joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42df61
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0x394], eax
mov eax, dword [ebp + 0x3a0]
push ebx
mov ebx, dword [ebp + 0x3a8]
push esi
mov esi, dword [ebp + 0x3a4]
push edi
xor edi, edi
push 2
push edi
push eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x70], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x74], eax
cmp eax, edi
jne 0x42dfbc
call fcn.0042c44d
mov esi, eax
jmp 0x42e082
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x42dfd5
call fcn.0042c44d
jmp 0x42e077
push esi
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x42dfcb
push esi
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x42e031
lea eax, [ebp - 0x6c]
cmp dword [ebp - 0x70], eax
je 0x42e008
lea ecx, [ebp - 0x70]
call fcn.0042cbd8
mov esi, 0x8007000e
lea ecx, [ebp - 0x78]
call fcn.0042cb12
mov ecx, dword [ebp + 0x394]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ca2f
add ebp, 0x398
leave
ret 0x10
push eax
lea ecx, [ebp - 0x70]
call fcn.0042d103
cmp dword [ebp - 0x70], edi
jne 0x42e046
mov esi, 0x8007000e
jmp 0x42e079
push esi
push dword [ebp - 0x70]
push esi
push ebx
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x42dfcb
mov edx, dword [ebp - 0x70]
push dword [ebp + 0x3ac]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x70]
lea ecx, [ebp - 0x80]
call fcn.0042dc78
mov esi, eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x6c]
cmp dword [ebp - 0x70], eax
je 0x42e00d
lea ecx, [ebp - 0x70]
call fcn.0042cbd8
jmp 0x42e00d
Function at 0x4433d7
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4433ee
inc eax
jmp 0x443490
push esi
mov esi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 1
call esi
test eax, eax
jne 0x44340b
push 0xd
call esi
test eax, eax
jne 0x44340b
inc eax
jmp 0x44348f
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push edi
push 0xd
call esi
mov edi, eax
test edi, edi
jne 0x443454
push 1
call esi
mov esi, eax
test esi, esi
je 0x443486
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x443486
push 0xffffffffffffffff
push eax
lea eax, [ebp - 4]
push eax
call fcn.004173a6
mov ecx, dword [ebp + 8]
add esp, 0xc
push eax
call fcn.004170c2
lea ecx, [ebp - 4]
call fcn.004170b4
push esi
jmp 0x443480
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x443486
push 0xffffffffffffffff
push eax
lea eax, [ebp - 4]
push eax
call fcn.004173be
mov ecx, dword [ebp + 8]
add esp, 0xc
push eax
call fcn.004170c2
lea ecx, [ebp - 4]
call fcn.004170b4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x443506
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x443519
inc eax
jmp 0x4435a4
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx]
cmp dword [eax + 8], 0
jne 0x443536
mov bl, 1
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x44359c
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebx]
mov eax, dword [eax + 8]
lea esi, [eax + eax]
lea eax, [esi + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x443562
call dword [sym.imp.USER32.dll_CloseClipboard]
xor bl, bl
jmp 0x44359a
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
mov eax, dword [ebx]
push esi
push dword [eax + 0xc]
push ebp
call fcn.0044ca40
add esp, 0xc
xor eax, eax
push edi
mov word [esi + ebp], ax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov bl, 1
pop ebp
pop edi
pop esi
xor eax, eax
test bl, bl
sete al
pop ebx
ret 4
Function at 0x4485c1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push ebx
push esi
mov esi, dword [ebp + 0x1a8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], eax
call edi
push esi
mov ebx, eax
call edi
cmp ebx, 0xffffffff
je 0x4486c2
cmp eax, 0xffffffff
je 0x4486c2
test bl, 0x10
je 0x4486c2
test al, 0x10
jne 0x4486c2
mov ebx, 0x20a
push ebx
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.0044d010
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
mov edi, 0x104
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
call esi
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
push eax
add ecx, 4
call fcn.00409234
push ebx
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.0044d010
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push edi
push dword [ebp - 0x78]
call esi
mov esi, dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
add esi, 8
push eax
mov ecx, esi
call fcn.00409234
push 0x5c
push 1
lea eax, [ebp - 0x78]
push eax
mov ecx, esi
call fcn.00408dc2
push eax
call fcn.00447eea
pop ecx
pop ecx
mov ecx, dword [ebp - 0x78]
add ecx, 0xfffffff0
mov bl, al
call fcn.00408324
test bl, bl
je 0x4486be
push 0x473a64
mov ecx, esi
call fcn.004481a9
mov al, 1
jmp 0x4486c4
xor al, al
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ca2f
add ebp, 0x19c
leave
ret 8
Function at 0x449035
Capabilities:
Copy file
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x1e8]
sub esp, 0x268
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0x1e4], eax
mov eax, dword [ebp + 0x1f4]
push ebx
push esi
mov esi, dword [ebp + 0x1f0]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00448ff2
push 0x47adc0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00448299
and dword [ebp - 0x6c], 0
push 0x24c
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0044d010
add esp, 0x20
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x7c]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
je 0x449124
test byte [ebp - 0x6c], 0x10
jne 0x44910a
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.00448299
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00448299
add esp, 0x18
push 0
push dword [ebp - 0x74]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.00408324
test bl, bl
je 0x4490fd
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4490fd
mov bl, 1
jmp 0x4490ff
xor bl, bl
mov ecx, dword [ebp - 0x74]
