joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4402c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46f1d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.00468020
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0043fc60
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00467f4e
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.00464814
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.00464814
push 1
push 0
push 0
mov ecx, esi
call fcn.004647bc
push 1
push 0
push 1
mov ecx, esi
call fcn.004647bc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00468092
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x440440
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46f1f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00468020
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0043fc60
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00467f4e
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x440504
cmp dword [esp + 0x40], 1
jne 0x440502
cmp ecx, eax
jge 0x440504
mov eax, ecx
cmp eax, 0xc8
jge 0x440510
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.004402c0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00468092
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x440c80
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46f263
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00462c30
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004682c8
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004697e4
test eax, eax
je 0x440d9c
mov ecx, dword [esp + 0x3c]
call fcn.004682f5
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x440d60
push edi
mov ecx, esi
call fcn.0046595f
mov ecx, esi
call fcn.00440f00
cmp dword [esp + 0x38], 1
jne 0x440d95
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00465a9a
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x4437c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4437f3
push esi
call fcn.004468d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4437ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x443879
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x443862
mov eax, dword [esi + 8]
test eax, eax
je 0x443817
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44385e
cmp eax, 2
je 0x443862
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44380a
cmp eax, 3
je 0x44383d
cmp eax, 1
jne 0x44380a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44380a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44380a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004438a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x443888
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004438a0
add esp, 4
pop esi
ret

Function at 0x463a25
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x463a5d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00461adc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00461ab4
jmp 0x463a69
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46511c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46515e
call fcn.0046abcf
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46515e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x465155
xor eax, eax
jmp 0x465166
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046516c
pop edi
pop esi
pop ebx
ret 4

Function at 0x46b0ff
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46b12d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46b14b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046b065
jmp 0x46b14b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46b14b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046b065
test edi, edi
mov eax, edi
jne 0x46b135
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1106147
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x1106152
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x1106204
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1138178]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1138178]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1138178]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1138178]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1138178]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1138178]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1138178]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x1138178]
inc ecx
sub edi, 8
dec esi
jne 0x1106169
pop ebx
test edi, edi
je 0x110621d
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x1138178]
inc ecx
dec edi
jne 0x1106208
pop esi
not eax
pop edi
ret

Function at 0x1106222
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x1138178]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x1138178]
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x40899c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jbe 0x40b715
cmc
cmp bl, bl
pushfd
jmp 0x40a515
mov esi, dword [esi + 4]
stc
cmc
cmp al, dl
push dword [esp]
test esi, esi
push 0x5a17d0a3
pushal
pushfd
pushfd
lea esp, [esp + 0x34]
jmp 0x40a21c

Function at 0x408ddd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], bx
lea esp, [esp + 8]
je 0x40a93f
jmp 0x40cd3f
jmp 0x408bd4

Function at 0x408e67
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0040aa16
test eax, eax
mov byte [esp], 0xd4
pushal
mov word [esp + 8], bp
jmp 0x40d29f
lea esp, [esp + 0x24]
jne 0x40b715
test ch, cl
cmp word [esi], ax
push edx
mov byte [esp], 0xb0
lea esp, [esp + 4]
jbe 0x40b715
cmc
mov esi, dword [esi + 4]
stc
call fcn.00409a3b

Function at 0x408f41
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub edi, edi
pushal
jmp 0x409796
cmc
mov dword [esp + 0x1c], 0x10
bt eax, 0x1b
cmp esp, 0x7a9b86a6
mov byte [esp], ah
xor edi, edi
push dword [esp + 8]
push dword [esp]
mov dword [esp + 0x20], 0x40a976
pushal
mov byte [esp + 0x14], 0xca
mov dword [esp + 0x3c], ebx
mov byte [esp + 4], ah
pushfd
mov byte [esp], 0x65
push dword [esp + 0x40]
ret 0x44
lea esp, [esp + 0xc]
je 0x40bda1
shld ax, di, cl
lea eax, [esp + 0x14]
shl ecx, 0x13
rol ch, cl
movzx ecx, dl
push eax
not cx
rcl cl, 3
sbb ecx, eax
bsf cx, di
push 0x14
shrd cx, dx, cl
btc cx, ax
lea ecx, [esi - 0x3eed2ee5]
lea ecx, [esp + 0x78]
cmc
pushfd
sub esp, 0xfffffffc
jle 0x4093db
pushfd
mov dword [esp], ecx
cmc
push 0x10
jmp 0x40a8f1
pushal
cmp si, 0xd3b0
test cl, ah
stc
mov dword [esp + 0x1c], ecx
push dword [esp]
jmp 0x408cfa
push 0x869f3ba7
pushfd
mov dword [esp + 0x24], 0x40b0a6
pushal
mov dword [esp + 0x40], ebx
pushfd
push dword [esp + 4]
push dword [esp + 0x48]
ret 0x4c
test al, cl
jmp 0x4088a7

Function at 0x409806
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x44], eax
call fcn.0040bcc0
mov dword [esp + 0x28], ebx
pushfd
mov ebx, 0x401c4c
push 0x8965b0e6
mov dword [esp], 0x970e457b
call fcn.0040d3a0

