joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5805d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 0x14]
pop ax
mov esi, dword [esp + 0x1d]
neg dx
jmp 0x58069e
sub esp, 0x14
xchg dword [esp + 0x20], esi
mov word [esp + 0x1e], dx
cpuid
jmp 0x5805c0
mov cx, 0xdb58
mov dword [esp + 0x1e], edi
xchg bh, al
sub si, bp
jmp 0x580643
mov dx, bx
rdtsc
inc di
sub esp, 0xd
mov bh, byte [esp + 0x23]
lea ebx, [edx*4]
jmp 0x5805e6
pop ebx
mov word [esp], sp
push dword [esp + 0xe]
xchg byte [esp + 0xb], dl
inc edx
jmp 0x580672
push dword [esp + 0x20]
inc dl
mov ebx, dword [esp + 0x2b]
mov edi, dword [esp + 0x17]
shr edi, cl
lea esp, [esp + 0x20]
jmp 0x580613
btc si, si
mov ecx, 0xcad0968
xchg word [esp + 0xe], bx
push dword [esp + 0x1c]
pop bp
rdtsc
jmp 0x580629
add esp, 0x10
lea edi, [esi + 0xff]
lea esp, [esp + 2]
mov cx, di
jmp 0x5806c9
lea ebp, [eax*4]
xchg dword [esp + 0xa], edx
bswap edi
mov cl, byte [esp + 5]
mov dl, 0x33
mov ebx, dword [esp + 0xa]
jmp 0x58065b
mov byte [esp + 0x17], bh
push bx
bswap ebx
lea ebp, [edi + ebp]
or dh, 0x8d
sbb al, 0xbc
jmp 0x5805fc
xchg dh, al
mov bx, word [esp]
mov eax, esi
lea ebx, [ebp*4]
jmp 0x580726
mov edi, esi
mov ch, ah
mov al, ch
pop dx
lea eax, reloc.MFC42.DLL_CWnd::OnCommand
mov ebx, esi
jmp 0x5806b3
bswap ebp
mov edx, 0x9b76c8bf
sub esp, 4
xchg word [esp + 9], ax
cmc
cld
jmp 0x58074f
mov dx, 0x3fcf
setbe dl
lea ecx, [eax + ecx]
sub esp, 0x11
dec di
pop bp
jmp 0x58070a
sub esp, 0x19
xchg word [esp + 8], di
xchg si, bp
add cl, cl
jmp 0x5807dc
mov edi, dword [esp + 0xe]
add esp, 9
mov di, 0xa457
mov ch, byte [esp + 2]
push word [esp + 5]
xchg dl, cl
jmp 0x580739
xchg dword [esp + 0xd], eax
lea ebx, [esi*4]
mov byte [esp + 0xb], ah
mov byte [esp + 0x1f], cl
lea edx, [eax + ecx]
lea esp, [esp]
call fcn.005807a7
mov byte [esp + 2], ch
xchg ah, ch
xchg dword [esp], ecx
cpuid
push dword [esp + 1]
jmp 0x5808ab
lea esp, [esp + 4]
setbe ah
call fcn.00580850
xchg byte [esp + 0x19], al
inc di
push word [esp + 6]
jmp 0x580919
push word [esp + 0x12]
not edx
not edi
pop si
cpuid
pop ecx
jmp 0x5809bb
lea esi, [edi + 0x96]
xchg cl, al
push word [esp + 0x17]
lea esi, [esp + ebp]
sub esp, 2
mov si, 0xd21e
jmp 0x580903
stc
mov bx, 0x9d44
popal
lea eax, [ebx*4]
bsf eax, ebp
call fcn.0058095f
cmp bh, 0x32
lea esp, [esp + 0x10]
bsf ebp, edx
lea eax, reloc.MFC42.DLL_CWnd::OnCommand
jmp 0x580a27
mov dl, 0x10
mov edi, 0xd40c70e8
pop ax
setae ah
mov edx, dword [esp + 1]
pop di
jmp 0x580a59
sub esp, 0x1e
mov byte [esp + 0xd], al
bsr cx, bp
mov ebx, eax
clc
cmc
jmp 0x580f36
std
xchg dword [esp + 6], ebx
mov bp, bx
pop dword [esp + 3]
setg dh
pushfd
jmp 0x580c2e
push word [esp + 0x1e]
mov dl, bh
bt ebp, esi
mov dword [esp + 0x17], ecx
pop eax
lea esi, [edx + 0x11]
jmp 0x580dad
setb bl
mov byte [esp + 0x20], al
mov edx, ebx
mov ah, ch
xchg dx, bx
lea esi, reloc.MFC42.DLL_CWnd::OnCommand
jmp 0x580ec5
Function at 0x58093e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, reloc.MFC42.DLL_CWnd::OnCommand
xchg ebp, ebx
pop si
lea esp, [esp + 0x18]
jmp 0x57f07c
cpuid
bsf ecx, ebp
lea edi, reloc.MFC42.DLL_CWnd::OnCommand
xchg si, cx
shr cx, 1
pop word [esp + 0x21]
jmp 0x57f02d
mov ax, word [esp + 1]
mov ebx, edx
mov word [esp + 0x12], cx
xchg bp, bx
mov si, 0x452d
mov bh, byte [esp + 0x13]
jmp 0x57f106
shr ebp, 3
push word [esp + 0x19]
mov bl, ah
mov ax, 0x69a9
push word [esp + 0x1f]
mov ecx, dword [esp + 9]
jmp 0x57f05b
sub esp, 0x1b
xchg bh, dl
cld
mov dx, word [esp + 0x22]
std
bts edx, edx
jmp 0x57f043
add esp, 7
ror bx, 0
bswap edx
sub esp, 0
mov ebp, eax
xchg edi, esi
jmp 0x57f0e7
lea esp, [esp + 0x12]
add esp, 8
mov ch, byte [esp + 1]
mov bl, byte [esp + 7]
mov ch, byte [esp + 1]
bswap esi
jmp 0x57f0ba
mov ch, byte [esp]
btc ax, sp
xchg byte [esp], dl
stc
cld
std
jmp 0x57f11a
mov ecx, dword [esp + 0x16]