add ecx, 0xfffffff0
call fcn.00408324
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4490a8
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.00408324
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
call fcn.00408324
mov ecx, dword [ebp + 0x1e4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0044ca2f
add ebp, 0x1e8
leave
ret

Function at 0x449fbc
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
push edi
mov edi, dword [ebp + 0x194]
push 0x206
lea eax, [ebp - 0x7e]
push 0
push eax
call fcn.0044d010
xor eax, eax
add esp, 0xc
mov word [ebp - 0x80], ax
mov esi, 0x104
push esi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x80]
push eax
call fcn.0044d3ee
pop ecx
test eax, eax
jle 0x44a031
cmp word [ebp + eax*2 - 0x82], 0x5c
je 0x44a031
push 0x5c
pop ecx
mov word [ebp + eax*2 - 0x80], cx
inc eax
xor ecx, ecx
mov word [ebp + eax*2 - 0x80], cx
sub esi, eax
push str.WinSxs_
lea eax, [ebp + eax*2 - 0x80]
push esi
push eax
call fcn.0044e901
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov ecx, edi
call fcn.00406c07
mov ecx, dword [ebp + 0x188]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0044ca2f
add ebp, 0x18c
leave
ret
Function at 0x44c3f3
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1a8]
sub esp, 0x228
mov eax, dword [0x4d9778]
xor eax, ebp
mov dword [ebp + 0x1a4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.0044c796
lea ecx, [edi + 0x24]
call fcn.004065e8
lea esi, [edi + 0x40]
mov ecx, esi
call fcn.004065e8
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x62]
push ebx
push eax
mov dword [edi + 0x20], ebx
call fcn.0044d010
add esp, 0xc
push ebx
push 0x1a
lea eax, [ebp - 0x64]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x80]
push str._sduowan_setup_
push eax
call fcn.0044c7ff
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00406799
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.004064bb
cmp dword [esi + 0x18], 8
jb 0x44c48b
mov eax, dword [esi + 4]
jmp 0x44c48e
lea eax, [esi + 4]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp dword [esi + 0x18], 8
jb 0x44c4a1
mov esi, dword [esi + 4]
jmp 0x44c4a4
add esi, 4
push str.setup.log
push esi
lea eax, [ebp - 0x80]
push str._s_s
push eax
call fcn.0044c7ff
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [edi + 0x24]
call fcn.00406799
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.004064bb
mov ecx, dword [ebp + 0x1a4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ca2f
add ebp, 0x1a8
leave
ret

Function at 0x44ca2f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d9778]
jne 0x44ca39
repz ret
jmp fcn.00453273
Function at 0x45cb28
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00453614
and dword [ebp - 4], 0
cmp dword [0x4e0ca0], 0
mov ebx, eax
jne 0x45cbd9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45cc8a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45cc8a
push eax
call fcn.004535a2
mov dword [esp], 0x47d05c
push edi
mov dword [0x4e0ca0], eax
call esi
push eax
call fcn.004535a2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4e0ca4], eax
call esi
push eax
call fcn.004535a2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4e0ca8], eax
call esi
push eax
call fcn.004535a2
pop ecx
mov dword [0x4e0cb0], eax
test eax, eax
je 0x45cbd9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004535a2
pop ecx
mov dword [0x4e0cac], eax
mov eax, dword [0x4e0cac]
cmp eax, ebx
je 0x45cc31
cmp dword [0x4e0cb0], ebx
je 0x45cc31
push eax
call fcn.0045361d
push dword [0x4e0cb0]
mov esi, eax
call fcn.0045361d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45cc31
test edi, edi
je 0x45cc31
call esi
test eax, eax
je 0x45cc28
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45cc28
test byte [ebp - 0xc], 1
jne 0x45cc31
or dword [ebp + 0x10], 0x200000
jmp 0x45cc6a
mov eax, dword [0x4e0ca4]
cmp eax, ebx
je 0x45cc6a
push eax
call fcn.0045361d
pop ecx
test eax, eax
je 0x45cc6a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45cc6a
mov eax, dword [0x4e0ca8]
cmp eax, ebx
je 0x45cc6a
push eax
call fcn.0045361d
pop ecx
test eax, eax
je 0x45cc6a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4e0ca0]
call fcn.0045361d
pop ecx
test eax, eax
je 0x45cc8a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45cc8c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46638e
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x46b359
call fcn.004694aa
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x4664a0
cmp byte [esi + 0x42], bl
je 0x4664a0
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x4663ca
xor al, al
jmp 0x4664a2
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00466364
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00466140
mov ecx, eax
call fcn.00465ae7
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00466140
mov ecx, eax
call fcn.00465ae7
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x46643a
dec eax
je 0x46643e
dec eax
dec eax
je 0x46649c
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00408976
mov al, bl
jmp 0x4664a2
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00466140
mov ecx, eax
call fcn.00465ae7
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x46647e
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00466140
mov ecx, eax
call fcn.00465ae7
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0044e4e6
add esp, 0x10
cmp edi, eax
jne 0x466428
cmp byte [esi + 0x42], 0
je 0x46649c
test edi, edi
jne 0x4663d8
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00408e3d
jmp 0x4663d8
mov bl, 1
jmp 0x46642a
mov al, 1
call fcn.004694f4
ret
Function at 0x466549
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x46b3c7
call fcn.004694aa
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x466573
lea eax, [ebp + 8]
push eax
call fcn.0040e3e3
