joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46baf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00449110
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00449190
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00449190
lea ecx, [esi + 0xc]
call fcn.0045d7c6
lea ecx, [esi + 0x10]
call fcn.0045d7c6
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0044b9c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0044b9c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0044b9c0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0045d83b
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0045d83b
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x44a208
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46bd18
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x44a218
call fcn.0044a730
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x44a2fb
cmp byte [edi], 0
je 0x44a2fb
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x44a23d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00448f30
test eax, eax
jne 0x44a25d
push 0x490448
lea ecx, [esi + 0x38]
call fcn.0045d978
jmp 0x44a2fb
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00448f80
test eax, eax
jne 0x44a28c
mov ecx, esi
call fcn.00449080
push edi
add esi, 0x38
push 0x490424
push esi
call fcn.0045b7d7
add esp, 0xc
jmp 0x44a2fb
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.0044afb0
test eax, eax
je 0x44a2f4
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0044a3d0
test eax, eax
jne 0x44a310
push edi
lea eax, [esi + 0x38]
push 0x490400
push eax
call fcn.0045b7d7
add esp, 0xc
mov ecx, esi
call fcn.0044a730
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x44a3b8
mov ecx, dword [0x4906b8]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0045b7d7
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00449030
test eax, eax
jne 0x44a37a
push 0x4903e4
lea ecx, [esi + 0x38]
call fcn.0045d978
jmp 0x44a38a
push 0xfa
mov ecx, esi
call fcn.0044afb0
test eax, eax
jne 0x44a3a7
mov ecx, esi
call fcn.0044a730
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0045d83b
jmp 0x44a2fb
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0045d83b
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x45fbdf
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45fc17
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045dc96
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045dc6e
jmp 0x45fc23
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4612cd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46130f
call fcn.00466e4e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46130f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x461306
xor eax, eax
jmp 0x461317
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046131d
pop edi
pop esi
pop ebx
ret 4

Function at 0x46737e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4673ac
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4673ca
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004672e4
jmp 0x4673ca
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4673ca
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004672e4
test edi, edi
mov eax, edi
jne 0x4673b4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001000
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
inc esi
cmp al, 0x22
jne 0x1000103f
push 0x22
push esi
call fcn.100010a0
mov edx, eax
add esp, 8
test edx, edx
je 0x10001056
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
ja 0x1000103a
mov esi, 0x10006490
jmp 0x10001056
lea esi, [edx + 2]
jmp 0x10001056
push 0x20
push esi
call fcn.100010a0
add esp, 8
mov esi, 0x10006494
test eax, eax
je 0x10001056
lea esi, [eax + 1]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push 0
push 0x3e8
push ecx
push esi
push edx
push eax
call sub.PBVM60.dll_Ordinal_137
pop edi
pop esi
ret 0x10

Function at 0x10001160
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x10002178
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x100064bc], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x100064b8], ecx
shl ecx, 8
add ecx, edx
mov dword [0x100064b4], ecx
shr eax, 0x10
mov dword [0x100064b0], eax
call fcn.10002040
test eax, eax
jne 0x100011ca
push 0x1c
call fcn.10001300
add esp, 4
mov dword [ebp - 4], 0
call fcn.10001e40
call fcn.10001e30
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10006890], eax
call fcn.10001a00
mov dword [0x10006498], eax
test eax, eax
je 0x100011fd
mov eax, dword [0x10006890]
test eax, eax
jne 0x10001207
push 0xffffffffffffffff
call fcn.10001360
add esp, 4
call fcn.10001750
call fcn.10001660
call fcn.10001330
mov esi, dword [0x10006890]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x100012e6
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x1000124e
test al, al
je 0x1000124e
and eax, 0xff
push eax
call fcn.10001600
add esp, 4
test eax, eax
je 0x10001228
inc esi
mov dword [ebp - 0x64], esi
jmp 0x10001228
cmp byte [esi], 0x22
jne 0x10001257
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x10001267
cmp al, 0x20
ja 0x10001267
inc esi
mov dword [ebp - 0x64], esi
jmp 0x10001257
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x10001288
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x1000128d
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.10001360
jmp 0x100012cb
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x10001257
inc esi
mov dword [ebp - 0x64], esi
jmp 0x100012e6
Function at 0x403274
Capabilities:
Encode data using xor