mov si, word [esp + 0xd]
pop ebp
cpuid
push dword [esp + 2]
cpuid
jmp 0x57f0d0
mov byte [esp], al
mov byte [esp], al
mov eax, 0x5bbaf7ba
lea ecx, [ebx*4]
lea esp, [esp]
stc
jmp 0x57f171
std
sub esp, 0x14
adc ax, 0x8e33
lea ebx, reloc.MFC42.DLL_CWnd::OnCommand
xchg dword [esp + 0x1a], ecx
mov byte [esp + 0xf], ch
jmp 0x57f0a9
mov bh, 0x8d
lea esi, [ecx*4]
mov byte [esp], dl
mov dl, bh
dec bl
jmp 0x57f199
mov byte [esp], dh
bswap eax
mov edx, dword [esp]
bswap ebx
add esp, 0
mov edx, dword [esp]
jmp 0x57f15b
adc di, bp
xchg al, bh
sets al
mov bl, ch
setp dl
sub esp, 0x11
jmp 0x57f7fa
xchg byte [esp], dh
btc ax, bx
add esp, 0
seto ah
mov bp, 0xfc12
lea esp, [esp]
jmp 0x57f183
mov edi, esi
xchg dl, ch
mov al, 0xe5
mov bp, 0x3119
xchg cl, ah
cmc
jmp 0x57f140
btc cx, si
lea edi, reloc.MFC42.DLL_CWnd::OnCommand
lea esi, [edi + 0xdf]
push word [esp + 0xc]
bts di, ax
mov di, word [esp + 0x12]
jmp 0x57f33d
setle dh
pop word [esp + 4]
neg bh
lea eax, [ebx + ebx]
lea eax, [ebx*4]
push dword [esp]
jmp 0x57f1b8
mov ebx, dword [esp + 1]
jmp 0x580775
Function at 0x580af2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop bp
mov ax, di
std
xchg byte [esp + 1], dl
mov byte [esp + 1], bl
not edi
jmp 0x580add
lea edi, [esi + 0xc0]
pop dword [esp]
setnp dh
neg al
xchg ebp, ebx
mov dword [esp], ecx
jmp 0x580a97
pushfd
mov ax, 0x1bbd
call fcn.00580ac2
setp dh
shl ebp, cl
call 0x580af2
xchg ecx, eax
jmp 0x580b20
bswap eax
cmp ax, 0xbdb8
not ch
lea esi, [esi + edi]
dec bp
lea esp, [esp + 0xd]
jmp 0x580b70
mov cl, al
mov di, 0xd27c
mov edx, ecx
lea edx, [ecx + ebp]
or ah, 0xd0
push word [esp + 1]
jmp 0x580aad
pop eax
bts ecx, edx
lea edi, [ebx*4]
xchg byte [esp + 0xc], dl
setp cl
jmp 0x580af4
add esp, 1
xchg byte [esp + 3], dl
lea esp, [esp]
lea esi, [edi*4]
lea ebx, [ebp*4]
cpuid
jmp 0x580b0b
mov edx, esp
add esp, 1
xchg byte [esp], cl
cpuid
sub esp, 0x13
mov ch, byte [esp + 0xe]
jmp 0x580bff
xchg cx, ax
mov word [esp], sp
sete bh
not si
bswap edi
mov bx, 0xd03d
jmp 0x580b55
pop dword [esp]
bsr ax, sp
shr ecx, cl
bswap ebx
rdtsc
jmp 0x580bc2
pop word [esp + 8]
mov edi, ebp
std
setno al
mov ch, 0xfa
xchg bx, ax
jmp 0x580b84
mov si, word [esp + 7]
xchg bh, dl
mov word [esp + 1], bp
jmp 0x580bd4
lea ebx, reloc.MFC42.DLL_CWnd::OnCommand
mov ch, 0x9d
mov ax, cx
xchg ecx, edi
pushfd
xchg bl, al
jmp 0x580bac
mov edi, 0xb1a29cc
or si, si
inc edi
cmc
mov edx, dword [esp + 2]
pushfd
jmp 0x580be9
mov eax, dword [esp + 0xd]
add esp, 9
btc di, sp
lea edx, [eax + esi]
jmp 0x580c13
bswap ecx
mov edx, dword [esp + 6]
setnp bl
pop word [esp + 0xf]
neg bl
mov ch, cl
jmp 0x580b9a
bsf ebp, esp
rcl bp, 4
rdtsc
std
bsr si, bp
call fcn.00580cd3
scasb al, byte es:[edi]
inc ebx
sal dword [esi + reloc.MFC42.DLL_CWnd::OnCommand], cl
shl eax, cl
popal
mov cx, word [esp + 1]
sub esp, 0
xchg dword [esp], esi
push sp
jmp 0x580b39

Function at 0x5810a1
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x7c], edi
lea esp, [esp + 0x7c]
jmp 0x5810bc
Function at 0x44f4a0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x100
lea ecx, [esp]
push esi
push eax
push str.binPUK2cutdat_d.aut
push ecx
call fcn.0050543d
lea edx, [esp + 0x10]
push 0x5190c4
push edx
call fcn.00505b50
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x44f53a
mov eax, dword [0x8e53fc]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x10
push 0x51815c
push 0x5211b4
push eax
call esi
mov ecx, dword [0x8e53fc]
push 0x11
push 0x51cbc0
push str.FAQ____
push ecx
call esi
cmp eax, 1
jne 0x44f520
mov edx, dword [0x8e53fc]
push eax
push 0
push 0
push 0x51d17c
push 0
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [0x8e53fc]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
add esp, 0x100
ret
push esi
push 0x749a3
push 1
push 0xa2e500
call fcn.00505b63
push esi
call fcn.005058b0
add esp, 0x14
