joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10092ca
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x1011584]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x220], eax
xor ebx, ebx
mov eax, esi
mov byte [edi], bl
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x10092fa
sub eax, ecx
sar eax, 1
cmp eax, 2
jb 0x100946c
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1009316
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x100946c
cmp word [esi + 2], 0x3a
jne 0x100946c
push 0x105
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, ebx
je 0x100945e
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x100935d
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x1009477
mov ax, word [ebp - 0x218]
mov word [ebp - 0xc], ax
mov ax, word [ebp - 0x216]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.010090ee
pop ecx
pop ecx
cmp esi, eax
jne 0x10093a3
mov byte [edi], 1
push ebx
push ebx
lea eax, [ebp - 0x240]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
lea eax, [ebp - 0x240]
mov dword [ebp - 0x230], eax
mov eax, esi
mov dword [ebp - 0x238], 0x18
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x22c], 0x42
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10093ea
sub eax, edx
sar eax, 1
cmp eax, 3
jne 0x1009409
cmp word [esi + 4], 0x5c
jne 0x1009409
push ebx
push ebx
push ebx
jmp 0x100940d
push ebx
push ebx
push 1
push 1
push 7
push ebx
push ebx
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x238]
push eax
push 0x80
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov esi, eax
cmp esi, ebx
jge 0x100944c
push 0x4000284a
call fcn.0100e4fd
push esi
call fcn.0100e412
pop ecx
jmp 0x1009476
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
mov dword [ecx], eax
mov al, 1
jmp 0x1009479
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e412
jmp 0x1009476
push 0x4000283e
call fcn.0100e4fd
pop ecx
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100f411
leave
ret 0xc
Function at 0x100948f
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1011584]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x10094d2
push 0x40002841
call fcn.0100e4fd
pop ecx
call fcn.0100e5ac
xor eax, eax
jmp 0x1009541
push esi
mov esi, 0x105
lea eax, [ebp - 0x210]
push esi
push eax
call sub.msvcrt.dll_wcscpy_s
push 0x10012dc
lea eax, [ebp - 0x210]
push esi
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0x18
push dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x10094be
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1009514
sub eax, edx
sar eax, 1
je 0x100953e
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1009529
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [edi + eax*2 - 2], cx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100f411
leave
ret 0x14
Function at 0x100998a
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [edi]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov eax, dword [ebp - 4]
add eax, eax
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [edi], eax
call esi
test eax, eax
jne 0x10099dc
call ebx
cmp eax, 0x6f
jne 0x10099e0
push dword [edi]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x10099b0
mov al, 1
jmp 0x10099e2
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10099ee
Capabilities:
Enumerate network shares

