joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10066bae
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006f3c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005c138
mov dword [ebp - 0x14], eax
cmp dword [0x10075c04], esi
jne 0x10066ca1
push 0x800
push esi
push 0x1001217c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10066c2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10066d81
push esi
push esi
push 0x1001217c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10066d81
push 0x10012194
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10066d81
push eax
call ebx
push 0x100121a0
push edi
mov dword [0x10075c04], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100121b0
push edi
mov dword [0x10075c08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100121c4
push edi
mov dword [0x10075c0c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10075c14], eax
test eax, eax
je 0x10066c9e
push 0x100121e0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10075c10], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10066cc6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10066cb9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10066cdb
push 4
pop eax
jmp 0x10066d83
cmp dword [ebp - 0x14], esi
je 0x10066cdb
push dword [0x10075c04]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10066cc0
mov eax, dword [0x10075c10]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10066d39
cmp dword [0x10075c14], edi
je 0x10066d39
push eax
call ebx
push dword [0x10075c14]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10066d39
test eax, eax
je 0x10066d39
call ecx
test eax, eax
je 0x10066d2e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10066d2e
test byte [ebp - 8], 1
jne 0x10066d39
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10066d69
mov eax, dword [0x10075c08]
cmp eax, edi
je 0x10066d66
push eax
call ebx
test eax, eax
je 0x10066d66
call eax
mov esi, eax
test esi, esi
je 0x10066d66
mov eax, dword [0x10075c0c]
cmp eax, edi
je 0x10066d66
push eax
call ebx
test eax, eax
je 0x10066d66
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10075c04]
call ebx
test eax, eax
je 0x10066d81
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10066d83
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005268d
mov esp, ebp
pop ebp
ret
Function at 0x402480
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4061a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push str.Regsvr32__s
push str._s__s
lea ecx, [ebp - 0x14]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov dword [ebp - 0x10], 0
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
jb 0x4024fb
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405b58
mov eax, dword [ebp - 0x18]
jmp 0x40251c
mov eax, dword [ebp + 8]
push eax
call fcn.00402420
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405b58
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x405610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
push esi
push edi
mov dword [ebp - 0x284], ecx
mov dword [ebp - 0x68], 0xffffffff
mov byte [ebp - 0x64], 0x46
mov byte [ebp - 0x63], 0
mov byte [ebp - 0x62], 0x69
mov byte [ebp - 0x61], 0
mov byte [ebp - 0x60], 0x6c
mov byte [ebp - 0x5f], 0
mov byte [ebp - 0x5e], 0x65
mov byte [ebp - 0x5d], 0
mov byte [ebp - 0x5c], 0x56
mov byte [ebp - 0x5b], 0
mov byte [ebp - 0x5a], 0x65
mov byte [ebp - 0x59], 0
mov byte [ebp - 0x58], 0x72
mov byte [ebp - 0x57], 0
mov byte [ebp - 0x56], 0x73
mov byte [ebp - 0x55], 0
mov byte [ebp - 0x54], 0x69
mov byte [ebp - 0x53], 0
mov byte [ebp - 0x52], 0x6f
mov byte [ebp - 0x51], 0
mov byte [ebp - 0x50], 0x6e
mov byte [ebp - 0x4f], 0
mov byte [ebp - 0x4e], 0
mov byte [ebp - 0x4d], 0
mov byte [ebp - 0x4c], 0
mov byte [ebp - 0x4b], 0
