joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40a60b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40a61a
pop dword [ebp - 0x10]
mov eax, 0x40a61a
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xfb1cfaab
sub dword [ebp - 0x20], 0xaccab560
mov dword [ebp - 0x1c], 0xca9f5ee1
add dword [ebp - 0x1c], 0x6793ed64
mov dword [ebp - 0x18], 0x980c454
add dword [ebp - 0x18], 0x42cb7fda
mov dword [ebp - 0x14], 0x28b24617
sub dword [ebp - 0x14], 0x28b24617
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x34d758c1
sub dword [ebp - 0x20], 0xc064ef6b
mov dword [ebp - 0x1c], 0x8597ed45
sub dword [ebp - 0x1c], 0x442b8bd0
mov dword [ebp - 0x18], 0x1908df16
sub dword [ebp - 0x18], 0xb59972aa
mov dword [ebp - 0x14], 0xdf8c38e5
add dword [ebp - 0x14], 0x2073c71b
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3911c
push 0
call eax
mov ecx, 0x44cc
xor ebx, ebx
add ebx, eax
mov edi, 0xfb6a298c
add edi, 0x4d78674
add edi, dword [ebp - 0x10]
mov edx, 0x7aa46a98
sub edx, 0xbfb3c0b6
sub dword [ebp - 8], 0x620ba49d
mov esi, dword [edi]
xor dword [ebp - 4], edi
sub esi, edx
xor dword [ebp - 4], 0x47da20b6
mov dword [ebx], esi
add dword [ebp - 0xc], eax
add ebx, 0x6072542f
add ebx, 0x9f8dabd5
add edi, 0x8bbb4b1b
add edi, 0x7444b4e9
loop 0x40a729
add eax, 0x528f5993
add eax, 0xad71ac70
mov ebx, eax
add eax, 5
mov ecx, 0x16ed8483
add ecx, 0xe9527b7d
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48d030]
jne 0x401073
repz ret
jmp fcn.00401e41

Function at 0x408aeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d3a
and dword [ebp - 4], 0
cmp dword [0x48fb68], 0
mov ebx, eax
jne 0x408b9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c4d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c4d
push eax
call fcn.00404cc8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48fb68], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48fb6c], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48fb70], eax
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x48fb78], eax
test eax, eax
je 0x408b9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x48fb74], eax
mov eax, dword [0x48fb74]
cmp eax, ebx
je 0x408bf4
cmp dword [0x48fb78], ebx
je 0x408bf4
push eax
call fcn.00404d43
push dword [0x48fb78]
mov esi, eax
call fcn.00404d43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408bf4
test edi, edi
je 0x408bf4
call esi
test eax, eax
je 0x408beb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408beb
test byte [ebp - 0xc], 1
jne 0x408bf4
or dword [ebp + 0x10], 0x200000
jmp 0x408c2d
mov eax, dword [0x48fb6c]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c2d
mov eax, dword [0x48fb70]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48fb68]
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af50
Capabilities:
Set console window title

Disassembly:
sub esp, 0x820
mov eax, dword [0x48d030]
xor eax, esp
mov dword [esp + 0x81c], eax
mov eax, dword [0x2c6d55c]
push ebx
mov ebx, dword [0x2c6d280]
push esi
mov esi, dword [0x48df60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40af91
push 0x48bd34
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2c6d55c]
mov dword [0x48fd0c], esi
cmp eax, 0x114e
jne 0x40afbb
lea eax, [esp + 0xc]
push eax
push str.Gijetuhe_batawuwafadis_fomikayemes_zeruru
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x2c6d55c]
cmp eax, 0x2f
jne 0x40afdb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
call fcn.0040ae50
mov ecx, dword [esp + 0x828]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401069
add esp, 0x820
ret
Function at 0x10002580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x100025d8
cmp byte [esi + ebx - 1], 0xa
je 0x100025ac
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10005128], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000903d
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x100210e4]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 4]
or eax, 0x2001f
mov dword [esp + 0x10], ebx
push eax
push ecx
push dword [edi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.10009402
mov esi, eax
test esi, esi
je 0x100090a3
cmp dword [esp + 0xc], ebx
je 0x1000909c
push dword [esp + 0xc]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
jmp 0x10009132
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
mov ebx, dword [sym.imp.advapi32.dll_RegEnumKeyExW]
jmp 0x100090e7
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.10009402
mov esi, eax
test esi, esi
jne 0x10009149
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x28]
mov dword [esp + 0x38], 0x100
call ebx
test eax, eax
je 0x100090be
cmp dword [esp + 0xc], 0
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
je 0x10009111
push dword [esp + 0xc]
call esi
and dword [esp + 0xc], 0
push dword [esp + 0x1c]
and dword [esp + 0x14], 0
mov ecx, edi
call fcn.10009402
cmp dword [esp + 0xc], 0
mov edi, eax
je 0x10009130
push dword [esp + 0xc]
call esi
mov eax, edi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10015027
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0xc], 0
jmp 0x10009090