pop esi
add esp, 0x100
ret
Function at 0x4db500
Capabilities:
Create http request
Initialize winsock library
Read data from internet
Receive data

Disassembly:
sub esp, 0x394
lea eax, [esp + 4]
push ebp
push esi
push edi
push str._PUK3_newest.txt
push str.http:__ygq12.gicp.net:8_s
push eax
call fcn.0050543d
add esp, 0xc
push 0
push 0
push 0
push 0
push str.CROSSGATE
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebp, eax
test ebp, ebp
je 0x4db55d
push 0
push closesocket
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
jne 0x4db58b
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea eax, [esp + 0x210]
xor esi, esi
push eax
push 0x101
mov dword [0xc30798], esi
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x4db696
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x394
ret
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
xor eax, eax
mov dword [0xc307a0], eax
lea edx, [eax + 0x800]
mov dword [esp + 0xc], 0x800
cmp edx, 0x4000
ja 0x4db5dc
lea ecx, [esp + 0xc]
lea edx, [eax + 0xc307a4]
push ecx
push 0x800
push edx
push esi
call edi
test eax, eax
je 0x4db60c
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4db61d
mov eax, dword [0xc307a0]
add eax, ecx
mov dword [0xc307a0], eax
jmp 0x4db598
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebp
call esi
mov eax, dword [0x8e53fc]
push 0x10
push str.NewestInitNetWork
push str.newest.txt_read
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x394
ret
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebp
call esi
jmp 0x4db55d
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebp
call esi
mov ecx, dword [0xc307a0]
mov byte [ecx + 0xc307a4], 0
movsx ecx, word [0x54a164]
lea eax, [ecx + ecx*2]
shl eax, 6
add eax, ecx
lea ecx, [esp + 0x110]
lea edx, [eax + 0xc1fef0]
lea eax, [eax + 0xc1fe70]
push edx
push eax
push str._s:_s
push ecx
call fcn.0050543d
lea edx, [esp + 0x120]
push edx
push 0xc307a4
call fcn.00505660
add esp, 0x18
test eax, eax
je 0x4db55d
mov eax, 1
pop edi
pop esi
mov dword [0xc30798], eax
pop ebp
add esp, 0x394
ret
mov dword [0xc307a0], esi
pop edi
pop esi
mov byte [0xc307a4], 0
mov eax, 1
pop ebp
add esp, 0x394
ret
Function at 0x4db6c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
mov eax, dword [0xc30798]
sub esp, 0x20
test eax, eax
jne 0x4db79f
mov eax, dword [str.ygq12.gicp.net:8GET__s_HTTP_1._0_n_n]
mov ecx, dword [0x54a534]
mov edx, dword [0x54a538]
mov dword [esp], eax
mov eax, dword [0x54a53c]
push 0
push 1
push 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [0xc3079c], eax
jne 0x4db714
mov eax, 0xfffffffd
add esp, 0x20
ret
push 0x50
mov word [esp + 0x14], 2
call sub.WSOCK32.dll_htons
lea ecx, [esp]
mov word [esp + 0x12], ax
push ecx
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x4db767
lea edx, [esp]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x4db75c
mov eax, dword [0xc3079c]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, 0xfffffffc
add esp, 0x20
ret
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esp + 0x14], eax
mov edx, dword [0xc3079c]
lea ecx, [esp + 0x10]
push 0x10
push ecx
push edx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x4db79f
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4db79f
mov eax, dword [0xc3079c]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, 0xfffffffb
add esp, 0x20
ret
mov eax, 1
add esp, 0x20
ret

Function at 0x4db7b0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov eax, dword [0xc30798]
sub esp, 0x100
test eax, eax
jne 0x4db7fa
push edi
push str._PUK3_newest.txt
lea eax, [esp + 8]
push 0x54a540
push eax
call fcn.0050543d
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0xc3079c]
push 0
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xc]
push ecx
push edx
call sub.WSOCK32.dll_send
pop edi
add esp, 0x100
ret
