0x105
lea eax, [esp + 0x98]
push edx
push eax
call fcn.00486350
add esp, 0x18
lea ecx, [esp + 0x88]
push ecx
mov ecx, dword [esp + 0x274]
call fcn.0041c9c0
test al, al
je 0x40cddd
mov ecx, edi
call fcn.00414d10
push 0x250
call fcn.004a2a14
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
test esi, esi
mov dword [esp + 0x260], 0
je 0x40cd12
mov ecx, edi
call fcn.00414ce0
mov edx, dword [esp + 0x274]
push eax
lea eax, [esp + 0x8c]
push edx
lea ecx, [esp + 0x90]
push eax
push ecx
call fcn.00485360
add esp, 4
lea edx, [esp + 0x2c]
mov ecx, esi
push eax
push edx
call fcn.00440260
mov esi, eax
jmp 0x40cd14
xor esi, esi
mov eax, dword [esp + 0x278]
mov ecx, esi
push eax
mov dword [esp + 0x264], 0xffffffff
call fcn.00441870
mov ecx, dword [esp + 0x27c]
push ecx
mov ecx, esi
call fcn.004418b0
mov edx, dword [esp + 0x280]
mov ecx, esi
push edx
call fcn.004418d0
mov eax, dword [esp + 0x284]
mov ecx, esi
push eax
call fcn.00440450
mov ecx, dword [esp + 0x288]
push ecx
mov ecx, esi
call fcn.00440460
mov edx, dword [esp + 0x28c]
mov ecx, esi
push edx
call fcn.004418f0
mov eax, dword [esp + 0x290]
mov ecx, esi
push eax
call fcn.00441910
mov ecx, dword [esp + 0x294]
push ecx
mov ecx, esi
call fcn.00441890
push esi
mov ecx, edi
call fcn.00414a50
mov edx, dword [esp + 0x268]
push edi
push edx
push 0
mov ecx, ebx
call fcn.0040a530
test al, al
jne 0x40cdc7
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
xor al, al
jmp 0x40cddd
mov esi, dword [esp + 0x298]
test esi, esi
je 0x40cddb
mov ecx, edi
call fcn.00414ce0
mov dword [esi], eax
mov al, 1
mov ecx, dword [esp + 0x258]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x258
ret 0x34
Function at 0x40fe20
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4ac55b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x134
mov eax, dword [esp + 0x144]
push ebx
push str.___lastlogintime
push eax
lea edx, [esp + 0x38]
push 0x105
push edx
xor ebx, ebx
call fcn.0040c8d0
lea ecx, [esp + 0x20]
call fcn.00489cd0
lea eax, [esp + 0x30]
mov dword [esp + 0x140], ebx
push eax
call fcn.00485230
add esp, 4
test al, al
je 0x40fe8e
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
je 0x40ff19
push ebx
push 1
lea edx, [esp + 0x38]
push 1
push edx
lea ecx, [esp + 0x30]
call fcn.00489d20
test al, al
je 0x40ff19
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x150]
xor ecx, ecx
xor edx, edx
push 0x1c
mov cx, word [eax + 6]
mov dx, word [eax + 2]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
xor ecx, ecx
xor edx, edx
mov cx, word [eax]
mov dx, word [eax + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 0xa]
mov dx, word [eax + 0xc]
lea eax, [esp + 0xc]
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x10], 1
mov dword [esp + 0x28], edx
call fcn.00489f00
lea ecx, [esp + 0x24]
mov bl, al
call fcn.00489e00
pop edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x140], 0xffffffff
call fcn.00489d10
mov ecx, dword [esp + 0x138]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x140
ret 8
Function at 0x416af0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4acd2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd4
push ebx
push ebp