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
push 0x1f6
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
call sub.NETAPI32.dll_NetShareEnum
cmp eax, esi
jne 0x1009b5c
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
mov edi, dword [sym.imp.msvcrt.dll_malloc]
shl eax, 2
push eax
mov dword [ebp - 4], esi
call edi
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp - 8]
shl eax, 2
push eax
call edi
mov edx, dword [ebp + 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov dword [edx], eax
xor edx, edx
cmp dword [ebx], edx
je 0x1009b59
cmp dword [ecx], edx
je 0x1009b59
mov dword [ebp + 0x10], edx
cmp eax, edx
jbe 0x1009b4d
jmp 0x1009a77
mov esi, dword [ebp - 4]
mov eax, dword [esi]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1009a7c
sub eax, edx
sar eax, 1
lea ecx, [eax + 1]
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1009a96
mov esi, dword [ebp + 0x10]
sub eax, edx
sar eax, 1
lea ebx, [eax + 1]
lea eax, [ecx + ecx]
push eax
shl esi, 2
call edi
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [esi + ecx], eax
lea eax, [ebx + ebx]
push eax
mov dword [ebp - 0x18], eax
call edi
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [esi + edx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, esi
cmp dword [eax], 0
je 0x1009b59
mov ecx, dword [ecx]
cmp dword [esi + ecx], 0
je 0x1009b59
push dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
push dword [ecx]
push dword [ebp - 0xc]
push dword [eax]
call sub.msvcrt.dll_wcsncpy_s
mov eax, dword [ebp - 4]
push ebx
push dword [eax + 0x18]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
push dword [esi + eax]
call sub.msvcrt.dll_wcsncpy_s
add esp, 0x20
cmp ebx, 2
jb 0x1009b28
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [esi + eax]
lea ebx, [eax + ebx*2 - 4]
cmp word [ebx], 0x5c
jne 0x1009b28
xor eax, eax
mov word [ebx], ax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [esi + eax]
add dword [ebp - 4], 0x28
mov edx, dword [ebp - 0x18]
xor ecx, ecx
inc dword [ebp + 0x10]
mov word [eax + edx - 2], cx
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jb 0x1009a74
push dword [ebp - 0x10]
call sub.NETAPI32.dll_NetApiBufferFree
xor eax, eax
jmp 0x1009b5c
push 8
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1009b68
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0x10]
push edi
push 0x900
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x1009c11
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1009b9d
sub eax, edx
push edi
sar eax, 1
lea ecx, [ebp - 0xc]
push ecx
add eax, eax
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
cmp esi, edi
jne 0x1009bd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e412
pop ecx
jmp 0x1009c1a
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1009bda
sub eax, edx
sar eax, 1
add eax, eax
cmp dword [ebp - 0xc], eax
je 0x1009bf9
push 8
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 0xc], edi
je 0x1009c06
push dword [ebp - 4]
call fcn.0100e3e7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1009c13
xor esi, esi
mov dword [ebp - 8], edi
cmp esi, edi
jne 0x1009c25
push 0x4000283a
call fcn.0100e4fd
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x100b268
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1011584]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x20a
xor ebx, ebx
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x100b2ec
push esi
lea eax, [ebp - 0x41c]
push eax
push 0xd4
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x100b2e3
lea eax, [ebp - 0x41c]
push eax
mov esi, 0x105
lea eax, [ebp - 0x210]
push esi
push eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
lea eax, [ebp - 0x210]
cmp dword [ebp + 8], ebx
je 0x100b2fe
push edi
push ebx
push 0x1002274
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x100b34b
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0100f411
leave
ret 8
push 0x1002274
push esi
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push esi
push edi
push eax
call fcn.0100ea98
test eax, eax
jne 0x100b2e3
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100b327
sub eax, edx
sar eax, 1
add eax, 4
cmp eax, esi
ja 0x100b2e3
push 0x1002268
push esi
push edi
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
mov ebx, edi
jmp 0x100b2eb

Function at 0x100bf7b
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push 0x23
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x100bfaa
test dword [ebp - 8], 0x200
je 0x100bfaa
xor eax, eax
inc eax
jmp 0x100bfac
xor eax, eax
leave
ret 4

Function at 0x100da40
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
xor esi, esi
mov dword [ebp - 0x10], edi
cmp edi, esi
je 0x100daf5
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x100da90
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x100da90
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x100daf5
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push ebx
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
call ebx
mov dword [ebp - 8], eax
inc eax
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [ebp - 4], eax
cmp eax, esi
je 0x100daf4
mov eax, dword [ebp - 8]
push esi
push esi
inc eax
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call edi
push eax
call ebx
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x100dd2a
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1011584]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x100dd9a
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x100dd91
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.0100f411
leave
ret

