joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ef0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
je 0x405f3a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x405f3a
lea edi, [eax + eax]
mov eax, edi
call fcn.00411340
mov esi, esp
test esi, esi
je 0x405f3a
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x405f3c
xor eax, eax
mov ebx, eax
lea edi, [ebp + 0xc]
call fcn.00401300
mov ebx, dword [ebp + 8]
mov eax, dword [ebx - 0x39]
mov edx, dword [eax + 0x10]
add ebx, 0xffffffc7
mov ecx, edi
push ecx
mov ecx, ebx
call edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx]
mov edx, dword [eax + 4]
push 0x14
push ecx
mov ecx, ebx
call edx
lea eax, [ebp + 8]
push eax
call fcn.00411bf0
mov ecx, dword [ebp + 0xc]
push 0x5c
push ecx
call fcn.0040b240
add esp, 0xc
test eax, eax
je 0x406015
mov ecx, dword [ebp + 0xc]
sub eax, ecx
cmp eax, 0xffffffff
je 0x406015
lea esi, [eax + 1]
test esi, esi
jge 0x405fa0
xor esi, esi
jmp 0x405fa9
mov eax, dword [ecx - 8]
cmp esi, eax
jle 0x405fa9
mov esi, eax
mov edi, dword [0x424d88]
test esi, esi
je 0x405fec
lea edx, [esi + 0xd]
push edx
call fcn.0040ade5
add esp, 4
test eax, eax
je 0x405fec
mov dword [eax], 1
mov byte [eax + esi + 0xc], 0
mov dword [eax + 4], esi
mov dword [eax + 8], esi
lea edi, [eax + 0xc]
lea eax, [esi + 1]
cmp eax, esi
jb 0x405fec
mov ecx, dword [ebp + 0xc]
push esi
push ecx
push edi
call fcn.0040b610
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea edx, [edi - 0xc]
cmp edx, 0x424d78
je 0x406015
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x406015
push edi
call fcn.0040b07a
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov edi, 0x80004005
test esi, esi
je 0x406058
push str.DllRegisterServer
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406051
call eax
mov edi, eax
test edi, edi
jl 0x406051
mov eax, dword [ebp + 0xc]
mov edx, dword [ebx]
mov edx, dword [edx + 8]
push eax
push 4
mov ecx, ebx
call edx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esi - 0xc]
cmp eax, 0x424d78
je 0x406083
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x406083
push esi
call fcn.0040b07a
add esp, 4
mov eax, dword [ebp + 0xc]
lea ecx, [eax - 0xc]
cmp ecx, 0x424d78
je 0x4060ae
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4060ae
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.0040b07a
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x408b70
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
cmp byte [esp + 0x10], 0
je 0x408b8a
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x257a]
dec eax
mov dword [esp], eax
jmp 0x408b97
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x257a]
mov dword [esp], edx
push ebx
push ebp
xor ebp, ebp
cmp dword [esp + 8], ebp
mov dword [esp + 0x18], ebp
mov ebx, 0x100
jl 0x408cb6
push edi
nop
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x2572]
mov edi, ebx
movzx ebx, byte [ecx + ebp]
inc ebp
cmp dword [esi + 0x2804], 0x2800
jne 0x408bfd
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x408bfd
push 0
lea edx, [esp + 0x14]
push edx
push 0x2800
lea ecx, [esi + 4]
push ecx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esi + 0x2804], 0
mov edx, dword [esi + 0x2804]
mov byte [edx + esi + 4], bl
mov edx, 1
add dword [esi + 0x2804], edx
mov eax, dword [esi + 0x2804]
cmp ebx, edi
je 0x408c25
mov dword [esp + 0x1c], edx
jmp 0x408cab
mov ecx, dword [esp + 0x1c]
add ecx, edx
cmp ecx, 4
mov dword [esp + 0x1c], ecx
jl 0x408cab
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x2572]
xor edi, edi
cmp byte [edx + ebp], 0
jbe 0x408ca2
cmp eax, 0x2800
jne 0x408c79
mov ecx, dword [esi]
cmp ecx, 0xffffffff
je 0x408c79
push 0
lea edx, [esp + 0x20]
push edx
push eax
lea eax, [esi + 4]
push eax
push ecx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esi + 0x2804], 0
mov ecx, dword [esi + 0x2804]
mov edx, dword [esp + 0x18]
mov byte [ecx + esi + 4], bl