mov ecx, 0x12
xor eax, eax
lea edi, [ebp - 0x4a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x6c], 0x2800
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x6c]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], 0
jmp 0x4056c3
mov ecx, dword [ebp - 0x70]
add ecx, 1
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x6c]
sub edx, 0x1a
cmp dword [ebp - 0x70], edx
jge 0x405805
mov ecx, 0xd
lea edi, [ebp - 0x64]
mov esi, dword [ebp - 0x74]
add esi, dword [ebp - 0x70]
xor eax, eax
repe cmpsw word [esi], word es:[edi]
jne 0x405800
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x74]
lea eax, [edx + ecx + 0x1a]
mov dword [ebp - 0x280], eax
mov ecx, dword [ebp - 0x280]
mov dword [ebp - 0x78], ecx
mov byte [ebp - 0x278], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x277]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push 0
push 0x1fe
lea edx, [ebp - 0x278]
push edx
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
push eax
mov ecx, dword [ebp - 0x78]
push ecx
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
jle 0x4057fb
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x288], edx
lea eax, [ebp - 0x278]
mov dword [ebp - 0x28c], eax
mov ecx, dword [ebp - 0x28c]
mov dl, byte [ecx]
mov byte [ebp - 0x28d], dl
mov eax, dword [ebp - 0x288]
cmp dl, byte [eax]
jne 0x4057d2
cmp byte [ebp - 0x28d], 0
je 0x4057c6
mov ecx, dword [ebp - 0x28c]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x28e], dl
mov eax, dword [ebp - 0x288]
cmp dl, byte [eax + 1]
jne 0x4057d2
add dword [ebp - 0x28c], 2
add dword [ebp - 0x288], 2
cmp byte [ebp - 0x28e], 0
jne 0x405774
mov dword [ebp - 0x294], 0
jmp 0x4057dd
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x294], ecx
mov edx, dword [ebp - 0x294]
mov dword [ebp - 0x298], edx
cmp dword [ebp - 0x298], 0
jne 0x4057f6
xor eax, eax
jmp 0x405808
or eax, 0xffffffff
jmp 0x405808
or eax, 0xffffffff
jmp 0x405808
jmp 0x4056ba
mov eax, dword [ebp - 0x68]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405810
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40631b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov eax, dword [ebp + 8]
push eax
push str._s_d.t1
lea ecx, [ebp - 0x10]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x4058a4
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CFile::Close
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xa
push eax
mov eax, dword [ebp + 8]
push eax
push str._s_d.t12
lea ecx, [ebp - 0x10]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
push 0
push 0x1001
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x405900
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CFile::Close
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x24], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00405b58
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00405c9c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405b58
mov eax, dword [ebp - 0x24]
jmp 0x405931
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00405b58
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00405c9c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405b58
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x416460
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x6315ac], 0
push esi
mov esi, 1
jne 0x41647d
call fcn.00565f40
mov dword [0x6315ac], eax
test eax, eax
je 0x4164ba
call fcn.00565f40
mov ecx, eax
mov eax, dword [0x6315ac]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xbb8
jl 0x4164a7
mov dword [0x6315b0], esi
mov eax, esi
mov dword [0x6315ac], ecx
pop esi
ret
cmp dword [0x6315b0], 3
jl 0x4164b4
xor eax, eax
pop esi
ret
add dword [0x6315b0], esi
mov eax, esi
pop esi
ret
Function at 0x442290
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