Function at 0x100de06
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x50
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x100de23
push 1
call dword [sym.imp.msvcrt.dll_exit]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x1002318
push 0x28
push esi
call sub.msvcrt.dll_swprintf_s
add esp, 0x14
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x100de45
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x50
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x100de62
push 1
call dword [sym.imp.msvcrt.dll_exit]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x1002324
push 0x28
push esi
call sub.msvcrt.dll_swprintf_s
add esp, 0x14
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x100de84
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x50
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x100dea1
push 1
call dword [sym.imp.msvcrt.dll_exit]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x1002330
push 0x28
push esi
call sub.msvcrt.dll_swprintf_s
add esp, 0x14
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x100e662
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1011584]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ebx
push edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100e682
sub eax, edx
sar eax, 1
lea esi, [ebx + eax*2]
cmp esi, ebx
jb 0x100e6ff
cmp word [esi], 0x5c
je 0x100e6a1
dec esi
dec esi
jmp 0x100e693
movzx edi, word [esi + 2]
xor eax, eax
push 0x104
mov word [esi + 2], ax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push eax
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov word [esi + 2], di
dec esi
dec esi
test eax, eax
je 0x100e693
lea eax, [ebp - 0x20c]
push 0x100239c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100f411
leave
ret 4
call fcn.0100e5ac
xor eax, eax
jmp 0x100e6ee

Function at 0x100f363
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1010018
call fcn.0100f428
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1011924
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100f178
cmp eax, esi
jne 0x100f16b
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x100f17b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100f152
xor esi, esi
inc esi
mov eax, dword [0x1011920]
cmp eax, esi
jne 0x100f18e
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100f1c9
mov eax, dword [0x1011920]
test eax, eax
jne 0x100f1c3
mov dword [0x1011920], esi
push 0x10012bc
push 0x10012b0
call fcn.0100f0cf
pop ecx
pop ecx
test eax, eax
je 0x100f1c9
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100f293
mov dword [0x10115c0], esi
mov eax, dword [0x1011920]
cmp eax, esi
jne 0x100f1ed
push 0x10012ac
push 0x10012a4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1011920], 2
cmp dword [ebp - 0x1c], ebx
jne 0x100f1fa
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1011928], ebx
je 0x100f21b
push 0x1011928
call fcn.0100f749
pop ecx
test eax, eax
je 0x100f21b
push ebx
push 2
push ebx
call dword [0x1011928]
push dword [0x10115a8]
push dword [0x10115ac]
push dword [0x10115a4]
call fcn.010055d5
add esp, 0xc
mov dword [0x10115bc], eax
cmp dword [0x10115b0], ebx
jne 0x100f279
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10115c0], ebx
jne 0x100f287
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10115bc]
call fcn.0100f46d
ret
call fcn.0100f896
jmp 0x100f130
Function at 0x40d700
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x480ccb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00475996
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40d782
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00473327
mov eax, dword [eax]
push 0x4b31c0
push eax
call fcn.00465164
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00475c21
test bl, bl
je 0x40d782
push 0x4b31c0
lea ecx, [esp + 0xc]
call fcn.00475fb1
push 0x4b6d28
lea ecx, [esp + 0xc]
call fcn.00475fb1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40d7be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00475c21
jmp 0x40d889
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40d842
lea edx, [esp + 0x7c]
push 0x4b6d24
push edx
call fcn.00465164
add esp, 8
test eax, eax
je 0x40d842
lea eax, [esp + 0x7c]
push 0x4b6d20
push eax
call fcn.00465164
add esp, 8
test eax, eax
je 0x40d842
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40d7d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00475c21
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40e080
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40e0e2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40e0f0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x480d4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4bf734]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40e228
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40e156
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00475c21
xor eax, eax
jmp 0x40e29f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00475d5e
push esi
lea ecx, [esp + 0xc]
call fcn.00475fed
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40e27d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push connect
call fcn.0040e080
test eax, eax
jne 0x40e27d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push connect
mov ecx, edi
call fcn.0040e080
test eax, eax
jne 0x40e27d
lea eax, [esp + 0x14]
push 0x4b6d3c
push eax
call fcn.00466230
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e25c
lea ecx, [esp + 0x14]
push 0x4b6d38
push ecx
call fcn.004661b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e25c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40e25f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00475d0e
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40e16e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00475c21
xor eax, eax
jmp 0x40e29f
mov byte [esi], 0
push 0x4b6d34
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00475c21
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4