inc dword [esi + 0x2804]
mov ecx, dword [edx + 0x2572]
movzx edx, byte [ecx + ebp]
mov eax, dword [esi + 0x2804]
inc edi
cmp edi, edx
jl 0x408c46
inc ebp
mov dword [esp + 0x1c], 0
cmp ebp, dword [esp + 0xc]
jle 0x408bb0
pop edi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x40940f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi], 0xffffffff
push edi
mov ebx, eax
je 0x409423
call fcn.004093d5
xor edi, edi
push edi
push 0x80
push dword [ebp + 0x10]
push edi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x409448
xor al, al
jmp 0x40948c
cmp ebx, edi
jne 0x409456
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push edi
push ebx
push edi
push dword [ebp + 0x14]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
cmp eax, edi
jne 0x409473
call fcn.004093d5
jmp 0x409444
push ebx
push edi
push edi
push dword [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
cmp eax, edi
je 0x40946c
mov dword [esi + 0xc], ebx
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x40a951
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4251f8], 0
push esi
jne 0x40a8c4
call fcn.0040a7ea
test eax, eax
je 0x40a907
mov eax, dword [0x4251f8]
cmp eax, 1
jne 0x40a8e5
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40a907
pop esi
ret
push eax
call dword [0x425200]
test eax, eax
jne 0x40a94f
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40a90b
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4251f8]
call dword [0x425200]
mov edi, eax
test edi, edi
je 0x40a930
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40a94c
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4251f8]
call dword [0x4251fc]
add edi, 0x10
cmp edi, esi
jb 0x40a938
mov eax, edi
pop edi
pop esi
ret
jmp 0x40a8b1

Function at 0x40f9d4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424a48]
jne 0x40f9de
repz ret
jmp fcn.00410f01

Function at 0x410b4a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040ddac
and dword [ebp - 4], 0
cmp dword [0x425894], 0
mov ebx, eax
jne 0x410bfb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410cac
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41f534
push edi
call esi
test eax, eax
je 0x410cac
push eax
call fcn.0040dd3a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425894], eax
call esi
push eax
call fcn.0040dd3a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425898], eax
call esi
push eax
call fcn.0040dd3a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42589c], eax
call esi
push eax
call fcn.0040dd3a
pop ecx
mov dword [0x4258a4], eax
test eax, eax
je 0x410bfb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040dd3a
pop ecx
mov dword [0x4258a0], eax
mov eax, dword [0x4258a0]
cmp eax, ebx
je 0x410c53
cmp dword [0x4258a4], ebx
je 0x410c53
push eax
call fcn.0040ddb5
push dword [0x4258a4]
mov esi, eax
call fcn.0040ddb5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x410c53
test edi, edi
je 0x410c53
call esi
test eax, eax
je 0x410c4a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410c4a
test byte [ebp - 0xc], 1
jne 0x410c53
or dword [ebp + 0x10], 0x200000
jmp 0x410c8c
mov eax, dword [0x425898]
cmp eax, ebx
je 0x410c8c
push eax
call fcn.0040ddb5
pop ecx
test eax, eax
je 0x410c8c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410c8c
mov eax, dword [0x42589c]
cmp eax, ebx
je 0x410c8c
push eax
call fcn.0040ddb5
pop ecx
test eax, eax
je 0x410c8c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425894]
call fcn.0040ddb5
pop ecx
test eax, eax
je 0x410cac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410cae
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411420
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
mov edi, eax
mov eax, 0x5a4d
cmp word [edi], ax
je 0x411431
xor eax, eax
pop edi
ret
mov ecx, dword [edi + 0x3c]
cmp ecx, 0x2000
ja 0x41142d
cmp dword [ecx + edi], 0x4550
jne 0x41142d
