joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e851
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2a20
call fcn.00402d10
and word [ebp - 0x220], 0
push esi
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x220]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, str.iphlpapi.dll
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
push eax
lea eax, [ebp - 0x220]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_wcsncat]
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x40e8c2
xor al, al
jmp 0x40e9c4
push str.GetAdaptersInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40e9a0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x2800
push ecx
lea ecx, [ebp - 0x2a20]
push ecx
call eax
test eax, eax
jne 0x40e9a0
lea eax, [ebp - 0x2a20]
lea esi, [ebp - 0x2a20]
test eax, eax
mov dword [ebp - 0xc], 3
je 0x40e9a0
push ebx
lea eax, [esi + 8]
push eax
call fcn.0040e9c8
mov dword [ebp + 8], eax
push 6
lea eax, [ebp - 8]
push 0
push eax
call sub.MSVCRT.dll_memset
mov ecx, edi
lea eax, [ebp - 8]
add esp, 0x10
xor edx, edx
sub ecx, eax
lea eax, [ebp + edx - 8]
mov bl, byte [ecx + eax]
cmp bl, byte [eax]
jne 0x40e949
inc edx
cmp edx, 6
jb 0x40e936
jmp 0x40e95a
cmp dword [esi + 0x1a0], 6
jne 0x40e995
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jle 0x40e995
mov al, byte [esi + 0x194]
mov byte [edi], al
mov al, byte [esi + 0x195]
mov byte [edi + 1], al
mov al, byte [esi + 0x196]
mov byte [edi + 2], al
mov al, byte [esi + 0x197]
mov byte [edi + 3], al
mov al, byte [esi + 0x198]
mov byte [edi + 4], al
mov al, byte [esi + 0x199]
mov byte [edi + 5], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov esi, dword [esi]
test esi, esi
jne 0x40e911
pop ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 6
lea eax, [ebp - 8]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.0040eb6a
pop edi
pop esi
leave
ret
Function at 0x40e9c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0x18]
mov edi, 0x20019
xor ebx, ebx
push eax
push edi
push ebx
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], 0x104
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x40eb36
push dword [ebp + 8]
lea eax, [ebp - 0x11c]
push str._sConnection
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x11c]
push ebx
push eax
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x40eb2d
push 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.MediaSubType
push dword [ebp - 4]
call esi
test eax, eax
jne 0x40eb24
push 1
lea eax, [ebp - 0x11c]
pop edi
mov dword [ebp - 8], 0x103
push 0x104
push ebx
push eax
mov dword [ebp - 0x14], edi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.PnpInstanceID
push dword [ebp - 4]
call esi
test eax, eax
jne 0x40eb24
cmp dword [ebp - 0x10], edi
jne 0x40eb12
mov esi, 0x41da14
push esi
call sub.MSVCRT.dll_strlen
mov edi, dword [sym.imp.MSVCRT.dll_strncmp]
push eax
lea eax, [ebp - 0x11c]
push esi
push eax
call edi
add esp, 0x10
test eax, eax
jne 0x40eaeb
mov dword [ebp - 0xc], ebx
jmp 0x40eb24
cmp dword [ebp - 0x10], 1
jne 0x40eb12
push esi
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x11c]
push esi
push eax
call edi
add esp, 0x10
test eax, eax
je 0x40eb12
mov dword [ebp - 0xc], 2
jmp 0x40eb24
xor eax, eax
cmp dword [ebp - 0x10], 2
setne al
dec eax
and al, 0xfe
add eax, 3
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ff32
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x41539c
call sub.MSVCRT.dll__EH_prolog
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
mov ebx, ecx
jne 0x40ff5d
push esi
push esi
push esi
push 2
mov ecx, ebx
call fcn.00411858
xor al, al
jmp 0x4100c3
mov ecx, ebx
call fcn.0040ee50
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
or dword [ebx + 8], 0xffffffff
or dword [ebx + 4], 0xffffffff
push 2
push esi
push dword [ebp + 8]
call edi
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push dword [ebp + 8]
mov esi, eax
call edi
xor eax, eax
add esp, 0x1c
cmp esi, eax
jne 0x40ff9e
push eax
push eax
push eax
push 0xd
jmp 0x40ff4f
mov edi, 0x4207f8
mov dword [ebp - 0x10], edi
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x10]
call fcn.0041259e
lea eax, [esi + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [ebp + 8]
and byte [eax], 0
mov dword [ebp - 0x14], eax
push 1
push esi
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x410000
xor eax, eax
mov ecx, ebx
push eax
push eax
push eax
push 2
call fcn.00411858
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], edi
je 0x40ff56
push dword [ebp - 0x10]
call fcn.00402cb2
pop ecx
jmp 0x40ff56
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov edi, eax
and byte [ecx + esi], 0
cmp byte [ecx], 0
je 0x41006b
mov cl, byte [edi]
cmp cl, 0xa
jne 0x410029
mov ecx, edi
sub ecx, eax
inc ecx
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.004126a7
inc edi
jmp 0x41005d
cmp cl, 0xd
jne 0x410065
mov ecx, edi
sub ecx, eax
test ecx, ecx
jle 0x410040
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.004126a7
lea eax, [ebp + 0xb]
push 1
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp + 0xb], 0xa
call fcn.004126a7
cmp byte [edi + 1], 0xa
lea eax, [edi + 1]