Function at 0x10009402
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10009411
pop dword [ebp - 0x48]
mov eax, 0xf55c95a3
sub eax, 0xe55c0192
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3cda7
push 0
mov eax, 0x38c2d529
sub eax, 0x28c153d9
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x6e660b5e
add ecx, 0x919a4912
xor edx, edx
add edx, eax
mov esi, 0x2936eec7
sub esi, 0x193438c7
add esi, dword [ebp - 0x48]
mov ebx, 0x8f86e3c9
sub ebx, 0x385ae4e0
xor dword [ebp - 4], 0xf0c27bf2
mov edi, dword [esi]
xor dword [ebp - 0x1c], 0x7bfcdd0b
xor edi, ebx
xor dword [ebp - 0x24], 0x8f613615
mov dword [edx], edi
sub dword [ebp - 4], ebx
add edx, 0x23634eff
add edx, 0xdc9cb105
add esi, 4
loop 0x10009472
add eax, 0x1eb658b3
add eax, 0xe14aebe0
mov ebx, eax
add eax, 0x34ac364c
sub eax, 0x34ac3647
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10009bdc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10016eb8
call fcn.100165db
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10009c59
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x10009c59
call fcn.1000836f
mov esi, eax
jmp 0x10009d5f
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x10009c7c
call fcn.1000836f
jmp 0x10009d52
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x10009c72
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x10009caf
mov esi, 0x8007000e
jmp 0x10009d54
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x10009d8d
jb 0x10009cca
cmp eax, 0xffffffff
ja 0x10009d8d
cmp eax, 0x400
jbe 0x10009cdf
push eax
lea ecx, [ebp - 0x418]
call fcn.10009402
jmp 0x10009d01
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x10009d01
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10009ca5
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10009c72
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.10009402
mov esi, eax
test edi, edi
je 0x10009d5f
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10009d78
lea ecx, [ebp - 0x418]
call fcn.10008337
lea ecx, [ebp - 0x428]
call fcn.10001550
mov eax, esi
call fcn.1001652c
ret 0x10
push 0x80070216
call fcn.10009402
int3
Function at 0x401d1d
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00401ecd
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x401e1b
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x401dbe
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x401e01
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x401dd5
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x401df0
test al, 0x40
je 0x401de7
mov ecx, dword [edi + 0x20]
jmp 0x401dee
test al, 0x80
je 0x401e01
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x401e01
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x401d8d
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x40af61
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x40b036
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x40b036
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x40b036
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x40afbc
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x40b036
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40b001
test dl, dl
je 0x40affd
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40b001
add ecx, 2
add eax, 2
test dl, dl
jne 0x40afe1
xor eax, eax
jmp 0x40b006
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40b018
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x40b023
inc esi
cmp esi, ebp
jae 0x40b036
mov edx, dword [esp + 0x10]
jmp 0x40afd7
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x40b29a
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x40b2a5
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x40b2b9
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x40b2bd
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x40b2f6
cmp dword [edi + ecx], 0x4550
jne 0x40b2f6
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x40b2f6
test byte [edi + ecx + 0x16], 2
je 0x40b2f6
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x40b2fb
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x40b337
xor eax, eax
jmp 0x40b31a
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x40b340
inc edx
movzx eax, dx
cmp eax, edi
jl 0x40b31a
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x40b346
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x40b37e
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x40b38c
add edx, 0x20
cmp eax, edx
jne 0x40b39d
test bx, bx
je 0x40b3d2
add esi, 2
add edi, 2
jmp 0x40b36e
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x40b3ab
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x40b3b9
add edx, 0x20
sub ecx, edx
je 0x40b3d2
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x40b367
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40be4b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x40bf0c
test ecx, ecx
je 0x40bf0c
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x40bf0c
test ebx, ebx
je 0x40bf0c
mov ebx, eax
add ebx, edx
je 0x40bf0c
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x40bf0c
cmp dword [edx + eax + 0x14], 0
je 0x40bf0c
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x40bf0c
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x40befc
test dl, dl
je 0x40bef8
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x40befc
add edi, 2
add esi, 2
test dl, dl
jne 0x40bedc
xor eax, eax
jmp 0x40bf01
sbb eax, eax
or eax, 1
test eax, eax
je 0x40bf18
inc ebp
cmp ebp, dword [esp + 4]
jb 0x40bec9
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x4208d0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4dde8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004d2a90
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x420952
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004d096a
mov eax, dword [eax]
push 0x5bbd1c
push eax
call fcn.004c22f4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004d2d1b
test bl, bl
je 0x420952
push 0x5bbd1c
lea ecx, [esp + 0xc]
call fcn.004d30ab
push 0x5bbd28
lea ecx, [esp + 0xc]
call fcn.004d30ab
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42098e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004d2d1b
jmp 0x420a59
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x420a12
lea edx, [esp + 0x7c]
push 0x5bbd24
push edx
call fcn.004c22f4
add esp, 8
test eax, eax
je 0x420a12
lea eax, [esp + 0x7c]
push 0x5bbd20
push eax
call fcn.004c22f4
add esp, 8
test eax, eax
je 0x420a12
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4209a2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004d2d1b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x421250
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4212b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4212c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ddf0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5d5664]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4213f8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x421326
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004d2d1b
xor eax, eax
jmp 0x42146f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004d2e58
push esi
lea ecx, [esp + 0xc]
call fcn.004d30e7
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x42144d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00421250
test eax, eax
jne 0x42144d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00421250
test eax, eax
jne 0x42144d
lea eax, [esp + 0x14]
push 0x5bbd38
push eax
call fcn.004c33f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x42142c
lea ecx, [esp + 0x14]
push 0x5bbd34
push ecx
call fcn.004c3370
mov esi, eax
add esp, 8
test esi, esi
jne 0x42142c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x42142f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004d2e08
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x42133e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004d2d1b
xor eax, eax
jmp 0x42146f
mov byte [esi], 0
push 0x5bbd30
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004d2d1b
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4