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0x48]
call fcn.00416d00
mov esi, dword [esp + 0xf8]
mov dword [esp + 0xec], 0
cmp esi, 0x40
jle 0x416b77
lea ecx, [esp + 0x48]
call fcn.00416d50
mov eax, dword [esp + 0xf4]
push esi
push eax
lea ecx, [esp + 0x50]
call fcn.00416d80
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x4c]
call fcn.00416e30
lea edx, [esp + 0x14]
mov dword [esp + 0xf8], 0x10
mov esi, dword [esp + 0xf8]
mov dword [esp + 0xf4], edx
lea edx, [ebx + 4]
mov ecx, 0x10
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
lea ebp, [ebx + 0x44]
mov ecx, 0x10
mov edi, ebp
mov dword [esp + 0x10], edx
rep stosd dword es:[edi], eax
mov ecx, esi
mov esi, dword [esp + 0xf4]
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xf8]
mov esi, dword [esp + 0xf4]
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dl, 0x36
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xffffffbc
sub ecx, ebx
mov bl, byte [eax - 0x40]
xor bl, dl
mov byte [eax - 0x40], bl
mov bl, byte [eax]
xor bl, 0x5c
mov byte [eax], bl
inc eax
lea esi, [ecx + eax]
cmp esi, 0x40
jl 0x416bd7
lea ecx, [esp + 0x48]
call fcn.00416d50
mov eax, dword [esp + 0x10]
push 0x40
push eax
lea ecx, [esp + 0x50]
call fcn.00416d80
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0xfc]
push ecx
push edx
lea ecx, [esp + 0x50]
call fcn.00416d80
lea eax, [esp + 0x14]
lea ecx, [esp + 0x48]
push eax
call fcn.00416e30
lea ecx, [esp + 0x48]
call fcn.00416d50
push 0x40
push ebp
lea ecx, [esp + 0x50]
call fcn.00416d80
lea ecx, [esp + 0x14]
push 0x10
push ecx
lea ecx, [esp + 0x50]
call fcn.00416d80
lea edx, [esp + 0x14]
lea ecx, [esp + 0x48]
push edx
call fcn.00416e30
mov byte [esp + 0x44], 0
xor esi, esi
lea edi, [esp + 0x24]
mov cl, byte [esp + esi + 0x14]
lea eax, [edi + 1]
push eax
push edi
push ecx
call fcn.00486640
add esp, 0xc
inc esi
add edi, 2
cmp esi, 0x10
jb 0x416c6d
mov ecx, dword [esp + 0x104]
lea edx, [esp + 0x24]
push edx
call fcn.004a371e
lea ecx, [esp + 0x48]
mov dword [esp + 0xec], 0xffffffff
call fcn.00416d40
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xe0
ret 0x14

Function at 0x416d50
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret
Function at 0x418550
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4ace3b
push eax
mov eax, 0x1090
mov dword fs:[0], esp
call fcn.0047aff0
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x80]
call fcn.0048d830
mov eax, dword [esp + 0x10b0]
xor ebx, ebx
push ebx
push ebx
push eax
lea ecx, [esp + 0x8c]
mov dword [esp + 0x10b4], ebx
call fcn.0048d8d0
test al, al
jne 0x4185c0
lea ecx, [esp + 0x80]
mov dword [esp + 0x10a8], 0xffffffff
call fcn.0048d880
xor al, al
jmp 0x418772
lea ecx, [esp + 0x80]
xor esi, esi
xor edi, edi
call fcn.0048dac0
test al, al
jne 0x418759
mov ebp, dword [esp + 0x10b4]
lea ecx, [esp + 0x13]
push ecx
lea ecx, [esp + 0x84]
call fcn.0048d940
test al, al
je 0x4186d8
mov eax, edi
sub eax, ebx
je 0x418644
dec eax
je 0x418621
dec eax
jne 0x418661
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x16]
mov dl, al
and al, 0x3f
shr dl, 6
or cl, dl
mov byte [esp + 0x17], al
mov byte [esp + 0x16], cl
xor edi, edi
jmp 0x418665
mov al, byte [esp + 0x13]
mov dl, byte [esp + 0x15]