movsx eax, byte [ebx]
push esi
push edi
push eax
call fcn.00552d74
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x19
ja 0x442302
push ebx
call fcn.00567960
add esp, 4
test eax, eax
je 0x442302
push ebx
mov dword [ebp + 8], 0x14
call fcn.005679b0
add esp, 4
test eax, eax
je 0x442302
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 5
je 0x442324
call edi
mov esi, eax
lea ecx, [ecx]
call fcn.00567c30
call edi
sub eax, esi
cmp eax, 0x3e8
jb 0x4422e0
dec dword [ebp + 8]
js 0x442302
push ebx
call fcn.005679b0
add esp, 4
test eax, eax
jne 0x4422d4
push 0
push ebx
call fcn.00588760
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x44231d
push esi
call fcn.005887b0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x442370
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
jne 0x4423ac
push 0x56
xor esi, esi
call fcn.00569860
add esp, 4
test eax, eax
je 0x4423b3
push 0xa2
call fcn.0056983d
add esp, 4
test eax, eax
jne 0x4423ac
push 0xa3
call fcn.0056983d
add esp, 4
test eax, eax
je 0x4423b3
pop esi
pop ebp
jmp 0x5661a0
mov eax, esi
pop esi
pop ebp
ret
mov eax, dword [0x6930a8]
push esi
push eax
xor esi, esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5661c3
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
ret
Function at 0x465350
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call fcn.00565f40
mov esi, dword [ebp + 8]
cmp eax, dword [esi]
jl 0x465498
call fcn.00565f40
add eax, 0x3e8
mov dword [esi], eax
call fcn.0040eae0
mov dword [ebp - 8], eax
mov eax, dword [eax + 0x364]
push eax
call fcn.00582840
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
je 0x465498
mov esi, dword [eax + 0x124]
push ebx
mov ebx, dword [eax + 0x128]
mov eax, dword [0x5c08bc]
push edi
mov edi, dword [0x5c08b8]
push 0x280
push eax
push edi
push ebx
push esi
mov dword [ebp + 8], eax
call fcn.0048bcd0
add esp, 0x14
test eax, eax
je 0x4653df
mov ecx, dword [ebp + 8]
push ecx
push edi
call fcn.0046d720
add esp, 8
call fcn.00465340
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
sub eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x1900
jle 0x465414
mov edx, dword [ebp + 8]
push 0x1900
push edx
push edi
push ebx
push esi
call fcn.0048bcd0
add esp, 0x14
test eax, eax
jne 0x465414
cmp esi, edi
setle al
dec eax
and eax, 0x80
jmp 0x465423
mov eax, dword [ebp + 8]
push eax
push edi
push ebx
push esi
call fcn.00582e90
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
push eax
push 0x5000000
call fcn.005831a0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add ecx, ebx
add eax, esi
mov dword [ebp - 0xc], ecx
push 0
mov dword [ebp - 0x10], eax
sar ecx, 6
push ecx
sar eax, 6
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00403a20
add esp, 0x20
cmp eax, 0xffffffff
je 0x465496
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x10]
push ecx
movzx ecx, byte [edx + 0x330]
movzx edx, ax
sar eax, 0x10
movzx eax, ax
push ecx
shl edx, 6
push edx
shl eax, 6
push eax
call fcn.00403580
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push ecx
push edx
call fcn.0046d720
add esp, 0x18
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47dc70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x5c43dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.005847d0
add esp, 4
test eax, eax
je 0x47dec8
mov eax, dword [0x641464]
test eax, eax
je 0x47dca9
push eax
call fcn.005671e0
add esp, 4
push ebx
push esi
push 0x9d02
call fcn.00567110
mov esi, eax
push 0x9d02
push 0
push esi
mov dword [ebp - 0xd0], esi
mov dword [0x641464], esi
call fcn.005517e0
push 1
push str.city_guard
call fcn.00584520
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x47dec1
push edi
jmp 0x47dcf6
mov esi, dword [ebp - 0xd0]
push 0
push ebx
push 1
push str.city
call fcn.00484b70
