joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403800
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x45563c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], 0
push 0x30
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.00417850
add esp, 0xc
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.00406480
push eax
call fcn.00412683
add esp, 8
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x40384c
xor al, al
jmp 0x4038a1
cmp dword [ebp - 0x20], 0x200000
jle 0x40389f
push 0
mov ecx, dword [ebp - 0x38]
add ecx, 0x18
call fcn.00406480
push eax
mov ecx, dword [ebp - 0x38]
call fcn.00406480
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40389f
push 0x40
push 0x12
mov edx, dword [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x38]
add ecx, 0x30
call fcn.00407100
mov ecx, dword [ebp - 0x38]
add ecx, 0x30
call fcn.00406890
mov ecx, dword [ebp - 0x38]
add ecx, 0x30
call fcn.00407130
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411455
mov esp, ebp
pop ebp
ret

Function at 0x403b80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44436b
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x45563c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x240], 0
lea ecx, [ebp - 0x238]
call fcn.00406e20
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
je 0x403bed
mov dword [ebp - 0x248], 0x20119
jmp 0x403bf7
mov dword [ebp - 0x248], 0x20219
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x24c], eax
lea ecx, [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jne 0x403cbd
xor edx, edx
mov word [ebp - 0x218], dx
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00417850
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
mov dword [ebp - 0x220], 1
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jne 0x403cb0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.00406f90
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x238]
call fcn.00406fb0
push eax
mov ecx, dword [ebp + 8]
call fcn.00406e50
mov edx, dword [ebp - 0x244]
or edx, 1
mov dword [ebp - 0x244], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00406f70
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411455
mov esp, ebp
pop ebp
ret
Function at 0x404090
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444063
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x45563c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00406240
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00406240
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0x14
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x890], 0xbb8
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x894], 0x1770
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x898], 0x1bb
push 0
push closesocket
push str.WorkingMac
push str.SYSTEMCurrentControlSetServicesNamSvcAdapter
lea ecx, [ebp - 0x30]
push ecx
call fcn.00403a30
add esp, 0x14
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00406300
lea ecx, [ebp - 0x30]
call fcn.004063e0
push 0
push closesocket
push str.Server
push str.SYSTEMCurrentControlSetServicesNamSvcNAM
lea eax, [ebp - 0x48]
push eax
call fcn.00403a30
add esp, 0x14
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00406300
lea ecx, [ebp - 0x48]
call fcn.004063e0
xor edx, edx
mov eax, dword [ebp - 0x10]
add eax, 0x38
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x405220
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444490
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x45563c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x44cd4c
push 0x6d
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x68]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x74], eax
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0x5c]
call fcn.00404bd0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00406240
mov byte [ebp - 4], 1
cmp dword [ebp - 0x6c], 0
jne 0x4052da
push str.Unpack_Client_Failed_n
call fcn.00412a3e
add esp, 4
mov byte [ebp - 0x5d], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004063e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.004041b0
mov al, byte [ebp - 0x5d]
jmp 0x40542b
call fcn.004051a0
push str.NamInstall.exe
push 0x458cd0
call fcn.0040b500
add esp, 8
push 0x458cd0
push 0x44cd78
call fcn.004034b0
push eax
call fcn.004038b0
add esp, 0xc
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push 0x458cd0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xffffffff
je 0x4053be
mov dword [ebp - 0x14], 0
push 0x458cd0
push 0x44cd90
call fcn.004034b0
push eax
call fcn.004038b0
add esp, 0xc
push 0x44cda4
lea ecx, [ebp - 0x2c]
call fcn.00406400
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x78], esp
lea eax, [ebp - 0x2c]
push eax
call fcn.004061e0
mov dword [ebp - 0x7c], eax
lea ecx, [ebp - 0x5c]
call fcn.00404e10
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x64]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x5e], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004063e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.004041b0
mov al, byte [ebp - 0x5e]
jmp 0x40542b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x458cd0
push 0x44cdc0
call fcn.004034b0
push eax
call fcn.004038b0
add esp, 0x10
push 0x44cddc
lea ecx, [ebp - 0x2c]
call fcn.00406400
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x84], esp
lea eax, [ebp - 0x2c]
push eax
call fcn.004061e0