mov cl, al
and al, 0xf
shr cl, 4
or dl, cl
mov edi, 2
shl al, 2
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], al
jmp 0x4186a4
mov al, byte [esp + 0x13]
mov edi, 1
mov dl, al
and al, 3
shr dl, 2
shl al, 4
mov byte [esp + 0x14], dl
mov byte [esp + 0x15], al
jmp 0x4186a4
cmp edi, ebx
jne 0x4186a4
mov eax, dword [esp + 0x14]
push eax
call fcn.00418510
mov ecx, dword [esp + 0x19]
mov byte [esp + esi + 0x20], al
push ecx
inc esi
call fcn.00418510
mov edx, dword [esp + 0x1e]
mov byte [esp + esi + 0x24], al
push edx
inc esi
call fcn.00418510
mov byte [esp + esi + 0x28], al
mov eax, dword [esp + 0x23]
push eax
inc esi
call fcn.00418510
add esp, 0x10
mov byte [esp + esi + 0x1c], al
inc esi
cmp esi, 0x4c
jl 0x4186c4
lea ecx, [esp + 0x1c]
push esi
push ecx
mov ecx, ebp
mov byte [esp + esi + 0x24], bl
call fcn.00485720
test al, al
je 0x4185a2
xor esi, esi
lea ecx, [esp + 0x80]
call fcn.0048dac0
test al, al
je 0x4185df
cmp edi, ebx
jle 0x418727
mov edx, dword [esp + 0x14]
push edx
call fcn.00418510
mov byte [esp + esi + 0x20], al
mov eax, dword [esp + 0x19]
push eax
inc esi
call fcn.00418510
add esp, 8
mov byte [esp + esi + 0x1c], al
inc esi
cmp edi, 1
jne 0x41870f
mov al, 0x3d
mov byte [esp + esi + 0x1c], al
inc esi
mov byte [esp + esi + 0x1c], al
jmp 0x418726
mov ecx, dword [esp + 0x16]
push ecx
call fcn.00418510
add esp, 4
mov byte [esp + esi + 0x1c], al
inc esi
mov byte [esp + esi + 0x1c], 0x3d
inc esi
cmp esi, ebx
jle 0x418759
lea edx, [esp + 0x1c]
push esi
push edx
mov ecx, ebp
mov byte [esp + esi + 0x24], bl
call fcn.00485720
lea ecx, [esp + 0x80]
mov bl, al
mov dword [esp + 0x10a8], 0xffffffff
call fcn.0048d880
mov al, bl
jmp 0x418772
lea ecx, [esp + 0x80]
mov dword [esp + 0x10a8], 0xffffffff
call fcn.0048d880
mov al, 1
mov ecx, dword [esp + 0x10a0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x109c
ret 8
Function at 0x41b8b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4ad164
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
push esi
inc eax
push edi
lea ecx, [ebp + 0x114]
mov dword [esp + 0x10], ebp
mov byte [ebp + 4], bl
mov dword [ebp + 8], eax
call fcn.0041ffe0
mov cl, byte [esp + 0x24]
mov dword [esp + 0x1c], ebx
mov byte [ebp + 0x228], cl
mov dword [ebp + 0x22c], ebx
mov dword [ebp + 0x230], ebx
mov dword [ebp + 0x234], ebx
lea ecx, [ebp + 0x238]
mov byte [esp + 0x1c], 1
call fcn.004853d0
lea ecx, [ebp + 0x65c]
mov byte [esp + 0x1c], 2
call fcn.004853d0
mov dl, byte [esp + 0x24]
mov al, byte [esp + 0x24]
mov byte [ebp + 0xaf8], dl
mov byte [ebp + 0xcfc], al
mov dword [ebp + 0xd00], ebx
mov dword [ebp + 0xd04], ebx
mov dword [ebp + 0xd08], ebx
mov cl, byte [esp + 0x24]
mov dword [ebp + 0xd10], ebx
mov byte [ebp + 0xd0c], cl
mov dword [ebp + 0xd14], ebx
mov dword [ebp + 0xd18], ebx
mov edi, str.No_Subject
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + 0xd1c], bl
mov byte [ebp + 0xd1d], 1
mov byte [ebp + 0xd1e], bl
mov byte [ebp + 0xd1f], bl
mov byte [ebp + 0xd20], bl
mov dword [ebp + 0xd24], ebx
mov dword [ebp], 0x4b50c0
mov byte [ebp + 0xc], bl
mov byte [ebp + 0xa80], bl
mov byte [ebp + 0xae4], bl
lea edx, [ebp + 0xaf9]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x1c], 5