pop ecx
jmp 0x4666ee
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x4665a1
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x4665a1
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x4666ee
mov eax, dword [esi + 0x4c]
cmp eax, ebx
je 0x4666e9
cmp dword [esi + 0x3c], ebx
jne 0x4665ca
push eax
push edi
call fcn.00465c8d
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x4666ee
jmp 0x4666e9
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
call fcn.00466364
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.00466140
mov ecx, eax
call fcn.00465ae7
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00466140
mov ecx, eax
call fcn.00465ae7
lea edx, [ebp - 0x38]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x4666bb
cmp eax, 1
jg 0x4666f6
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00466140
mov ecx, eax
call fcn.00465ae7
mov edi, dword [ebp - 0x38]
sub edi, eax
je 0x466660
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00466140
mov ecx, eax
call fcn.00465ae7
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0044e4e6
add esp, 0x10
cmp edi, eax
jne 0x4666dd
lea eax, [ebp - 0x30]
mov byte [esi + 0x42], 1
cmp dword [ebp - 0x3c], eax
jne 0x466726
test edi, edi
ja 0x466686
cmp dword [ebp - 0x18], 0x20
push 0
lea ecx, [ebp - 0x2c]
jae 0x4666e2
push 8
call fcn.00408e3d
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00466140
mov ecx, eax
call fcn.00465ae7
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00466140
mov ecx, eax
call fcn.00465ae7
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x40]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x3c]
push edx
lea edx, [ebp - 0x2e]
push edx
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x466617
push 0
lea ecx, [ebp - 0x2c]
push 1
call fcn.00408976
mov eax, 0xffff
call fcn.004694f4
ret 4
cmp eax, 3
jne 0x4666dd
push dword [esi + 0x4c]
push dword [ebp - 0x30]
call fcn.00465c8d
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x466715
mov esi, 0xffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00408976
mov ax, si
jmp 0x4666ee
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00408976
mov ax, word [ebp + 8]
jmp 0x4666ee
Function at 0x466fb4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4e111c], 0
push esi
jne 0x466f27
call fcn.00466e4d
test eax, eax
je 0x466f6a
mov eax, dword [0x4e111c]
cmp eax, 1
jne 0x466f48
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x466f6a
pop esi
ret
push eax
call dword [0x4e1124]
test eax, eax
jne 0x466fb2
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x466f6e
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4e111c]
call dword [0x4e1124]
mov edi, eax
test edi, edi
je 0x466f93
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x466faf
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4e111c]
call dword [0x4e1120]
add edi, 0x10
cmp edi, esi
jb 0x466f9b
mov eax, edi
pop edi
pop esi
ret
jmp 0x466f14

Function at 0x4687ee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret
Function at 0x427fa0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49ce7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048f4b9
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x428022
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048cc9d
mov eax, dword [eax]
push 0x720250
push eax
call fcn.0047e1d4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0048f744
test bl, bl
je 0x428022
push 0x720250
lea ecx, [esp + 0xc]
call fcn.0048fb20
push 0x723dcc
lea ecx, [esp + 0xc]
call fcn.0048fb20
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42805e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0048f744
jmp 0x428129
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4280e2
lea edx, [esp + 0x7c]
push 0x723dc8
push edx
call fcn.0047e1d4
add esp, 8
test eax, eax
je 0x4280e2
lea eax, [esp + 0x7c]
push 0x723dc4
push eax
call fcn.0047e1d4
add esp, 8
test eax, eax
je 0x4280e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x428072
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0048f744
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x428920
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x428982
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x428990
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49cefb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x72bb6c]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x428ac8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4289f6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048f744
xor eax, eax
jmp 0x428b3f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0048f8cd
push esi
lea ecx, [esp + 0xc]
call fcn.0048fb5c
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x428b1d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00428920
test eax, eax
jne 0x428b1d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00428920
test eax, eax
jne 0x428b1d
lea eax, [esp + 0x14]
push 0x723de0
push eax
call fcn.0047f380
mov esi, eax
add esp, 8
test esi, esi
jne 0x428afc
lea ecx, [esp + 0x14]
push 0x723ddc
push ecx
call fcn.0047f300
mov esi, eax
add esp, 8
test esi, esi
jne 0x428afc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x428aff
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0048f87d
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x428a0e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048f744
xor eax, eax
jmp 0x428b3f
mov byte [esi], 0
push 0x723dd8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0048f744
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4

Function at 0x42ff66
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
mov eax, dword [esi + 0x3ac]
test eax, eax
jne 0x42ff8e
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x3ac], eax
pop esi
add esp, 0x190
ret