jne 0x410061
inc edi
inc edi
mov eax, edi
jmp 0x410066
mov edi, eax
jmp 0x41005d
inc edi
cmp byte [edi], 0
jne 0x410010
sub edi, eax
je 0x410079
push edi
push eax
lea ecx, [ebp - 0x10]
call fcn.004126a7
push dword [ebp - 0x14]
call fcn.00402cb2
mov eax, dword [ebx]
pop ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
add ecx, 8
push 0
push ecx
mov ecx, ebx
call dword [eax + 8]
cmp byte [ebx + 0x2c], 0
je 0x4100ab
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x4207f8
jmp 0x40ffec
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x4207f8
je 0x4100c1
push dword [ebp - 0x10]
call fcn.00402cb2
pop ecx
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x413733
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
push ebx
push esi
mov edx, 0x81
push edi
xor ebx, ebx
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x262]
mov word [ebp - 0x264], bx
mov word [ebp - 0x46c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x46a]
mov word [ebp - 0x674], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x672]
push 0x13
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x208
pop ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
lea edi, [ebp - 0x5a]
mov word [ebp - 0x5c], bx
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 1
movzx ecx, byte [eax + 0xf]
push ecx
movzx ecx, byte [eax + 0xe]
push ecx
movzx ecx, byte [eax + 0xd]
push ecx
movzx ecx, byte [eax + 0xc]
push ecx
movzx ecx, byte [eax + 0xb]
push ecx
movzx ecx, byte [eax + 0xa]
push ecx
movzx ecx, byte [eax + 9]
push ecx
movzx ecx, byte [eax + 8]
push ecx
movzx ecx, word [eax + 6]
push ecx
movzx ecx, word [eax + 4]
push ecx
push dword [eax]
lea eax, [ebp - 0x5c]
push str._08lX__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push 0x27
push eax
call esi
lea eax, [ebp - 0x5c]
mov edi, 0x103
push eax
push str.CLSID_sInprocServer32
lea eax, [ebp - 0x46c]
push edi
push eax
call esi
add esp, 0x48
lea eax, [ebp - 0x5c]
push eax
push str.CLSID_sLocalServer32
lea eax, [ebp - 0x674]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x264]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x46c]
push ebx
mov edi, 0x80000000
push eax
push edi
call esi
test eax, eax
je 0x41386d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x674]
push ebx
push eax
push edi
call esi
test eax, eax
je 0x41386d
xor eax, eax
jmp 0x413883
push dword [ebp + 0x10]
lea eax, [ebp - 0x264]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41389d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x415668
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x214
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.00413995
mov edi, eax
cmp edi, esi
je 0x4138e7
cmp dword [ebp - 0x10], esi
je 0x4138e0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x413984
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x413958
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x10]
push eax
call fcn.0041389d
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x413945
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x41390a
cmp dword [ebp - 0x10], esi
je 0x413953
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x413984
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x41396b
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x413982
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x414007
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
push 0
lea ebx, [esi + 0x30]
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x414057
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push edi
push 0
push eax
mov dword [esi + 8], eax
call sub.MSVCRT.dll_memset
add esp, 0x10
push dword [esi + 8]
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x414057
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.00413dcf
test eax, eax
jne 0x41405e
xor eax, eax
jmp 0x414100
mov eax, dword [ebp - 0x2c]
mov edi, 0x104
mov ecx, eax
mov word [esi + 0xe], ax
mov eax, dword [ebp - 0x28]
push edi
shr ecx, 0x10
mov word [esi + 0xc], cx
mov ecx, eax
shr ecx, 0x10
mov word [esi + 0x12], ax
mov eax, dword [ebp - 0x24]
mov word [esi + 0x10], cx
mov ecx, eax
shr ecx, 0x10
mov word [esi + 0x16], ax
mov eax, dword [ebp - 0x20]
mov word [esi + 0x14], cx
mov ecx, eax
mov word [esi + 0x1a], ax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x238]
shr ecx, 0x10
mov word [esi + 0x18], cx
push eax
push 0x41e128
mov ecx, esi
call fcn.00413ee4
lea eax, [esi + 0x648]
push edi
push eax
push 0x41e108
mov ecx, esi
call fcn.00413ee4
lea eax, [esi + 0x440]
push edi
push eax
push 0x41e0f0
mov ecx, esi
call fcn.00413ee4
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4143bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
mov esi, 0x2000000
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41454d
lea eax, [ebp - 4]
push eax
push 1
push 2
push ebx
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x414548
push str.advapi32.dll
call fcn.004058a5
push str.ConvertStringSidToSidW
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x41453a
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 8]
call eax
test eax, eax
je 0x41453a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], 0x20