movzx eax, word [ecx + edi + 0x14]
lea edx, [ecx + edi + 0x18]
push ebp
mov ebp, dword [edx + 0x3c]
add eax, edx
cmp byte [eax], 0x55
push esi
jne 0x411472
cmp byte [eax + 1], 0x50
jne 0x411472
cmp byte [eax + 2], 0x58
jne 0x411472
cmp byte [eax + 3], 0x30
jne 0x411472
sub ebp, 0xc00
movzx edi, word [ecx + edi + 6]
push ebx
xor edx, edx
xor esi, esi
xor ebx, ebx
cmp edi, 2
jl 0x41149e
lea ecx, [edi - 2]
shr ecx, 1
inc ecx
lea ebx, [ecx + ecx]
lea esp, [esp]
add edx, dword [eax + 0x10]
add esi, dword [eax + 0x38]
add eax, 0x50
sub ecx, 1
jne 0x411490
cmp ebx, edi
pop ebx
jge 0x4114a6
add ebp, dword [eax + 0x10]
lea eax, [esi + edx]
pop esi
add eax, ebp
pop ebp
pop edi
ret

Function at 0x411950
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push edi
lea ecx, [esp + 8]
push ecx
mov edi, eax
mov eax, dword [0x424d88]
push edx
push 0
mov dword [edi], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x4119c8
push ebx
mov eax, 0x410
call fcn.00401ec0
push eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov ebx, edi
call fcn.00402190
mov ecx, dword [edi]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [edi]
lea edx, [esp + 8]
mov dword [ecx - 8], eax
push edx
mov byte [ecx + eax], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
pop ebx
test eax, eax
jl 0x4119c8
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 4]
test eax, eax
je 0x4119d8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, edi
pop edi
add esp, 8
ret

Function at 0x4119e0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [0x424d88]
mov dword [edi], eax
push 0x7fff
mov eax, 0x7fff
call fcn.00401ec0
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x411a33
mov ebx, edi
call fcn.00402190
cmp esi, 0xffffffff
jne 0x411a24
mov edx, dword [edi]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, dword [edi]
mov dword [eax - 8], esi
mov byte [eax + esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
ret
push 0x41fca5
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
call fcn.00402230
test eax, eax
je 0x411a68
mov ebx, dword [edi]
lea eax, [esi + 1]
cmp eax, esi
jb 0x411a61
push esi
push 0x41fca5
push ebx
call fcn.0040b610
add esp, 0xc
mov dword [ebx - 8], esi
mov byte [ebx + esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x411ae0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov ebx, eax
xor edi, edi
lea eax, [esp + 0x14]
push eax
push edi
lea ecx, [esp + 0x20]
push ecx
push edi
push ebx
push ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
call esi
test eax, eax
jne 0x411bd3
mov eax, dword [esp + 0x18]
cmp eax, edi
jbe 0x411bd3
cmp eax, 2
jbe 0x411b8d
cmp eax, 4
jne 0x411bd3
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push edi
push edi
push ebx
push ebp
mov dword [esp + 0x34], edi
call esi
test eax, eax
jne 0x411bd3
mov edx, dword [esp + 0x1c]
mov ecx, dword [0x424d88]
push edx
push 0x4203e4
lea edx, [esp + 0x18]
mov dword [esp + 0x18], ecx
call fcn.00401990
add esp, 8
lea ecx, [esp + 0x10]
mov esi, dword [esp + 0x24]
mov eax, esi
call fcn.00401290
lea ecx, [esp + 0x10]
call fcn.00401fb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [0x424d88]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
lea edi, [esp + 0x10]
mov esi, eax
call fcn.00401ec0
test eax, eax
je 0x411bb4
mov eax, dword [esp + 0x10]
mov dword [eax - 8], esi
mov byte [esi + eax], 0
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
test eax, eax
je 0x411b6f
call fcn.00401fb0
mov edi, dword [esp + 0x24]
mov ebx, 0x41fca5
call fcn.00401300
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x411bf0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x424d88]
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov dword [ebp], eax
mov eax, 0x7fff
mov edi, ebp
call fcn.00401ec0
push eax
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
test esi, esi
je 0x411ce7
push ebx
mov ebx, ebp
call fcn.00402190