Function at 0xef1653
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0xef16bf
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0xef1708
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00f0ab00
add esp, 8
test eax, eax
jne 0xef1706
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0xef170a
jmp 0xef16b6
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0xefd99a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0xefd9aa
xor eax, eax
jmp 0xefdb73
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0xefdb2b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xf2defc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xf2defc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xf2defc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xf2defc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xf2defc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xf2defc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xf2defc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0xf2defc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0xefd9b3
cmp dword [ebp + 0x10], 0
je 0xefdb6d
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0xf2defc]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0xefdb31
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x40c810
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x467abb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045c676
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40c892
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045a58d
mov eax, dword [eax]
push 0x47c1d0
push eax
call fcn.0044d3f4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045c901
test bl, bl
je 0x40c892
push 0x47c1d0
lea ecx, [esp + 0xc]
call fcn.0045cc91
push 0x47fd44
lea ecx, [esp + 0xc]
call fcn.0045cc91
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40c8ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045c901
jmp 0x40c999
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40c952
lea edx, [esp + 0x7c]
push 0x47fd40
push edx
call fcn.0044d3f4
add esp, 8
test eax, eax
je 0x40c952
lea eax, [esp + 0x7c]
push 0x47fd3c
push eax
call fcn.0044d3f4
add esp, 8
test eax, eax
je 0x40c952
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c8e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045c901
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40d190
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40d1f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40d200
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x467b3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4861e8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40d338
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40d266
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045c901
xor eax, eax
jmp 0x40d3af
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045ca3e
push esi
lea ecx, [esp + 0xc]
call fcn.0045cccd
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40d38d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.0040d190
test eax, eax
jne 0x40d38d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.0040d190
test eax, eax
jne 0x40d38d
lea eax, [esp + 0x14]
push 0x47fd58
push eax
call fcn.0044e430
mov esi, eax
add esp, 8
test esi, esi
jne 0x40d36c
lea ecx, [esp + 0x14]
push 0x47fd54
push ecx
call fcn.0044e3b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40d36c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40d36f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045c9ee
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40d27e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045c901
xor eax, eax
jmp 0x40d3af
mov byte [esi], 0
push 0x47fd50
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045c901
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4