joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402b91
Capabilities:
Hide graphical window

Disassembly:
push esi
push dword [0x43af14]
mov esi, ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x402bb4
push 0
push dword [0x43af14]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
test esi, esi
je 0x402bd2
push 5
push dword [0x43af14]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x43af14]
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
ret

Function at 0x403051
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x4030a1
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x4030a1
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x40000000
push 0x4372c0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
test eax, eax
mov dword [0x43aea0], eax
setne cl
jmp 0x4030a5
xor ebx, ebx
mov ecx, ebx
xor edi, edi
inc edi
test ecx, ecx
je 0x4030f3
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x4030f3
cmp dword [esp + 0xc], edi
je 0x4030f3
call fcn.0040130c
call fcn.00415152
cmp dword [esp + 0xc], edi
jle 0x4030e9
mov ecx, dword [esi + edi*4]
call fcn.00401eac
inc edi
cmp edi, dword [esp + 0xc]
jl 0x4030da
call fcn.00403197
jmp 0x40318c
mov esi, dword [esp + 0x34]
lea eax, [esp + 0xc]
push ebp
push eax
mov dword [0x43aeb4], esi
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], 0x8000
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.00415152
push 0xa
push 0x439118
call dword [sym.imp.USER32.dll_CreateAcceleratorTableW]
push ebx
push 0x402c39
push ebx
push edi
push esi
mov ebp, eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
mov esi, eax
jmp 0x40317d
lea eax, [esp + 0x18]
push eax
push ebp
push esi
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x40317d
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x40317d
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
jne 0x403146
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 0x10
Function at 0x4036f2
Capabilities:
Get file version info

Disassembly:
sub esp, 0x214
lea eax, [esp + 0xc]
push ebx
push ebp
push esi
xor esi, esi
mov ebp, edx
push edi
test ecx, ecx
jne 0x403717
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x40371f
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40378c
push ebx
push edi
push dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x403783
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push 0x4372e8
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x403783
cmp dword [esp + 0x10], esi
je 0x403783
mov esi, dword [esp + 0x14]
mov edi, ebp
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret

Function at 0x403bff
Capabilities:
Hash data using sha256

Disassembly:
push esi
push 0xd0
mov esi, ecx
push 0
push esi
call fcn.0042aa1d
and dword [esi + 0xc8], 0
add esp, 0xc
and dword [esi + 0xcc], 0
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
ret
Function at 0x409289
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.00403bff
push 0x3f
lea eax, [ebp - 0x43]
push 0
push eax
call fcn.0042aa1d
and dword [ebp - 0x38], 0
lea ecx, [ebp - 0x44]
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x44], 0x2040040
sub ecx, edi
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x34], al
push 8
mov byte [ebp - 0x33], 0x40
pop edx
mov eax, dword [ecx + edi]
xor dword [edi], eax
lea edi, [edi + 8]
mov eax, dword [ecx + edi - 4]
xor dword [edi - 4], eax
dec edx
jne 0x4092ca
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4174df
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
push ebx
mov ebx, dword [esp + 0x40]
mov eax, ecx
push ebp
push esi
push edi
mov esi, eax
mov dword [esp + 0x14], eax
lea edi, [esp + 0x18]
mov ecx, ebx
push 0x10
pop ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ebx
lea edi, [esp + 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, eax
mov esi, ebp
sub edi, ebx
lea eax, [esp + 0x38]
sub eax, ebx
mov ebx, eax
mov al, byte [edi + ecx]
xor al, byte [ecx]
mov byte [ebx + ecx], al
inc ecx
dec esi
jne 0x417517
mov ebx, dword [esp + 0x4c]
xor eax, eax
xor edi, edi
movzx ecx, byte [eax + 0x42c480]
movzx eax, byte [esp + edi + 0x18]
xor ecx, eax
mov byte [esp + edi + 0x18], cl
inc edi
movzx eax, cl
cmp edi, 0x30
jb 0x41752b
add eax, esi
and eax, 0xff
inc esi
cmp esi, 0x12
jb 0x417529
mov edi, dword [esp + 0x14]
lea esi, [esp + 0x18]
sub ebx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ecx, byte [edx + 0xf]
movzx eax, byte [ebx + edx]
xor eax, ecx
movzx ecx, byte [eax + 0x42c480]
movzx eax, byte [edx]
xor ecx, eax
mov byte [edx], cl
inc edx
movzx ecx, cl
dec ebp
jne 0x417565
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x421cb6
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push edi
mov edi, ecx
test ebx, ebx
je 0x421d50
push esi
mov eax, dword [edi + 0x188]
mov esi, ebx
sub eax, dword [edi + 0x18c]
cmp ebx, eax
cmova esi, eax
mov eax, dword [edi + 0x18c]
push esi
add eax, 0xc8
add eax, edi
push ebp
push eax
call fcn.0042a9fb
add dword [edi + 0x18c], esi
add esp, 0xc
mov eax, dword [edi + 0x188]
add ebp, esi
sub ebx, esi
cmp dword [edi + 0x18c], eax
jne 0x421d47
xor ecx, ecx
test eax, 0xfffffff8
jbe 0x421d39
mov eax, dword [edi + ecx*8 + 0xc8]
xor dword [edi + ecx*8], eax
mov eax, dword [edi + ecx*8 + 0xcc]
xor dword [edi + ecx*8 + 4], eax
inc ecx
mov eax, dword [edi + 0x188]
shr eax, 3
cmp ecx, eax
jb 0x421d16
mov ecx, edi
call fcn.00421e93
and dword [edi + 0x18c], 0
test ebx, ebx
jne 0x421cca
pop esi
pop edi
pop ebp
pop ebx
ret