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041d760
test al, al
je 0x41ba0b
lea esi, [ebp + 0xc]
mov byte [ebp + 4], 1
push esi
push ebx
push 0x4d83ac
push str.temp_
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
push ebx
push 1
push 1
push esi
lea ecx, [ebp + 0x238]
call fcn.00485470
test al, al
jne 0x41ba0b
mov byte [esi], bl
mov ecx, dword [esp + 0x14]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x41c4c0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4ad254
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x4b50c0
xor ebx, ebx
mov dword [esp + 0x20], 5
xor edi, edi
mov eax, dword [esi + 0x22c]
cmp eax, ebx
je 0x41c51f
mov ecx, dword [esi + 0x230]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x41c51f
mov edx, eax
mov ecx, dword [edx + edi*4]
cmp ecx, ebx
je 0x41c51c
mov eax, dword [ecx]
push 1
call dword [eax]
inc edi
jmp 0x41c4f4
mov ecx, dword [esi + 0x230]
mov edx, dword [esi + 0x22c]
cmp ecx, ecx
mov eax, ecx
je 0x41c53f
mov edi, dword [eax]
add eax, 4
mov dword [edx], edi
add edx, 4
cmp eax, ecx
jne 0x41c531
mov ecx, dword [esi + 0x230]
lea edi, [esi + 0x238]
mov dword [esp + 0x14], ecx
mov ecx, edi
mov dword [esi + 0x230], edx
call fcn.004854c0
lea ebp, [esi + 0x65c]
mov ecx, ebp
call fcn.004854c0
mov ecx, esi
call fcn.0041d630
test al, al
je 0x41c57e
lea edx, [esi + 0xc]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
cmp byte [esi + 4], bl
je 0x41c588
call fcn.0041d7c0
mov eax, dword [esi + 0xd10]
push eax
mov dword [esp + 0x18], eax
call fcn.004a2a3d
mov dword [esi + 0xd10], ebx
mov dword [esi + 0xd14], ebx
mov dword [esi + 0xd18], ebx
mov eax, dword [esi + 0xd00]
push eax
mov dword [esp + 0x1c], eax
call fcn.004a2a3d
add esp, 8
mov ecx, ebp
mov dword [esi + 0xd00], ebx
mov dword [esi + 0xd04], ebx
mov dword [esi + 0xd08], ebx
mov byte [esp + 0x20], 2
call fcn.00485420
mov ecx, edi
mov byte [esp + 0x20], 1
call fcn.00485420
mov eax, dword [esi + 0x22c]
push eax
mov dword [esp + 0x18], eax
call fcn.004a2a3d
add esp, 4
lea ecx, [esi + 0x114]
mov dword [esi + 0x22c], ebx
mov dword [esi + 0x230], ebx
mov dword [esi + 0x234], ebx
mov dword [esp + 0x20], 0xffffffff
call fcn.004200a0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x41c9c0
Capabilities:
Copy file

Disassembly:
push esi
mov esi, ecx
call fcn.0041d630
test al, al
je 0x41c9f1
mov ecx, esi
call fcn.0041cae0
test al, al
jne 0x41c9f1
mov eax, dword [esp + 8]
push 0
add esi, 0xc
push eax
push esi
call dword [sym.imp.kernel32.dll_CopyFileA]
test eax, eax
setne al
pop esi
ret 4
xor al, al
pop esi
ret 4
Function at 0x4211a0
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ad48b
push eax
mov eax, 0x1010
mov dword fs:[0], esp
call fcn.0047aff0
push ebx
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x14]
test al, al
jne 0x4212ef
lea ebx, [esi + 0x18]
mov ecx, ebx
call fcn.00489f60
test al, al
je 0x4212ef
mov edi, dword [esp + 0x1030]
push edi
call fcn.00485230
add esp, 4
test al, al
je 0x421213
mov al, byte [esp + 0x1034]
test al, al
je 0x4212ef
push edi
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
je 0x4212ef
lea ecx, [esp + 0xc]
call fcn.00489cd0
push 0
push 1
push 1