mov dword [ebp - 0x80], eax
lea ecx, [ebp - 0x5c]
call fcn.00404e10
mov byte [ebp - 0x5f], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004063e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.004041b0
mov al, byte [ebp - 0x5f]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411455
mov esp, ebp
pop ebp
ret
Function at 0x408fd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444598
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x45563c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x40], 0
je 0x409010
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x40901c
mov al, 1
jmp 0x4091bf
mov dword [ebp - 0x54], 8
call fcn.004013c0
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.004013c0
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.00401340
add esp, 8
movzx eax, al
test eax, eax
je 0x40905f
xor al, al
jmp 0x4091bf
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.004080c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x28]
call fcn.004083d0
mov ecx, eax
call fcn.00409470
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.004064a0
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.004083d0
mov ecx, eax
call fcn.00409470
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x40]
call fcn.0040a610
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4090da
cmp dword [ebp - 0x3c], 1
je 0x4090e1
cmp dword [ebp - 0x3c], 3
je 0x40917b
jmp 0x409193
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x45], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004083d0
mov ecx, eax
call fcn.00409470
mov edx, dword [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x409144
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.004083d0
mov ecx, eax
call fcn.00409470
push eax
call fcn.004132f3
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x409144
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004063e0
mov al, byte [ebp - 0x34]
jmp 0x4091bf
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x409167
mov byte [ebp - 0x31], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004063e0
mov al, byte [ebp - 0x31]
jmp 0x4091bf
cmp dword [ebp - 0x38], 0
jne 0x409179
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.004081e0
jmp 0x4091ab
mov byte [ebp - 0x33], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004063e0
mov al, byte [ebp - 0x33]
jmp 0x4091bf
mov byte [ebp - 0x32], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004063e0
mov al, byte [ebp - 0x32]
jmp 0x4091bf
jmp 0x409072
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411455
mov esp, ebp
pop ebp
ret
Function at 0x40dfb0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul edx, edx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x10], 0
mov ecx, 4
imul ecx, ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul ecx, ecx, 3
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x40e290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x45563c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40c], ecx
mov ecx, dword [ebp - 0x40c]
call fcn.0040dfb0
xor eax, eax
mov ecx, dword [ebp - 0x40c]
add ecx, 0x68
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov byte [ecx + 0x20], al
push 0x44e848
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x408]
push eax
call fcn.004139f5
add esp, 0xc
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x40e313
mov ecx, dword [ebp + 8]
push ecx
push str._s_cant_be_opened_n
call fcn.00412a3e
add esp, 8
jmp 0x40e374
mov edx, dword [ebp - 0x408]
push edx
push 0x400
push 1
lea eax, [ebp - 0x404]
push eax
call fcn.00413bfd
add esp, 0x10
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
je 0x40e35a
mov ecx, dword [ebp - 0x410]
push ecx
lea edx, [ebp - 0x404]
push edx
mov ecx, dword [ebp - 0x40c]
call fcn.0040e030
jmp 0x40e313
mov ecx, dword [ebp - 0x40c]
call fcn.0040e180
mov eax, dword [ebp - 0x408]
push eax
call fcn.00413890
add esp, 4
mov eax, dword [ebp - 0x40c]
add eax, 0x68
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411455
mov esp, ebp
pop ebp
ret 4
Function at 0x40fb70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44495b
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x45563c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x13c], 0
lea ecx, [ebp - 0x134]
call fcn.00406240
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
je 0x40fbe3
mov dword [ebp - 0x144], 0x20119
jmp 0x40fbed
mov dword [ebp - 0x144], 0x20219
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x148], eax
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x148]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x40fcb1
mov byte [ebp - 0x114], 0
push 0x103
push 0
lea edx, [ebp - 0x113]
push edx
call fcn.00417850
add esp, 0xc
mov dword [ebp - 0x118], 0x104
mov dword [ebp - 0x11c], 1
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x11c]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x40fca4
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x134]
call fcn.00406400
mov eax, dword [ebp - 0x138]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x134]
call fcn.00406480
push eax
mov ecx, dword [ebp + 8]
call fcn.00406270
mov ecx, dword [ebp - 0x140]
or ecx, 1
mov dword [ebp - 0x140], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.004063e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411455
mov esp, ebp
pop ebp
ret 0x14

Function at 0x40ffc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x208