Function at 0x421d54
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov edx, dword [esi + 0x18c]
mov eax, dword [esi + 0x188]
sub eax, edx
push eax
lea eax, [esi + 0xc8]
add eax, edx
push edi
push eax
call fcn.0042aa1d
mov eax, dword [esi + 0x18c]
add esp, 0xc
mov ecx, edi
or byte [esi + eax + 0xc8], 6
mov eax, dword [esi + 0x188]
or byte [eax + esi + 0xc7], 0x80
test dword [esi + 0x188], 0xfffffff8
jbe 0x421dc8
mov eax, dword [esi + ecx*8 + 0xc8]
xor dword [esi + ecx*8], eax
mov eax, dword [esi + ecx*8 + 0xcc]
xor dword [esi + ecx*8 + 4], eax
inc ecx
mov eax, dword [esi + 0x188]
shr eax, 3
cmp ecx, eax
jb 0x421da5
mov ecx, esi
call fcn.00421e93
test dword [esi + 0x188], 0xfffffff8
jbe 0x421de9
mov eax, dword [esi + 0x188]
inc edi
shr eax, 3
cmp edi, eax
jb 0x421ddb
mov eax, dword [esi + 0x188]
pop edi
mov dword [esi + 0x18c], eax
pop esi
ret

Function at 0x421e93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov esi, ecx
xor edi, edi
mov ecx, esi
call fcn.00420e2c
mov ecx, esi
call fcn.00421442
mov ecx, esi
call fcn.00421786
call fcn.00421915
mov eax, dword [edi + 0x42cf40]
xor dword [esi], eax
mov eax, dword [edi + 0x42cf44]
add edi, 8
xor dword [esi + 4], eax
cmp edi, 0xc0
jb 0x421e9f
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424666
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov esi, ebx
push edi
mov dword [esp + 0x10], eax
lea edi, [ecx + 8]
sub esi, ecx
mov dword [esp + 0x14], 4
mov eax, dword [edi + 4]
xor eax, dword [esi + edi + 4]
mov ecx, dword [edi]
xor ecx, dword [esi + edi]
push eax
mov eax, dword [edi - 4]
xor eax, dword [ebx + 4]
push ecx
mov ecx, dword [edi - 8]
xor ecx, dword [ebx]
push eax
push ecx
call fcn.004245fe
mov ecx, dword [esp + 0x1c]
lea ebx, [ebx + 0x10]
add esp, 0x10
lea edi, [edi + 0x10]
add ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ecx
adc eax, edx
dec dword [esp + 0x14]
mov dword [esp + 0x10], eax
jne 0x424691
push eax
push ecx
call fcn.00424639
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x426304
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, ecx
shr eax, 0xf
xor eax, ecx
imul ecx, eax, 0x85ebca77
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
push esi
mov esi, dword [esp + 8]
and esi, 0xf
cmp esi, 4
jb 0x426334
push edi
mov edi, esi
shr edi, 2
mov eax, dword [edx]
sub esi, 4
imul eax, eax, 0x3d4d51c3
add edx, 4
sub ecx, eax
rol ecx, 0x11
imul ecx, ecx, 0x27d4eb2f
dec edi
jne 0x426317
pop edi
test esi, esi
je 0x426350
movzx eax, byte [edx]
imul eax, eax, 0x165667b1
add ecx, eax
inc edx
rol ecx, 0xb
imul ecx, ecx, 0x9e3779b1
dec esi
jne 0x426338
pop esi
jmp 0x4262e2