cmp esi, 0xffffffff
jne 0x411c3a
mov ecx, dword [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, dword [ebp]
mov dword [eax - 8], esi
mov byte [eax + esi], 0
mov eax, dword [eax - 8]
mov esi, 1
cmp eax, esi
jge 0x411c52
mov esi, eax
mov edx, dword [0x424d88]
sub eax, esi
push eax
push ebp
lea edi, [esp + 0x1c]
mov dword [esp + 0x1c], edx
call fcn.00401fe0
mov esi, dword [esp + 0x14]
mov ecx, 0x41fd08
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411c94
test dl, dl
je 0x411c90
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411c94
add eax, 2
add ecx, 2
test dl, dl
jne 0x411c74
xor eax, eax
jmp 0x411c99
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea eax, [esi - 0xc]
setne bl
cmp eax, 0x424d78
je 0x411cbf
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x411cbf
push esi
call fcn.0040b07a
add esp, 4
test bl, bl
pop ebx
je 0x411d1d
push 0x41fd08
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x411d1d
mov esi, eax
push 0x41fd08
mov eax, ebp
call fcn.00402110
pop edi
pop esi
mov eax, ebp
pop ebp
ret
push 0x41fca5
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
call fcn.00402230
test eax, eax
je 0x411d1d
mov edi, dword [ebp]
lea ecx, [esi + 1]
cmp ecx, esi
jb 0x411d16
push esi
push 0x41fca5
push edi
call fcn.0040b610
add esp, 0xc
mov dword [edi - 8], esi
mov byte [edi + esi], 0
pop edi
pop esi
mov eax, ebp
pop ebp
ret
Function at 0x411da0
Capabilities:
Create process on windows
Set current directory

Disassembly:
sub esp, 0xac
push ebx
push ebp
mov ebp, dword [0x424d88]
push esi
mov esi, eax
push edi
mov ebx, ecx
mov dword [esp + 0x18], ebp
test esi, esi
je 0x411f1d
cmp byte [esi], 0
je 0x411f1d
push 0x44
lea eax, [esp + 0x74]
push 0
push eax
call fcn.0040b980
push esi
push ebx
push str.__s___s
lea eax, [esp + 0x34]
mov dword [esp + 0x88], 0x44
call fcn.00411900
add esp, 0x18
cmp byte [esp + 0xc0], 0
je 0x411ead
lea ecx, [esp + 0x14]
push ecx
call fcn.00411bf0
add esp, 4
lea ecx, [esp + 0x18]
call fcn.00401480
mov eax, dword [esp + 0x14]
lea edx, [eax - 0xc]
cmp edx, 0x424d78
je 0x411e46
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x411e46
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0040b07a
add esp, 4
lea edi, [esp + 0x14]
call fcn.00401300
mov esi, dword [esp + 0x14]
push 0x5c
push esi
call fcn.0040b240
add esp, 8
test eax, eax
je 0x411e87
sub eax, esi
cmp eax, 0xffffffff
je 0x411e87
inc eax
lea edx, [esp + 0x20]
mov ecx, edi
call fcn.00401630
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [esp + 0x20]
call fcn.00401fb0
lea edx, [esi - 0xc]
cmp edx, 0x424d78
je 0x411ea9
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x411ea9
push esi
call fcn.0040b07a
add esp, 4
mov ebp, dword [esp + 0x18]
xor eax, eax
lea edi, [esp + 0x1c]
call fcn.00401ec0
mov esi, dword [esp + 0x1c]
test eax, eax
je 0x411ec7
mov dword [esi - 0xc], 0xffffffff
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x74]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
lea eax, [esi - 0xc]
cmp eax, 0x424d78
je 0x411ef9
mov dword [esi - 0xc], 1
mov edi, dword [esp + 0x60]
cmp eax, 0x424d78
je 0x411f63
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x411f63
push esi
call fcn.0040b07a
add esp, 4
jmp 0x411f63
push 0x3c
lea eax, [esp + 0x28]
push 0
push eax
call fcn.0040b980
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], 0x3c
mov dword [esp + 0x34], str.open
mov dword [esp + 0x38], ebx
mov dword [esp + 0x44], 0xa
mov dword [esp + 0x2c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edi, dword [esp + 0x5c]
mov ebx, eax
test ebx, ebx
je 0x411f83
cmp byte [esp + 0xc0], 0
je 0x411fa0
cmp edi, 0xffffffff
je 0x411f83
test edi, edi
je 0x411f83
push edi
call fcn.00411700
add esp, 4
cmp byte [esp + 0xc0], 0
je 0x411fa0
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x411fa0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 8], 0
je 0x411fad