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40fffe
mov ecx, dword [ebp - 4]
add ecx, 0x208
push ecx
push str.file__s__error_and_return_false
call fcn.004034b0
push eax
call fcn.004038b0
add esp, 0xc
xor al, al
jmp 0x410000
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x431698
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0041df1d
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4316d0
xor eax, eax
jmp 0x4316fc
cmp esi, dword [ebp - 4]
je 0x4316f9
cmp dword [ebp + 0xc], 0
je 0x4316f9
push dword [edi + 0x9c]
call fcn.004312a6
push dword [edi + 0x9c]
mov esi, eax
call fcn.00417b21
pop ecx
pop ecx
cmp esi, eax
je 0x4316cc
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x431d5b
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45563c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004174dc
mov dword [ebp - 0x14], eax
cmp dword [0x458b84], edi
jne 0x431e4c
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x431dd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x431f2c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x431f2c
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x431f2c
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x458b84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x458b88], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x458b8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x458b94], eax
test eax, eax
je 0x431e49
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x458b90], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x431e71
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x431e64
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x431e86
push 4
pop eax
jmp 0x431f2e
cmp dword [ebp - 0x14], edi
je 0x431e86
push dword [0x458b84]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x431e6b
mov eax, dword [0x458b90]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x431ee4
cmp dword [0x458b94], esi
je 0x431ee4
push eax
call ebx
push dword [0x458b94]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x431ee4
test eax, eax
je 0x431ee4
call ecx
test eax, eax
je 0x431ed9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x431ed9
test byte [ebp - 8], 1
jne 0x431ee4
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x431f14
mov eax, dword [0x458b88]
cmp eax, esi
je 0x431f11
push eax
call ebx
test eax, eax
je 0x431f11
call eax
mov edi, eax
test edi, edi
je 0x431f11
mov eax, dword [0x458b8c]
cmp eax, esi
je 0x431f11
push eax
call ebx
test eax, eax
je 0x431f11
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x458b84]
call ebx
test eax, eax
je 0x431f2c
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x431f2e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411455
leave
ret
Function at 0x40ecd0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46cfdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00461ac1
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40ed52
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045f840
mov eax, dword [eax]
push 0x4c9210
push eax
call fcn.00452474
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00461d4c
test bl, bl
je 0x40ed52
push 0x4c9210
lea ecx, [esp + 0xc]
call fcn.004620dc
push 0x4ccd8c
lea ecx, [esp + 0xc]
call fcn.004620dc
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40ed8e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00461d4c
jmp 0x40ee59
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40ee12
lea edx, [esp + 0x7c]
push 0x4ccd88
push edx
call fcn.00452474
add esp, 8
test eax, eax
je 0x40ee12
lea eax, [esp + 0x7c]
push 0x4ccd84
push eax
call fcn.00452474
add esp, 8
test eax, eax
je 0x40ee12
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40eda2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00461d4c
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40f650
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40f6b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40f6c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46d05b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4d32f0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40f7f8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40f726
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00461d4c
xor eax, eax
jmp 0x40f86f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00461e89
push esi
lea ecx, [esp + 0xc]
call fcn.00462118
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x4ccdc4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40f84d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040f650
test eax, eax
jne 0x40f84d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040f650
test eax, eax
jne 0x40f84d
lea eax, [esp + 0x14]
push 0x4ccda0
push eax
call fcn.004534b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40f82c
lea ecx, [esp + 0x14]
push 0x4ccd9c
push ecx
call fcn.00453430
mov esi, eax
add esp, 8
test esi, esi
jne 0x40f82c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40f82f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00461e39
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40f73e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00461d4c
xor eax, eax
jmp 0x40f86f
mov byte [esi], 0
push 0x4ccd98
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00461d4c
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4