Function at 0x426586
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, edx
mov ebp, ecx
and esi, 0x1f
push edi
mov edi, dword [esp + 0x20]
cmp esi, 8
jb 0x4265fa
mov eax, esi
shr eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
add ebp, 8
push eax
push ecx
push 0
push 0
call fcn.004264c2
add esp, 0x10
mov ecx, eax
xor ecx, ebx
xor edx, edi
mov eax, ecx
shld eax, edx, 0x1b
push 0x9e3779b1
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.0042a988
mov ebx, eax
mov edi, edx
add ebx, 0xc2b2ae63
adc edi, 0x85ebca77
sub esi, 8
dec dword [esp + 0x14]
jne 0x4265a9
cmp esi, 4
jb 0x42664b
mov eax, dword [ebp]
add ebp, 4
push 0x9e3779b1
push 0x85ebca87
push 0
push eax
call fcn.0042a988
mov ecx, eax
xor edx, edi
xor ecx, ebx
mov eax, ecx
push 0xc2b2ae3d
shld eax, edx, 0x17
shld edx, ecx, 0x17
push 0x27d4eb4f
push edx
push eax
call fcn.0042a988
mov ebx, eax
mov edi, edx
add ebx, 0x9e3779f9
adc edi, 0x165667b1
sub esi, 4
test esi, esi
je 0x42668c
movzx eax, byte [ebp]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.0042a988
xor ebx, eax
xor edi, edx
push 0x9e3779b1
mov eax, ebx
inc ebp
shld eax, edi, 0xb
push 0x85ebca87
shld edi, ebx, 0xb
push edi
push eax
call fcn.0042a988
mov ebx, eax
mov edi, edx
dec esi
jne 0x42664f
push edi
push ebx
call fcn.0042653a
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x426979
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
push 0x9e3779b1
push 0x85ebca87
mov esi, edx
mov ebp, ecx
push 0
push esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebp
call fcn.0042a988
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, esi
shr eax, 4
mov dword [esp + 0x24], ebp
sub ebp, ebx
lea edi, [ebx + 8]
mov dword [esp + 0x14], edx
mov ebx, ebp
mov dword [esp + 0x30], eax
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x1c], 8
mov edx, dword [edi]
sub edx, dword [esp + 0x40]
mov eax, dword [edi + 4]
sbb eax, dword [esp + 0x44]
xor edx, dword [ebx + edi]
xor eax, dword [ebx + edi + 4]
mov esi, dword [edi - 8]
add esi, dword [esp + 0x40]
mov ecx, dword [edi - 4]
adc ecx, dword [esp + 0x44]
xor ecx, dword [ebp + 4]
xor esi, dword [ebp]
push eax
push edx
push ecx
push esi
call fcn.004245fe
add esp, 0x10
lea ebp, [ebp + 0x10]
add dword [esp + 0x18], eax
lea edi, [edi + 0x10]
adc dword [esp + 0x14], edx
dec dword [esp + 0x1c]
jne 0x4269ca
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x28]
mov ecx, dword [ebx + 0x7f]
sub ecx, dword [esp + 0x40]
mov eax, dword [ebx + 0x83]
sbb eax, dword [esp + 0x44]
mov esi, dword [ebx + 0x77]
mov edx, dword [ebx + 0x7b]
mov ebx, dword [esp + 0x2c]
xor ecx, dword [ebx + ebp - 8]
xor eax, dword [ebx + ebp - 4]
add esi, dword [esp + 0x40]
push eax
adc edx, dword [esp + 0x48]
xor edx, dword [ebx + ebp - 0xc]
xor esi, dword [ebx + ebp - 0x10]
push ecx
push edx
push esi
call fcn.004245fe
mov ebx, edx
mov edi, eax
mov edx, dword [esp + 0x24]
push edx
push dword [esp + 0x2c]
call fcn.00424639
mov esi, dword [esp + 0x48]
add esp, 0x18
mov dword [esp + 0x2c], eax
mov ecx, edx
mov dword [esp + 0x28], ecx
cmp esi, 8
jbe 0x426ae6
mov edx, dword [esp + 0x38]
sub ebp, 0xffffff80
add edx, 3
add esi, 0xfffffff8
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], esi
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
sub ecx, dword [esp + 0x40]
mov esi, dword [edx]
sbb eax, dword [esp + 0x44]
xor ecx, dword [ebp + 8]
xor eax, dword [ebp + 0xc]
mov edx, dword [edx + 4]
add esi, dword [esp + 0x40]
push eax
adc edx, dword [esp + 0x48]
xor edx, dword [ebp + 4]
xor esi, dword [ebp]
push ecx
push edx
push esi
call fcn.004245fe
add esp, 0x10
lea ebp, [ebp + 0x10]
add edi, eax
adc ebx, edx
mov edx, dword [esp + 0x1c]
add edx, 0x10
dec dword [esp + 0x18]
mov dword [esp + 0x1c], edx
jne 0x426a93
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
add edi, eax
adc ebx, ecx
push ebx
push edi
call fcn.00424639
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x42a6e8
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
je 0x42a70d
cmp al, 0x20
jle 0x42a71f
inc esi
cmp byte [esi], 0x20
jg 0x42a701
jmp 0x42a71f
cmp al, 0x22
je 0x42a71e
inc esi
mov al, byte [esi]
test al, al
jne 0x42a709
cmp al, 0x22
jne 0x42a71f
jmp 0x42a71e
cmp al, 0x20
jg 0x42a725
inc esi
mov al, byte [esi]
test al, al
jne 0x42a71a
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0042a794
push 0x42b1ec
push 0x42b1e8
call fcn.0042a7ac
test byte [ebp - 0x18], 1
movzx eax, word [ebp - 0x14]
pop ecx
pop ecx
push 0xa
pop ecx
cmovne ecx, eax