add esp, 0x10
test eax, eax
je 0x47dea8
mov ecx, eax
imul ecx, ecx, 0x9a
push 0x69267c
push ebx
lea esi, [ecx + esi - 0x9a]
push 1
push str.select_role
mov word [esi], ax
call fcn.005845e0
add esp, 0x10
test eax, eax
je 0x47dd85
push 0xc8
lea edx, [ebp - 0xcc]
push 0
push edx
call fcn.005517e0
push 8
lea eax, [ebp - 0xcc]
push eax
push 0x69267c
call fcn.00484d70
add esp, 0x18
cmp eax, 8
jg 0x47dd85
xor ecx, ecx
test eax, eax
jle 0x47dd85
lea edx, [esi + 2]
mov di, word [ebp + ecx*4 - 0xcc]
mov word [edx], di
inc ecx
add edx, 2
cmp ecx, eax
jl 0x47dd72
push 0x69267c
push ebx
push 1
push str.select_role2
call fcn.005845e0
add esp, 0x10
test eax, eax
je 0x47ddf3
push 0xc8
lea ecx, [ebp - 0xcc]
push 0
push ecx
call fcn.005517e0
push 8
lea edx, [ebp - 0xcc]
push edx
push 0x69267c
call fcn.00484d70
add esp, 0x18
cmp eax, 8
jg 0x47ddf3
xor ecx, ecx
test eax, eax
jle 0x47ddf3
lea edx, [esi + 0x12]
jmp 0x47dde0
mov di, word [ebp + ecx*4 - 0xcc]
mov word [edx], di
inc ecx
add edx, 2
cmp ecx, eax
jl 0x47dde0
push 0x69267c
push ebx
push 1
push str.guard_data
xor edi, edi
call fcn.005845e0
add esp, 0x10
test eax, eax
je 0x47dea8
add esi, 0x24
cmp edi, 6
jge 0x47dea8
push 0xc8
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.005517e0
push 6
lea ecx, [ebp - 0xcc]
push ecx
push 0x69267c
call fcn.00484d70
add esp, 0x18
cmp eax, 6
jne 0x47dea8
mov dx, word [ebp - 0xcc]
mov word [esi - 2], dx
mov ax, word [ebp - 0xc8]
mov word [esi], ax
mov ecx, dword [ebp - 0xc4]
mov dword [esi + 2], ecx
mov edx, dword [ebp - 0xc0]
mov dword [esi + 6], edx
mov eax, dword [ebp - 0xbc]
push 0x69267c
inc edi
mov dword [esi + 0xa], eax
mov ecx, dword [ebp - 0xb8]
push ebx
lea edx, [edi + 1]
push edx
mov dword [esi + 0xe], ecx
push str.guard_data
add esi, 0x14
call fcn.005845e0
add esp, 0x10
test eax, eax
jne 0x47de15
push ebx
push str.city_guard
call fcn.00584580
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x47dcf0
pop edi
call fcn.005849c0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005517d0
mov esp, ebp
pop ebp
ret
Function at 0x51f4e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x5c43dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ecx + 0x38]
sub ebx, dword [ecx + 0x34]
xor eax, eax
sar ebx, 2
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], eax
test ebx, ebx
jle 0x51f5ea
push esi
push edi
mov edx, dword [ecx + 0x38]
sub edx, dword [ecx + 0x34]
sar edx, 2
cmp edx, eax
jle 0x51f52a
mov edx, dword [ecx + 0x34]
mov edi, dword [edx + eax*4]
jmp 0x51f52c
xor edi, edi
mov edx, dword [edi + 1]
cmp edx, dword [ebp + 8]
jne 0x51f5d9
mov esi, dword [ebp + 0xc]
cmp dword [edi + 5], esi
jne 0x51f5d9
push str.hTemp_Mail_Backup
call fcn.0059bf1e
mov eax, dword [ebp + 8]
push esi
push eax
call fcn.0051ebe0
lea edx, [ebp - 0x84]
add esp, 0xc
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x51f563
lea ecx, [ebp - 0x84]
push 0x5ad790
push ecx
call fcn.00555463
mov esi, eax
add esp, 8
test esi, esi
je 0x51f5cd
push esi
push 1
xor eax, eax
lea edx, [ebp - 0x94]
push 0x10
push edx
mov dword [ebp - 0x94], 1
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
call fcn.00554dc4
push esi
push 1
push 0x119
push edi
call fcn.00554dc4
push esi
call fcn.00554ef3
add esp, 0x24
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x98], eax
cmp eax, ebx
jl 0x51f515
pop edi
pop esi
mov eax, dword [ecx]
mov edx, dword [ecx + 0x61]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005517d0
mov esp, ebp
pop ebp
ret 8
Function at 0x520a50
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a097b
mov eax, dword fs:[0]
push eax
sub esp, 0x1e4
mov eax, dword [0x5c43dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push str.hTemp_Mail_Backup
lea eax, [ebp - 0x90]
push str._s_.
push eax
call fcn.00552808
add esp, 0xc
lea ecx, [ebp - 0x1ec]
push ecx
lea edx, [ebp - 0x90]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1f0], eax
cmp eax, 0xffffffff
je 0x520bc1
call fcn.004fa850
push eax
call fcn.0051eba0
push eax
lea eax, [ebp - 0x90]
push str._s__u_
push eax
call fcn.00552808
add esp, 0x10
xor ebx, ebx
nop
test byte [ebp - 0x1ec], 0x10
jne 0x520b9e
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0x1c0]
push edx
call fcn.00553df0
add esp, 8
cmp eax, ebx
je 0x520b9e
lea ecx, [ebp - 0x1c0]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x520b14
sub ecx, esi
lea eax, [ecx + eax - 4]
push str..hdb
push eax
call fcn.00555060
add esp, 8
test eax, eax
jne 0x520b9e
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x98], 0xf
mov dword [ebp - 0x9c], ebx
mov byte [ebp - 0xac], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x520b52
sub eax, edx
push eax
lea ecx, [ebp - 0x1c0]
push ecx
lea ecx, [ebp - 0xac]
call fcn.0040dfb0
lea edx, [ebp - 0xac]
push edx
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0051ab50
cmp dword [ebp - 0x98], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x520b9e
mov eax, dword [ebp - 0xac]
push eax
call fcn.0055185a
add esp, 4
mov esi, dword [ebp - 0x1f0]
lea ecx, [ebp - 0x1ec]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x520ae0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005517d0
mov esp, ebp
pop ebp
ret
Function at 0x524d20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x5c43dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x804]
push edx
call fcn.00552f00
lea eax, [ebp - 0x804]
add esp, 0xc
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x524d51
mov cx, word [0x5a511c]
mov dl, byte [0x5a511e]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [ebp - 0x804]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x524d75
mov ecx, dword [0x670dbc]
push ecx
sub eax, edx
push eax
lea edx, [ebp - 0x804]
push 1
push edx
call fcn.00554dc4
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x10
call fcn.005517d0
mov esp, ebp
pop ebp
ret

Function at 0x531b70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 0xc]
cmp ecx, 0xc
jb 0x531c2a
mov eax, dword [esp + 8]
cmp byte [eax], 0x41
jne 0x531c2a
cmp byte [eax + 1], 0x64
jne 0x531c2a
cmp byte [eax + 2], 0x6f
jne 0x531c2a
cmp byte [eax + 3], 0x62
jne 0x531c2a
cmp byte [eax + 4], 0x65
jne 0x531c2a
push ebx
xor ecx, ecx
mov cl, byte [eax + 7]
push ebp
push esi
push edi
mov edi, ecx
xor edx, edx
mov dl, byte [eax + 8]
xor ecx, ecx
mov cl, byte [eax + 9]
mov esi, dword [esp + 0x14]
shl edi, 8
add edi, edx
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov dl, byte [eax + 0xa]
mov cl, byte [eax + 0xb]
shl ebp, 8
add ebp, edx
xor edx, edx
mov dl, byte [eax + 5]
xor ebx, ebx
mov bl, byte [eax + 6]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi]
mov dword [ecx + 0x1c], edi
shl edx, 8
add ecx, 0x18
add edx, ebx
mov ebx, dword [esp + 0x1c]
push 1
mov dword [ecx], edx
mov dword [ecx + 8], ebp
mov dword [ecx + 0xc], ebx
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x4c
mov ecx, dword [esi]
call dword [ecx + 4]
add esp, 8
mov byte [esi + 0x110], 1
mov byte [esi + 0x111], bl
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 4]
push 1
push eax
mov edx, dword [eax]
mov dword [edx + 0x14], 0x4e
mov edx, dword [esp + 0x18]
add ecx, edx
mov edx, dword [eax]
mov dword [edx + 0x18], ecx
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
ret
Function at 0x5335b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x5335e0
push esi
call fcn.00533ac0
mov al, byte [esi + 0x48]
add esp, 4
test al, al
je 0x5335d9
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x533666
mov eax, dword [esi + 0x198]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x53364f
mov eax, dword [esi + 8]
test eax, eax
je 0x533604
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x198]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x53364b
cmp eax, 2
je 0x53364f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5335f7
cmp eax, 3
je 0x53362a
cmp eax, 1
jne 0x5335f7
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x5335f7
mov edx, dword [esi + 0x124]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x5335f7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x84]
push esi
mov dword [esi + 0x8c], eax
call fcn.005336a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x533686
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.005336a0
add esp, 4
pop esi
ret