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x14]
push eax
push 0x19
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x414531
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x68]
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x28], ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x24]
mov ecx, 0x103
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x47a]
cmp dword [ebp + 0x10], ebx
mov word [ebp - 0x47c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
je 0x4144d0
push dword [ebp + 0x10]
lea eax, [ebp - 0x47c]
push dword [ebp + 0xc]
push str.__s___s
push 0x207
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
jmp 0x4144e8
push 0x207
lea eax, [ebp - 0x47c]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x47c]
push ebx
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x41452b
cmp dword [ebp + 0x14], ebx
jbe 0x41451c
push dword [ebp + 0x14]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x28]
call esi
push dword [ebp - 0x24]
call esi
push 1
pop ebx
jmp 0x414531
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 4]
call esi
push dword [ebp - 0xc]
call esi
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x414679
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
push edi
and word [ebp - 0x19c], 0
push 4
lea edi, [ebp - 0x19a]
pop eax
and dword [ebp - 4], 0
push 0x63
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
pop ecx
push dword [ebp + 8]
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones_d
lea eax, [ebp - 0x19c]
push 0xc8
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x19c]
push str.2500
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
pop edi
jne 0x4146f3
cmp dword [ebp - 4], eax
je 0x4146f3
leave
ret
push 1
pop eax
leave
ret
Function at 0x421bb7
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x421bef
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x421bdd
mov al, 1
jmp 0x421c39
cmp dword [ebx + 0x54], ecx
jne 0x421be6
mov al, 2
jmp 0x421c39
cmp dword [ebx + 0x7c], ecx
jne 0x421c39
mov al, 3
jmp 0x421c39
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x421c04
mov al, 4
jmp 0x421c39
cmp ecx, 5
jne 0x421c24
cmp ebx, 0
jne 0x421c12
mov al, 5
jmp 0x421c39
cmp ebx, 1
jne 0x421c1b
mov al, 6
jmp 0x421c39
cmp ebx, 2
jne 0x421c24
mov al, 7
jmp 0x421c39
cmp ecx, 6
jne 0x421c30
cmp ebx, 0
jne 0x421c32
mov al, 8
jmp 0x421c39
cmp ebx, 1
jne 0x421c39
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437ad0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x499bbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048e0d8
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x437b52
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048bd60
mov eax, dword [eax]
push 0x597244
push eax
call fcn.0047e004
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0048e363
test bl, bl
je 0x437b52
push 0x597244
lea ecx, [esp + 0xc]
call fcn.0048e6f3
push 0x59add8
lea ecx, [esp + 0xc]
call fcn.0048e6f3
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x437b8e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0048e363
jmp 0x437c59
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x437c12
lea edx, [esp + 0x7c]
push 0x59add4
push edx
call fcn.0047e004
add esp, 8
test eax, eax
je 0x437c12
lea eax, [esp + 0x7c]
push 0x59add0
push eax
call fcn.0047e004
add esp, 8
test eax, eax
je 0x437c12
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x437ba2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0048e363
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x438450
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4384b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4384c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x499c3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5a1670]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4385f8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x438526
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048e363
xor eax, eax
jmp 0x43866f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0048e4a0
push esi
lea ecx, [esp + 0xc]
call fcn.0048e72f
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x59ae10
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x43864d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push 0x80000000
call fcn.00438450
test eax, eax
jne 0x43864d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x80000000
mov ecx, edi
call fcn.00438450
test eax, eax
jne 0x43864d
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.0047f040
mov esi, eax
add esp, 8
test esi, esi
jne 0x43862c
lea ecx, [esp + 0x14]
push 0x59ade8
push ecx
call fcn.0047efc0
mov esi, eax
add esp, 8
test esi, esi
jne 0x43862c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x43862f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0048e450
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x43853e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048e363
xor eax, eax
jmp 0x43866f
mov byte [esi], 0
push 0x59ade4
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0048e363
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4