push ecx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.0042a778
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x41cf70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x41cf7f
pop dword [ebp - 0x44]
mov eax, 0x41cf7f
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x38996
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x3372ad59
add ecx, 0xcc8d8608
mov ebx, eax
mov esi, 0x6cbc199d
add esi, 0x93873a63
add esi, dword [ebp - 0x44]
mov edx, 0xc931ffb
add edx, 0x8fb20474
add dword [ebp - 0x28], edi
mov edi, dword [esi]
xor dword [ebp - 0x28], edx
sub edi, edx
mov dword [ebx], edi
xor dword [ebp - 0x3c], 0xff307237
add ebx, 4
add esi, 4
loop 0x41cfd4
add eax, 0xc5a748c1
sub eax, 0xc5a6886a
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x64c78fdd
add ecx, 0x9b787023
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
jmp 0x403a1c
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405220], eax
mov dword [0x4051a8], 0x403098
mov dword [0x4051a4], 2
jmp 0x403a4c
mov dword [0x4051ac], 0
mov dword [0x4051b0], 0
mov dword [0x4051a0], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051b4], eax
mov dword [0x4051c8], 0x40426e
mov dword [0x4051c0], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051b8], eax
mov dword [0x4051cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051bc], eax
push 0x4051a0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.justam
push 0x40426e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405218], eax
push 5
push dword [0x405218]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405218]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x403b1f
push 0
push 0
push 0
push 0x4051d0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x403b4c
push 0x4051d0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4051d0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x403b1f
mov eax, dword [0x4051d8]
jmp 0x403b59
call 0x402be1
ret
Function at 0x40a610
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x493d0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00488848
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40a692
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00486722
mov eax, dword [eax]
push 0x4b5c68
push eax
call fcn.004788d4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00488ad3
test bl, bl
je 0x40a692
push 0x4b5c68
lea ecx, [esp + 0xc]
call fcn.00488e63
push 0x4b5c74
lea ecx, [esp + 0xc]
call fcn.00488e63
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40a6ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00488ad3
jmp 0x40a799
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40a752
lea edx, [esp + 0x7c]
push 0x4b5c70
push edx
call fcn.004788d4
add esp, 8
test eax, eax
je 0x40a752
lea eax, [esp + 0x7c]
push 0x4b5c6c
push eax
call fcn.004788d4
add esp, 8
test eax, eax
je 0x40a752
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a6e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00488ad3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40afa0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40b002
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40b010
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x493d8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4c4fe0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40b148
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40b076
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00488ad3
xor eax, eax
jmp 0x40b1bf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00488c10
push esi
lea ecx, [esp + 0xc]
call fcn.00488e9f
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40b19d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.0040afa0
test eax, eax
jne 0x40b19d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.0040afa0
test eax, eax
jne 0x40b19d
lea eax, [esp + 0x14]
push 0x4b5c84
push eax
call fcn.00479950
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b17c
lea ecx, [esp + 0x14]
push 0x4b5c80
push ecx
call fcn.004798d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b17c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40b17f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00488bc0
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40b08e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00488ad3
xor eax, eax
jmp 0x40b1bf
mov byte [esi], 0
push 0x4b5c7c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00488ad3
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4