Function at 0x40982a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x9d4e22d8
jmp 0x40d227
nop
push 0xfb44b303
push dword [esp]
xchg dword [esp + 0xc], edx
pop edx
mov edx, 0x401839
mov byte [esp + 4], 0x90
pushal
mov edx, dword [edx + 0xb136]
push edi
lea edx, [edx - 0x72cf3c39]
push 0xd97b7198
call fcn.0040c948
jmp 0x40b911

Function at 0x409975
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ch, bl
pushfd
mov ecx, dword [esp + 0x90]
clc
clc
sub esp, 0xffffffe8
xor ecx, esp
pushfd
pushal
lea esp, [esp + 0x24]
call fcn.0040148b
jmp 0x409a46
lea esp, [esp + 4]
call fcn.00408f9f
test bp, 0x31c3
push 0x4629f8a0
xor eax, eax
bt di, 2
movsx si, dl
sub esi, 0x8f060ba3
rol si, 0xa
mov edi, dword [esp + 4]
adc ch, bh
mov esi, dword [esp + 8]
bts cx, cx
sub bh, cl
clc
not bh
mov ebx, dword [esp + 0xc]
pushfd
jmp 0x408dbc
mov dword [esp], edi
pushfd
mov word [esp], 0xa1b7
jmp 0x409428
Function at 0x40a216
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0040b172
test esi, esi
lea esp, [esp + 8]
push 0xa2e73075
lea esp, [esp + 4]
je 0x40b715
pushfd
setno ch
setb cl
not cx
mov ecx, dword [esp + 0x34]
jmp 0x4084de
mov byte [esp], bl
nop
pushal
pushfd
lea esp, [esp + 0x44]
jmp fcn.0040138a
pushal
jmp 0x40abff

Function at 0x40a4ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jne 0x4013a8
push eax
push dword [esp]
nop
push ebp
push 0x6178ca24
push edx
lea esp, [esp + 0x14]
jmp fcn.0040138a

Function at 0x40a5c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], edx
call fcn.0040d538

Function at 0x40a6ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov byte [esp + 8], cl
xchg dword [esp + 0x44], ebp
pushfd
pushfd
push dword [esp + 0x4c]
ret 0x50
lea esp, [esp + 0xc]
je 0x40a93f
jmp 0x40c7e2
push 0x8000
call fcn.004096af
pushal
pushfd
mov word [esp + 8], 0x524f
lea ebp, [ebp - 0x617b1d80]
jmp 0x409580

Function at 0x40a738
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushal
push 0xfd989b7
nop
call fcn.0040d6bb
jmp 0x40a209

Function at 0x40af04
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
push edi
lea esp, [esp + 0x3c]
jbe 0x40b715
stc
call fcn.0040c3c2

Function at 0x40afb1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
pushfd
call fcn.0040c99c
xor eax, 0x6683b0d9
bswap ebx
lea esp, [esp + 8]
je 0x40b715
pushal
bswap ecx
lea ecx, [edi + 0x65755837]
mov ecx, 0x2ccff335
mov ecx, dword [esp + 0x50]
pushal
lea esp, [esp + 0x40]
jo 0x409152
push ecx
push ebp
mov byte [esp], bh
jmp 0x40b504

Function at 0x40b096
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [eax + 0x691b]
call fcn.0040d248
mov dword [esp + 0x10], eax
pushfd
lahf
mov eax, 0x401b47
jmp 0x40a934

Function at 0x40b222
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push dword [esp]
pushfd
nop
mov byte [esp + 4], 0xc1
lea esp, [esp + 0xc]
jmp fcn.00401283
call fcn.0040ade1
jmp 0x408e53
cmp eax, esi
jmp 0x40cedb
call fcn.0040c53b
test bp, 0x6d17
cmc
stc
push edx
add dword [esp + 0x18], 0x1000
push esi
test edi, edi
pushfd
lea esp, [esp + 0xc]
je 0x409a36
jmp 0x40cfc8
pushal
lea esp, [esp + 0x28]
je 0x40a93f
call fcn.00409ff8
cmc
cmp eax, 0xc0000004
push 0xfb09c360
mov byte [esp], 0x57
pushfd
mov word [esp], 0x5191
lea esp, [esp + 8]
je 0x40cbe3
call fcn.0040bb08
lea eax, [eax + 0x7e3e1d16]
pushal
xchg dword [esp + 0x24], eax
pushal
push dword [esp + 8]
mov dword [esp + 8], 0x23b276ec
mov byte [esp], 0xd9
push dword [esp + 0x48]
ret 0x4c
push 0x8000
call fcn.0040d4c4
push 0x6266ab0c
lea esp, [esp + 0x24]
je 0x40bda1
aaa
movsx cx, cl
rol al, cl
add ah, bl
lea eax, [esp + 0x14]
movzx cx, al
shr cl, 1
btr cx, 0xe
push eax
cmc
sal ch, 5
push 0x14
movzx cx, bl
lea ecx, [esp + 0x78]
pushal
mov dword [esp + 0x1c], ecx
pushal
mov dword [esp + 0x38], 0x10
stc
test cl, al
stc
xor edi, edi
call fcn.0040c973
push dword [esp + 0xc]
push 0x4f6a2ec1
mov dword [esp + 0x4c], 0xc0000000
jmp 0x40beff
Function at 0x40b646
Capabilities:
Execute anti-debugging instructions