Disassembly:
sbb esp, dword [ebx + 0x6f4cb4f5]
or byte [edi + 0x7aa6e808], dl
leave
sti
xor edi, edx
and al, 0xe7
push cs
cdq
out 0x9d, eax
out dx, al
cmc
adc al, byte [edx + edx*2]
xchg ecx, eax
lock adc byte [0xf12ba782], ah
fbld tbyte [ecx]
push cs
imul ebx, dword [reloc.ADVAPI32.DLL_RegCloseKey], 0x14
sbb eax, 0x4a8e6862
adc al, 0xd6
adc ebp, edi
mov ecx, 0xef53ad35
je 0x40323c
retf
Function at 0x49dc05
Capabilities:
Encode data using xor

Disassembly:
push edx
jmp 0x49de3b
lea esp, [esp + 4]
jb 0x49dac6
xor byte [edi + 0xffffffe], 0x83
inc ecx
add al, byte [eax]
add byte [esi - 4], ch
jae 0x49de56
outsb dx, byte [esi]
cld
xchg edx, eax
cmc
add al, 0xb5
pop eax
leave
pop ecx
cmp bl, cl
jl 0x49dc0a
or esp, dword [edx - reloc.ADVAPI32.DLL_RegCloseKey]
push eax
loope 0x49dc87
int 0x5d
and al, 0xd7
pushal
into
pop esi
int3
xchg ecx, eax
pushal
out 0x1d, eax
popfd
or eax, 0x6d60a754
out dx, al
jl 0x49dcaf
test byte [ecx + 0x7d], 3
xchg ebx, eax
test byte [0x5ac445b3], 0x3d
int3
ja 0x49dc98
xor byte [ecx - 0x37], 0xed
push 0xd76899fe
or eax, 0x8f7c1585
cmp eax, 0xc3a436bd
sub dword ds:[ebp + reloc.ADVAPI32.DLL_RegCloseKey], 0xc24cc59a
movsd dword es:[edi], dword [esi]
push esp
xchg ecx, eax
push ebp
invalid
and dword [ebp - 4], 0
pushal
pop dword [esp]
pushal
mov dword [esp + 0x35], ecx
jmp 0x49e0bc
lea esp, [esp + 4]
sub ebx, dword [ebp + 0xc]
sub esp, 2
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0x49de24
mov al, byte [esp]
shr ax, cl
mov al, 0x12
xor eax, eax
jmp 0x49daab
pushal
mov byte [esp + 7], ah
lea esp, [esp + 0x20]
popal
pushal
mov byte [esp + 2], ah
jmp 0x49e0e4
pushal
xchg ah, bl
mov di, word [esp]
xchg esi, ebp
mov dword [esp], edx
jmp 0x49e076
lea esp, [esp + 0x3c]
push edi
mov di, 0x6d41
mov di, 0xa33d
pushal
jmp 0x49e09d
lea esp, [esp + 0x40]
and al, 0x40
dec edi
call fcn.0049e087
xchg byte [edx + esi*4], bl
aad 0x24
loope 0x49e0e5
imul edi, ecx, 0x8da6b98
stosd dword es:[edi], eax
ret 0x4c7d

