joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dba8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44dbbf
add esp, 0xfffffff0
call fcn.00403408
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041c8d4
mov eax, dword [0x453ff8]
cmp word [eax + 2], 0
jne 0x44dbe7
mov eax, dword [0x453ff8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044f0fc
mov eax, dword [0x4540a4]
cmp word [eax + 2], 0
jne 0x44dc01
mov eax, dword [0x4540a4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044f2f4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.004030cc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.004030cc
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41f130]
call fcn.00424d78
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44dd88
mov eax, dword [0x453f14]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00425148
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44f894
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x453f14]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c528
test eax, eax
je 0x44dcf6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004087b8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c550
test eax, eax
je 0x44dd0a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004040a4
mov eax, dword [0x453e04]
cmp byte [eax], 0
jne 0x44dd3e
mov eax, ebx
call fcn.0044deb0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044fa70
mov eax, ebx
call fcn.00450434
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44dd7e
call fcn.00403460
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e130
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x455bb4]
cmp dword [eax + 0x30], 0
je 0x44e1da
cmp dword [ebx + 0x94], 0
jne 0x44e1d4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44e0c0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44e1d4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44e19a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44e1d4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00416f34
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44e1a9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44ed3c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44ed71
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f24
jmp 0x44ed7e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403e88
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44fc4c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44fc8d
mov eax, esi
call fcn.0043679c
test al, al
je 0x44fc8d
mov eax, dword [ebx + 0x84]
call fcn.0043653c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44fc8d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043653c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4010e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
xchg edi, esi
push esi
mov edi, edi
push edi
mov eax, ebx
push eax
push ebp
call fcn.00401283
mov esi, eax
mov dword [ebp - 0xc], esi
sub esi, 0xc0000135
and dword [ebp - 0x18], esi
and dword [ebp - 4], esi
clc
xor ecx, ecx
mov ebx, ecx
mov ebx, dword [ebp - 0xc]
add ebx, 0x40447769
push ebx
mov ebx, dword [esp]
add esp, 4
xor ebx, 0xffffffff
inc ebx
sub esi, ebx
add esi, dword [ebp - 0x18]
mov dword [ebp - 0xc], esi
mov eax, ebp
xor esi, esi
or esi, 0x2a8
sub esi, 0x100
neg esi
add eax, esi
mov dword [ebp - 0x10], eax
xor esi, esi
sub esi, section..data
neg esi
mov dword [ebp - 0x28], 0
xor dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x10]
mov edx, 0xfffffff0
sub eax, edx
mov dword [ebp - 0x1c], eax
sub dword [ebp - 4], 0x30
xor eax, eax
dec eax
not dword [ebp - 4]
sub dword [ebp - 4], eax
push dword [ebp - 0x28]
push dword [ebp - 4]
push dword [ebp - 0xc]
lea ebx, [ebp - 0x1a8]
push ebx
call fcn.00401235
xor edi, edi
or edi, dword [ebp - 0x10]
add edi, 4
mov edi, dword [edi]
mov esi, dword [ebp - 0x10]
add edi, dword [esi]
mov dword [ebp - 0x24], edi
mov edi, 0x40
push edi
and dword [ebp - 0x18], 0
mov edx, 0x3000
push edx
lea edx, [ebp - 0x24]
push edx
push 0
xor edx, edx
mov dword [ebp - 0x20], edx
lea edx, [ebp - 0x20]
push edx
push 0xffffffffffffffff
call sub.NTDLL.dll_NtAllocateVirtualMemory
mov edx, dword [ebp - 0x20]
mov dword [ebp - 8], edx
mov dword [ebp - 0x20], 0x400000
and dword [ebp - 0x1ac], 0
jmp 0x4011f1
mov ebx, dword [ebp - 0x1ac]
inc ebx
mov dword [ebp - 0x1ac], ebx
mov edi, dword [ebp - 0x1c]
add edi, 8
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x1ac]
mov eax, dword [edi + 8]
cmp ebx, eax
jae 0x401243
push dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
push dword [ecx + 4]
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add ecx, dword [esi]
push ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x18]
push edx
call fcn.0040122d
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add edx, dword [esi + 4]
mov dword [ebp - 0x18], edx
jmp 0x4011db
mov ecx, dword [ebp - 0x20]
push ecx
mov ebx, dword [ebp - 8]
mov edx, 0x1530
add ebx, edx
mov dword [ebp - 0x14], ebx
xor edi, edi
or edi, dword [ebp - 0x19c]
push edi
and esi, 0
or esi, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
add edx, dword [esi + 4]
push edx
xor edx, edx
or edx, dword [ebp - 0x14]
push edx
add edx, 0x7480000
push edx
mov ecx, dword [ebp - 0x14]
push ecx
ret 4
Function at 0x10034cd
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x420]
push eax
push 0x2001f
xor esi, esi
push esi
push dword [0x1008018]
mov dword [ebp - 0x420], esi
push 0x80000002
mov dword [ebp - 0x430], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1003641
push ebx
mov dword [ebp - 0x424], esi
mov ebx, 0x20a
push ebx
lea eax, [ebp - 0x210]
push esi
push eax
mov dword [ebp - 0x42c], 0x104
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x424]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, esi
jne 0x100361b
lea eax, [ebp - 0x430]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x100361b
push ebx
lea eax, [ebp - 0x41c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x434]
push eax
push esi
push dword [0x1008020]
mov dword [ebp - 0x434], esi
push dword [ebp - 0x430]
mov dword [ebp - 0x42c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x430]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x1003619
cmp dword [ebp - 0x434], 1
jne 0x1003619
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100362b
xor edi, edi
inc dword [ebp - 0x424]
cmp edi, esi
je 0x100352f
jmp 0x1003640
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x420]
call fcn.01003359
mov edi, eax
pop ebx
cmp dword [ebp - 0x420], esi
je 0x100365e
cmp dword [ebp - 0x420], 0xffffffff
je 0x100365e
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x1003678
push dword [ebp - 0x428]
push esi
push 0x323
call fcn.010042a0
add esp, 0xc
jmp 0x100368e
push edi
push dword [ebp - 0x428]
push 2
push 0x324
call fcn.010042a0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01003c92
leave
ret 4
Function at 0x100388b
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push edi
push edi
push 0x100
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
push 0x1008110
push 0x1008118
push 0x10031e5
push 0x100119c
call fcn.0100323c
cmp dword [ebp + 8], 2
je 0x10038de
push 0x1a0
push 0x191
call fcn.010043e3
jmp 0x10039db
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [eax + 4]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
je 0x1003911
cmp eax, 2
jb 0x10039b5
movzx ecx, word [esi]
push 0x2d
pop edx
cmp cx, dx
je 0x100390a
cmp cx, 0x2f
jne 0x1003925
cmp word [esi + 2], 0x3f
jne 0x1003925
push 0x1a0
push 0x191
call fcn.010043e3
jmp 0x10039da
cmp eax, 4
jbe 0x10039b5
cmp cx, dx
je 0x1003939
cmp cx, 0x2f
jne 0x100395b
movzx eax, word [esi + 2]
cmp ax, 0x4d
je 0x1003949
cmp ax, 0x6d
jne 0x100395b
cmp word [esi + 4], 0x3a
jne 0x100395b
add esi, 6
push esi
call fcn.01003704
jmp 0x10039d8
cmp cx, dx
je 0x1003966
cmp cx, 0x2f
jne 0x1003988
movzx eax, word [esi + 2]
cmp ax, 0x47
je 0x1003976
cmp ax, 0x67
jne 0x1003988
cmp word [esi + 4], 0x3a
jne 0x1003988
add esi, 6
push esi
call fcn.01003453
jmp 0x10039d8
cmp cx, dx
je 0x1003993
cmp cx, 0x2f
jne 0x10039b5
movzx eax, word [esi + 2]
cmp ax, 0x50
je 0x10039a3
cmp ax, 0x70
jne 0x10039b5
cmp word [esi + 4], 0x3a
jne 0x10039b5
add esi, 6
push esi
call fcn.010034cd
jmp 0x10039d8
push 0x1001238
push edi
call dword [sym.imp.msvcrt.dll_setlocale]
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push edi
push eax
call dword [sym.imp.loadperf.dll_UnloadPerfCounterTextStringsW]
mov edi, eax
pop esi
push 0x1008110
call fcn.01003268
mov eax, edi
pop edi
pop ebp
ret
Function at 0x1003c83
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10074b0
call fcn.01003e34
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10084c4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1003a98
cmp eax, esi
jne 0x1003a8b
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1003a9b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003a72
xor esi, esi
inc esi
mov eax, dword [0x10084c0]
cmp eax, esi
jne 0x1003aae
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1003ae9
mov eax, dword [0x10084c0]
test eax, eax
jne 0x1003ae3
mov dword [0x10084c0], esi
push 0x1001174
push 0x1001168
call fcn.010039ef
pop ecx
pop ecx
test eax, eax
je 0x1003ae9
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1003bb3
mov dword [0x1008164], esi
mov eax, dword [0x10084c0]
cmp eax, esi
jne 0x1003b0d
push 0x1001164
push 0x100115c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10084c0], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1003b1a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10084c8], ebx
je 0x1003b3b
push 0x10084c8
call fcn.01003da9
pop ecx
test eax, eax
je 0x1003b3b
push ebx
push 2
push ebx
call dword [0x10084c8]
push dword [0x100814c]
push dword [0x1008150]
push dword [0x1008148]
call fcn.0100388b
add esp, 0xc
mov dword [0x1008160], eax
cmp dword [0x1008154], ebx
jne 0x1003b99
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1008164], ebx
jne 0x1003ba7
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1008160]
call fcn.01003e79
ret
call fcn.01003f81
jmp 0x1003a50
Function at 0x10041ae
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
je 0x1004206
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 2
jne 0x1004206
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
xor esi, esi
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10041e3
push esi
sub eax, edx
lea ecx, [ebp - 0x10]
push ecx
sar eax, 1
push eax
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1004295
push ebx
push dword [ebp + 8]
call fcn.01004121
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor esi, esi
mov dword [ebp - 8], eax
cmp eax, esi
je 0x100427d
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push eax
push esi
push 1
call edi
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x100427d
push eax
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x100427d
push esi
push esi
push dword [ebp - 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp - 8]
push esi
push 1
call edi
cmp eax, esi
je 0x1004270
push esi
lea ecx, [ebp - 0x10]
push ecx
dec eax
push eax
push dword [ebp - 4]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 8]
cmp dword [ebp + 8], eax
je 0x1004294
cmp eax, esi
je 0x1004294
push eax
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x1005aed
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
lea edx, [ebp - 0x218]
push edx
push 0x2000000
xor esi, esi
push esi
push ecx
push eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1005bde
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
push esi
push esi
push esi
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1005bc0
push ebx
push edi
mov ebx, 0x20a
push ebx
lea eax, [ebp - 0x210]
push esi
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x1005b9b
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call fcn.01005aed
test eax, eax
jne 0x1005bbe
push ebx
push eax
lea eax, [ebp - 0x210]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
dec dword [ebp - 0x214]
push edi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
push dword [ebp - 0x218]
call esi
test eax, eax
je 0x1005b77
pop edi
pop ebx
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x21c]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01003c92
leave
ret 8
Function at 0x10004715
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
leave
ret
Function at 0x10034b60
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x100b457b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.100a836c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x10034be2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.100a53f7
mov eax, dword [eax]
push 0x100da224
push eax
call fcn.10097d84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.100a85f7
test bl, bl
je 0x10034be2
push 0x100da224
lea ecx, [esp + 0xc]
call fcn.100a8987
push 0x100ddd9c
lea ecx, [esp + 0xc]
call fcn.100a8987
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x10034c1e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.100a85f7
jmp 0x10034ce9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x10034ca2
lea edx, [esp + 0x7c]
push 0x100ddd98
push edx
call fcn.10097d84
add esp, 8
test eax, eax
je 0x10034ca2
lea eax, [esp + 0x7c]
push 0x100ddd94
push eax
call fcn.10097d84
add esp, 8
test eax, eax
je 0x10034ca2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10034c32
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.100a85f7
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x10035500
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x10035562
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x10035570
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x100b45fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x100e6058]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x100356a8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x100355d6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.100a85f7
xor eax, eax
jmp 0x1003571f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.100a8734
push esi
lea ecx, [esp + 0xc]
call fcn.100a89c3
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x100356fd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.10035500
test eax, eax
jne 0x100356fd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.10035500
test eax, eax
jne 0x100356fd
lea eax, [esp + 0x14]
push 0x100dddb0
push eax
call fcn.10098dc0
mov esi, eax
add esp, 8
test esi, esi
jne 0x100356dc
lea ecx, [esp + 0x14]
push 0x100dddac
push ecx
call fcn.10098d40
mov esi, eax
add esp, 8
test esi, esi
jne 0x100356dc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x100356df
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.100a86e4
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x100355ee
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.100a85f7
xor eax, eax
jmp 0x1003571f
mov byte [esi], 0
push 0x100ddda8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.100a85f7
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4