Disassembly:
nop
pushfd
lea esp, [esp + 8]
jmp fcn.0040138a
jmp 0x409111

Function at 0x40b70b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
jne 0x4013a8

Function at 0x40b941
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add eax, eax
movzx edx, word [edi + eax*8 + 0xa]
lea eax, [edi + eax*8 + 4]
mov eax, dword [eax + 8]
push edx
push eax
push ecx
call fcn.004010a0
add esp, 0xc
mov edx, dword [esp + 0x28]
push edx
push edi
call fcn.0040ae03
push 0x8000
push 0
push edi
call fcn.0040c5f7
enter 0xffffffffffff8c8b, 0x24
test byte [eax], al
add byte [eax], al
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040148b
mov esp, ebp
pop ebp
ret
push 0x7851d669
jmp 0x40d931
add esp, 0xc
pushal
bt cx, sp
test eax, eax
lea esp, [esp + 0x20]
jb 0x408982
pushfd
mov byte [esp], 0x5d
pushfd
lea esp, [esp + 8]
jne 0x4013a8
push ebx
pushal
pushal
nop
mov byte [esp + 0xc], bh
push dword [esp + 4]
lea esp, [esp + 0x48]
jmp fcn.0040138a
push dword [esp]
call fcn.0040a4ae
push eax
invalid

Function at 0x40cd51
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushfd
pushfd
lea esp, [esp + 0x2c]
jne 0x40b715
pushfd
cmp word [esi], ax
pushfd
push 0x64cdfe86
pushfd
lea esp, [esp + 0x10]
jbe 0x40b715
test edx, edi
mov esi, dword [esi + 4]
cmc
cmc
test esi, esi
pushfd
mov word [esp], 0xbe91
mov byte [esp], cl
lea esp, [esp + 4]
jmp 0x40a21c

Function at 0x40cddc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push eax
lea esp, [esp + 0x28]
je 0x40a93f
pushal
mov word [esp + 4], 0x4f9
push 0x2a64f31
mov dword [esp + 0x20], 0x8000
call fcn.0040b363
push dword [esp]
pushal
lea esp, [esp + 0x2c]
je 0x40cbe3
cmp cl, ch
stc
bt edx, ecx
cmp bh, dl
sub esi, esi
cmc
pushal
cmp eax, esi
jmp 0x4091b1

Function at 0x40d3c6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov byte [esp], dl
jmp 0x40980f

Function at 0x40d3e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x30]
je 0x40a93f
push 0x8ee1d5e2
pushal
mov dword [esp + 0x20], 0x8000
mov word [esp + 4], si
mov byte [esp + 0x10], al
pushfd
push 0xa5baf78d
mov dword [esp + 0x24], esi
pushfd
pushfd
call fcn.0040a191

Function at 0x40d624
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x28], esi
jmp 0x40ac7b
pushal
xchg dword [esp + 0x28], esi
pushfd
jmp 0x409314
jmp 0x409844

Function at 0x40d881
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
push dword [esp]
pushal
cmp eax, 0xc0000004
mov dword [esp], 0xb5a83189
lea esp, [esp + 0x28]
je 0x40cbe3
cmp ebp, 0x264e3036
jmp 0x40d35f
Function at 0x40e360
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4788fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046b4fc
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40e3e2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00468e1a
mov eax, dword [eax]
push 0x598220
push eax
call fcn.0045b924
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046b787
test bl, bl
je 0x40e3e2
push 0x598220
lea ecx, [esp + 0xc]
call fcn.0046bb63
push 0x59bd88
lea ecx, [esp + 0xc]
call fcn.0046bb63
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40e41e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046b787
jmp 0x40e4e9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40e4a2
lea edx, [esp + 0x7c]
push 0x59bd84
push edx
call fcn.0045b924
add esp, 8
test eax, eax
je 0x40e4a2
lea eax, [esp + 0x7c]
push 0x59bd80
push eax
call fcn.0045b924
add esp, 8
test eax, eax
je 0x40e4a2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e432
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046b787
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40f760
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40f7c2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40f7d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x478a5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5a2cf8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40f908
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40f836
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046b787
xor eax, eax
jmp 0x40f97f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046b910
push esi
lea ecx, [esp + 0xc]
call fcn.0046bb9f
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40f95d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040f760
test eax, eax
jne 0x40f95d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040f760
test eax, eax
jne 0x40f95d
lea eax, [esp + 0x14]
push 0x59bd9c
push eax
call fcn.0045ca00
mov esi, eax
add esp, 8
test esi, esi
jne 0x40f93c
lea ecx, [esp + 0x14]
push 0x59bd98
push ecx
call fcn.0045c980
mov esi, eax
add esp, 8
test esi, esi
jne 0x40f93c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40f93f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046b8c0
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40f84e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046b787
xor eax, eax
jmp 0x40f97f
mov byte [esi], 0
push 0x59bd94
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046b787
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4