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402380
Capabilities:
Accept command line arguments
Check for foreground window switch
Enumerate gui resources
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 3
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AnimateWindow]
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
call esi
push 0x416560
push 0x41656c
mov edi, 0x41b0f4
mov ebx, 0x416564
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, eax
call fcn.004037f0
mov edx, edi
mov ecx, ebx
call fcn.00402e60
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push 0x416560
push 0x41656c
mov edi, 0x41b0f0
mov ebx, 0x416570
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push ecx
mov edx, esp
mov dword [esp + 0x18], esp
push edx
mov ecx, eax
call fcn.004037f0
mov edx, edi
mov ecx, ebx
call fcn.00402e60
add esp, 0xc
push 0
push 0
call esi
mov eax, dword [0x41b0f4]
mov ecx, dword [0x41b0f0]
push eax
push ecx
push str.is_sbpEXg_s
mov edi, 0x41b0f8
call fcn.00405440
add esp, 0xc
push 0
push 0
call dword [sym.imp.USER32.dll_FlashWindow]
mov edx, dword [0x41b0f4]
cmp dword [edx - 0xc], 0
jne 0x40246a
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
jmp 0x402480
push 0
push 0
mov byte [0x41b060], 1
call dword [sym.imp.USER32.dll_GetWindow]
mov ecx, dword [0x41b09c]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [0x41b09c]
mov dword [ecx + 4], ecx
mov ecx, dword [0x41b09c]
mov dword [0x41b0a0], 0
cmp eax, ecx
je 0x4024cf
mov edi, dword [eax]
push eax
call fcn.004062a0
mov ecx, dword [0x41b09c]
add esp, 4
mov eax, edi
cmp edi, ecx
jne 0x4024b8
mov eax, dword [0x41b0a8]
mov dword [esp + 0xc], ecx
cmp eax, dword [0x41b0ac]
je 0x4024e5
mov dword [0x41b0ac], eax
lea ecx, [esp + 0xc]
push ecx
push eax
mov ecx, 0x10
mov edx, 0x41b0a8
call fcn.004051f0
push 0
mov dword [0x41b0b8], 7
mov dword [0x41b0bc], 8
call ebx
push 0
push 0x402d80
call dword [sym.imp.USER32.dll_EnumWindows]
push 0
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
call esi
call fcn.00402560
call esi
push 0
mov byte [0x41b060], 0
call dword [sym.imp.USER32.dll_GetParent]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x402480
Function at 0x4059c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x41a24c
call fcn.00406173
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x405a74
test esi, esi
jne 0x405a74
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x405a58
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405a52
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405a52
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x405a41
cmp esi, eax
jae 0x405a45
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x405a33
cmp esi, eax
jb 0x405a49
xor eax, eax
jmp 0x405a52
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x405a7d
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x41a24c
call fcn.00406173
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x4059e5
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405b78
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405baa
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x405ba6
cmp esi, eax
jae 0x405baa
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x405b98
cmp esi, eax
jb 0x405bb0
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x4062ab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4190a4]
jne 0x4062b5
repz ret
jmp fcn.00407816
Function at 0x40d4fb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4190a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004089c3
and dword [ebp - 0x14], 0
cmp dword [0x41b030], 0
mov dword [ebp - 0x18], eax
jne 0x40d5ae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40d656
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40d656
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41b030], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41b034], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41b038], eax
call edi
push eax
call esi
mov dword [0x41b040], eax
test eax, eax
je 0x40d5ae
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41b03c], eax
mov eax, dword [0x41b03c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40d607
cmp dword [0x41b040], ecx
je 0x40d607
push eax
call esi
push dword [0x41b040]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40d607
test ebx, ebx
je 0x40d607
call edi
test eax, eax
je 0x40d5fe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40d5fe
test byte [ebp - 8], 1
jne 0x40d607
or dword [ebp + 0x10], 0x200000
jmp 0x40d63a
mov eax, dword [0x41b034]
cmp eax, dword [ebp - 0x18]
je 0x40d63a
push eax
call esi
test eax, eax
je 0x40d63a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40d63a
mov eax, dword [0x41b038]
cmp eax, dword [ebp - 0x18]
je 0x40d63a
push eax
call esi
test eax, eax
je 0x40d63a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41b030]
call esi
test eax, eax
je 0x40d656
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40d658
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004062ab
leave
ret
Function at 0x42b7e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4bf46b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004b310b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x42b862
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004b0187
mov eax, dword [eax]
push 0x5ec240
push eax
call fcn.004a1d84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004b3396
test bl, bl
je 0x42b862
push 0x5ec240
lea ecx, [esp + 0xc]
call fcn.004b3726
push 0x5efdb4
lea ecx, [esp + 0xc]
call fcn.004b3726
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42b89e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004b3396
jmp 0x42b969
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x42b922
lea edx, [esp + 0x7c]
push 0x5efdb0
push edx
call fcn.004a1d84
add esp, 8
test eax, eax
je 0x42b922
lea eax, [esp + 0x7c]
push 0x5efdac
push eax
call fcn.004a1d84
add esp, 8
test eax, eax
je 0x42b922
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42b8b2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004b3396
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x42c160
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42c1c2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x42c1d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4bf4eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x601128]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x42c308
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x42c236
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004b3396
xor eax, eax
jmp 0x42c37f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004b34d3
push esi
lea ecx, [esp + 0xc]
call fcn.004b3762
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x5efdec
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x42c35d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0042c160
test eax, eax
jne 0x42c35d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0042c160
test eax, eax
jne 0x42c35d
lea eax, [esp + 0x14]
push 0x5efdc8
push eax
call fcn.004a2dc0
mov esi, eax
add esp, 8
test esi, esi
jne 0x42c33c
lea ecx, [esp + 0x14]
push 0x5efdc4
push ecx
call fcn.004a2d40
mov esi, eax
add esp, 8
test esi, esi
jne 0x42c33c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x42c33f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004b3483
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x42c24e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004b3396
xor eax, eax
jmp 0x42c37f
mov byte [esi], 0
push 0x5efdc0
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004b3396
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4