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1034], 0
call fcn.00489d20
test al, al
je 0x4212db
mov eax, dword [esi + 8]
mov edi, dword [esp + 0x102c]
mov eax, dword [eax + edi*4]
mov ecx, dword [eax + 0x108]
push ecx
mov ecx, ebx
call fcn.0048a280
test al, al
je 0x4212db
mov esi, dword [esi + 8]
mov edx, dword [esi + edi*4]
mov esi, dword [edx + 0x10c]
test esi, esi
jbe 0x4212c3
mov edi, dword [sym.imp.kernel32.dll_Sleep]
cmp esi, 0x1000
jbe 0x421288
lea eax, [esp + 0x1c]
push 0x1000
push eax
jmp 0x42128e
lea ecx, [esp + 0x1c]
push esi
push ecx
mov ecx, ebx
call fcn.00489e20
test eax, eax
jne 0x4212aa
mov ecx, ebx
call fcn.00489f70
test al, al
jne 0x4212db
push 2
call edi
jmp 0x4212bf
lea edx, [esp + 0x1c]
push eax
push edx
lea ecx, [esp + 0x14]
sub esi, eax
call fcn.00489f00
test al, al
je 0x4212db
test esi, esi
ja 0x421274
lea ecx, [esp + 0xc]
mov dword [esp + 0x1024], 0xffffffff
call fcn.00489d10
mov al, 1
jmp 0x4212f1
lea ecx, [esp + 0xc]
mov dword [esp + 0x1024], 0xffffffff
call fcn.00489d10
xor al, al
mov ecx, dword [esp + 0x101c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x101c
ret 0xc
Function at 0x429c20
Capabilities:
Get number of processors

Disassembly:
mov dword [ecx], 0x4b5ad4
jmp fcn.00492200
Function at 0x43f73b
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4aeecb
push eax
mov dword fs:[0], esp
sub esp, 0x424
push esi
mov esi, ecx
push str.key.dta
call fcn.00485230
add esp, 4
test al, al
je 0x43f75e
push str.key.dta
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
je 0x43f7db
lea ecx, [esp + 4]
call fcn.004853d0
push 0
push 1
push 1
push str.key.dta
lea ecx, [esp + 0x14]
mov dword [esp + 0x440], 0
call fcn.00485470
test al, al
je 0x43f7c7
add esi, 4
push ebx
push esi
lea ecx, [esp + 0xc]
call fcn.004856d0
lea ecx, [esp + 8]
mov bl, al
mov dword [esp + 0x434], 0xffffffff
call fcn.00485420
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x424]
mov dword fs:[0], ecx
add esp, 0x430
ret
lea ecx, [esp + 4]
mov dword [esp + 0x430], 0xffffffff
call fcn.00485420
mov ecx, dword [esp + 0x428]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x430
ret
Function at 0x441ae0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4af029
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x4b5c04
lea ecx, [esi + 0x30]
mov dword [esp + 0x10], 0xa
call fcn.004a3625
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 9
call fcn.004a3625
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 8
call fcn.004a3625
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 7
call fcn.004a3625
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 6
call fcn.004a3625
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 5
call fcn.004a3625
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 4
call fcn.004a3625
lea ecx, [esi + 0x14]
mov byte [esp + 0x10], 3
call fcn.004a3625
lea ecx, [esi + 0x10]
mov byte [esp + 0x10], 2
call fcn.004a3625
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 1
call fcn.004a3625
lea ecx, [esi + 8]
mov byte [esp + 0x10], 0
call fcn.004a3625
lea ecx, [esi + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.004a3625
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret