joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027c90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
movzx eax, byte [0x10069a24]
test eax, eax
jne 0x10027cc2
mov ecx, dword [ebp + 8]
mov dword [0x10069a20], ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x10069a5c]
push eax
call fcn.1001ced0
add esp, 8
mov byte [0x10069a24], al
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 3
ja case.default.0x10027cd5
mov edx, dword [ebp - 4]
jmp dword [edx*4 + 0x10027ed8]
push 0
push 0
push 0
push 0x1001ce80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
clc
jae 0x10027cf6
dec ecx
test byte [esi - 0x64], ah
pushf
push 0xa

Function at 0x10027f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
mov dword [ebp - 4], 0
jmp 0x10027f82
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x15
jge 0x10027fc1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x133e70b]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10027fbc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10027f79
mov eax, 1
imul ecx, eax, 0x15
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10027fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x2d
mov dword [ebp - 4], 0
jmp 0x10028002
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x10028041
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x4b9ddb]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1002803c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10027ff9
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10028060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x51
mov dword [ebp - 4], 0
jmp 0x10028082
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x17
jge 0x100280c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x750cd0d2]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100280bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10028079
mov eax, 1
imul ecx, eax, 0x17
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100280e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x60
mov dword [ebp - 4], 0
jmp 0x10028102
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x10028141
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x71372462]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1002813c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100280f9
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10028160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x97
mov dword [ebp - 4], 0
jmp 0x10028182
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x100281c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x62cf5ac5]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100281bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10028179
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100281e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xa6
mov dword [ebp - 4], 0
jmp 0x10028202
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x11
jge 0x10028241
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x59652bcb]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1002823c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100281f9
mov eax, 1
imul ecx, eax, 0x11
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10028260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xb0
mov dword [ebp - 4], 0
jmp 0x10028282
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x100282c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x6bb10811]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100282bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10028279
mov eax, 1
shl eax, 4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100282e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xbd
mov dword [ebp - 4], 0
jmp 0x10028302
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x10028341
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x4741eb81]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1002833c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100282f9
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10028360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xd1
mov dword [ebp - 4], 0
jmp 0x10028382
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x100283c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x27fc8fe9]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100283bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10028379
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100283e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xf9
mov dword [ebp - 4], 0
jmp 0x10028402
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x17
jge 0x10028441
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x69dbe12c]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1002843c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100283f9
mov eax, 1
imul ecx, eax, 0x17
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10029fd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0x10021a20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10029ff7
call fcn.1001caa0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1002bdc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1002bf70
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1002be8d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10068200]
jb 0x1002be0a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10068204]
ja 0x1002be0a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1002bdda
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10032620
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1002be30
jmp 0x1002be8d
cmp dword [ebp - 0x14], 0x10000
jne 0x1002be73
cmp dword [ebp - 0x18], 0x10000
jb 0x1002be73
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002be66
mov eax, dword [ebp - 8]
jmp 0x1002be8f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1002be88
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1002bf70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1002bdda
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1002bea0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1002bfa0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1002bf65
mov edx, dword [ebp - 4]
cmp edx, dword [0x10068200]
jb 0x1002bee5
mov eax, dword [ebp - 4]
cmp eax, dword [0x10068204]
ja 0x1002bee5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1002beb5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10032620
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1002bf0b
jmp 0x1002bf65
cmp dword [ebp - 0x14], 0x10000
jne 0x1002bf4e
cmp dword [ebp - 0x18], 0x10000
jb 0x1002bf4e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002bf41
mov eax, dword [ebp - 8]
jmp 0x1002bf67
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1002bf60
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1002bfa0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1002beb5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1002bfd0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1002c3c0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x10069b4c], 0
jne 0x1002c00d
cmp dword [0x10069b48], 0
je 0x1002c00d
mov eax, dword [0x10069b48]
mov dword [0x10069b4c], eax
cmp dword [0x10069b4c], 0
je 0x1002c08a
mov ecx, dword [0x10069b4c]
cmp dword [ecx + 8], 0
je 0x1002c08a
mov edx, dword [0x10069b4c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1002c08a
mov ecx, dword [0x10069b4c]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1002c08a
mov eax, dword [0x10069b4c]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x1002c059
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x1002c060
xor eax, eax
jmp 0x1002c1a9
mov ecx, dword [0x10069b4c]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10032620
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x1002c1a9
mov edx, dword [0x10069b48]
mov dword [0x10069b4c], edx
jmp 0x1002c0a6
mov eax, dword [0x10069b4c]
mov ecx, dword [eax + 4]
mov dword [0x10069b4c], ecx
cmp dword [0x10069b4c], 0
je 0x1002c0e6
cmp dword [0x10069b4c], 0
je 0x1002c0e4
mov edx, dword [0x10069b4c]
cmp dword [edx + 8], 0
je 0x1002c0e4
mov eax, dword [0x10069b4c]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x1002c0e4
mov edx, dword [0x10069b4c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1002c0e4
jmp 0x1002c03e
jmp 0x1002c098
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1002c1b0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1002c1a7
mov eax, dword [ebp - 0x18]
mov dword [0x10069b4c], eax
mov ecx, dword [0x10069b4c]
mov dword [ecx], 0x52727464
mov edx, dword [0x10069b4c]
mov dword [edx + 8], 0
mov eax, dword [0x10069b4c]
mov ecx, dword [0x10069b48]
mov dword [eax + 4], ecx
mov edx, dword [0x10069b4c]
mov dword [0x10069b48], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x10069b4c]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x1002c177
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x1002c197
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1002c16e
mov eax, dword [0x10069b4c]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1002c03e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1002da70
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10069b94], 0
je 0x1002da86
xor eax, eax
jmp 0x1002dca2
cmp dword [0x10069b90], 0
je 0x1002da99
mov eax, dword [0x10069b90]
jmp 0x1002dca2
push 0x24
push 0
push 0x10069b6c
call fcn.10032620
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10069b6c], eax
push 0
push 0
push 0x10054fc0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x10069b70], eax
cmp dword [0x10069b70], 0
jne 0x1002db3e
mov dword [0x10069b94], 1
cmp dword [0x10069b70], 0
je 0x1002daf1
mov eax, dword [0x10069b70]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10069b74], 0
mov dword [0x10069b78], 0
mov dword [0x10069b7c], 0
mov dword [0x10069b80], 0
mov dword [0x10069b84], 0
mov dword [0x10069b88], 0
mov dword [0x10069b8c], 0
xor eax, eax
jmp 0x1002dca2
push str.ImagehlpApiVersionEx
mov ecx, dword [0x10069b70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069b74], eax
push str.SymInitialize
mov edx, dword [0x10069b70]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069b78], eax
push str.SymSetOptions
mov eax, dword [0x10069b70]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069b7c], eax
push str.SymGetOptions
mov ecx, dword [0x10069b70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069b80], eax
push str.SymLoadModule64
mov edx, dword [0x10069b70]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069b84], eax
push str.SymGetModuleInfo64
mov eax, dword [0x10069b70]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069b88], eax
push str.SymFromName
mov ecx, dword [0x10069b70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069b8c], eax
push 8
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.10032620
add esp, 0xc
mov eax, 0xc
mov word [ebp - 0xc], ax
cmp dword [0x10069b74], 0
je 0x1002dc23
cmp dword [0x10069b78], 0
je 0x1002dc23
cmp dword [0x10069b84], 0
je 0x1002dc23
cmp dword [0x10069b88], 0
je 0x1002dc23
cmp dword [0x10069b8c], 0
jne 0x1002dc28
jmp 0x1002dad2
lea ecx, [ebp - 0xc]
push ecx
call dword [0x10069b74]
movzx edx, word [ebp - 0xc]
cmp edx, 0xc
jge 0x1002dc40
jmp 0x1002dad2
push 0
push 0
mov eax, dword [0x10069b6c]
push eax
call dword [0x10069b78]
test eax, eax
jne 0x1002dc59
jmp 0x1002dad2
cmp dword [0x10069b80], 0
je 0x1002dc93
cmp dword [0x10069b7c], 0
je 0x1002dc93
call dword [0x10069b80]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xfffffff8
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, 0x2704
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
call dword [0x10069b7c]
mov dword [0x10069b90], 0x10069b6c
mov eax, dword [0x10069b90]
mov esp, ebp
pop ebp
ret

Function at 0x1004250d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10042383
Function at 0x47fd50
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x518d9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0050b5fa
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x47fdd2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00508ea3
mov eax, dword [eax]
push 0xab4d38
push eax
call fcn.004fab04
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0050b885
test bl, bl
je 0x47fdd2
push 0xab4d38
lea ecx, [esp + 0xc]
call fcn.0050bc61
push 0xab4d44
lea ecx, [esp + 0xc]
call fcn.0050bc61
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x47fe0e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0050b885
jmp 0x47fed9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x47fe92
lea edx, [esp + 0x7c]
push 0xab4d40
push edx
call fcn.004fab04
add esp, 8
test eax, eax
je 0x47fe92
lea eax, [esp + 0x7c]
push 0xab4d3c
push eax
call fcn.004fab04
add esp, 8
test eax, eax
je 0x47fe92
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47fe22
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0050b885
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x481150
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4811b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4811c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x518efb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0xac4da8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4812f8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x481226
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0050b885
xor eax, eax
jmp 0x48136f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0050ba0e
push esi
lea ecx, [esp + 0xc]
call fcn.0050bc9d
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x48134d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00481150
test eax, eax
jne 0x48134d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00481150
test eax, eax
jne 0x48134d
lea eax, [esp + 0x14]
push 0xab4d64
push eax
call fcn.004fbcf0
mov esi, eax
add esp, 8
test esi, esi
jne 0x48132c
lea ecx, [esp + 0x14]
push 0xab4d60
push ecx
call fcn.004fbc70
mov esi, eax
add esp, 8
test esi, esi
jne 0x48132c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x48132f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0050b9be
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x48123e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0050b885
xor eax, eax
jmp 0x48136f
mov byte [esi], 0
push 0xab4d5c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0050b885
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4