push ebp
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp ebx, 1
lea edx, [ebp - 0xc]
sete bl
cmp edx, 0x424d78
je 0x411fd5
lea esi, [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x411fd5
push esi
call fcn.0040b07a
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xac
ret
Function at 0x413220
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
mov eax, dword [esi + 0x15f]
push ebx
push ebp
push edi
mov dword [esi + 0x177], eax
lea ebx, [esi + 0x107]
mov ecx, 1
lea edi, [esp + 0x10]
mov eax, ebx
mov byte [esp + 0xc], 1
call fcn.004077a0
mov ecx, dword [eax]
mov edx, dword [esi + 0xeb]
mov ebp, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push ecx
push 0xf7
push edx
call ebp
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, 0x424d78
je 0x413291
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x413291
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0040b07a
add esp, 4
mov ecx, 0x1c
lea edi, [esp + 0x10]
mov eax, ebx
call fcn.004077a0
mov eax, dword [eax]
mov ecx, dword [esi + 0xeb]
push eax
push 0xf8
push ecx
call ebp
mov eax, dword [esp + 0x10]
lea edx, [eax - 0xc]
cmp edx, 0x424d78
je 0x4132df
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4132df
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0040b07a
add esp, 4
cmp byte [esi + 0x156], 0
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
je 0x413320
mov ecx, dword [esi + 0xeb]
push 0xf3
push ecx
call ebx
push 5
push eax
call ebp
mov edx, dword [esi + 0xeb]
push 0
push 0xf3
push edx
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov byte [esp + 0xc], 0
mov eax, dword [0x4250dc]
mov ecx, 0xffff
xor edi, edi
cmp ax, cx
je 0x41334f
cwde
mov edx, dword [esi + 0xeb]
push eax
push edx
call ebx
push 5
push eax
call ebp
movsx eax, word [edi*2 + 0x4250de]
inc edi
cmp eax, 0xffffffff
jne 0x413332
mov eax, dword [esi + 0xeb]
push 0x181
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
mov al, byte [esp + 0xc]
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x413b00
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14f]
xor edx, edx
mov ecx, 0x24
div ecx
push esi
push edi
mov dword [esp + 0x10], eax
test edx, edx
jne 0x413c5b
mov eax, dword [ebx + 0xbe]
lea edx, [esp + 0x14]
push edx
call fcn.00413a50
test al, al
je 0x413c5b
xor ecx, ecx
mov eax, 0x10
mov dword [esp + 0x48], eax
mov edx, 4
mul edx
seto cl
mov dword [esp + 0x38], vtable.CryptoPP::IteratedHash_unsigned_int_.0
mov dword [esp + 0x3c], 0x40
neg ecx
or ecx, eax
push ecx
call fcn.0040ade5
mov dword [esp + 0x50], eax
xor ecx, ecx
mov eax, 5
mov dword [esp + 0x54], eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040ade5
mov dword [esp + 0x5c], eax
xor ecx, ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x40], vtable.CryptoPP::SHA.0
mov dword [eax], 0x67452301
mov eax, dword [esp + 0x5c]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [esp + 0x5c]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [esp + 0x5c]
mov dword [edx + 0xc], 0x10325476
mov eax, dword [esp + 0x5c]
add esp, 8
lea ecx, [esp + 0x14]
mov dword [eax + 0x10], 0xc3d2e1f0
push ecx
mov eax, 0xf
lea esi, [esp + 0x3c]
call fcn.00409493
lea edx, [esp + 0x24]
push edx
mov edi, esi
call fcn.004095b4
mov esi, dword [esp + 0x10]
mov ebx, dword [ebx + 0x14b]
xor edx, edx
test esi, esi
jle 0x413c3c
lea eax, [esp + 0x24]
sub ebx, eax
mov ecx, 0x14
lea eax, [esp + 0x24]
lea esp, [esp]
cmp ecx, 4
jb 0x413c64
mov edi, dword [ebx + eax]
cmp edi, dword [eax]
jne 0x413c34
sub ecx, 4
add eax, 4
jmp 0x413c20
inc edx
add ebx, 0x24
cmp edx, esi
jl 0x413c13
mov eax, dword [esp + 0x54]
push eax
mov dword [esp + 0x3c], vtable.CryptoPP::IteratedHash_unsigned_int_.0
call fcn.0040b07a
mov ecx, dword [esp + 0x50]
push ecx
call fcn.0040b07a
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x54]
push ecx
mov dword [esp + 0x3c], vtable.CryptoPP::IteratedHash_unsigned_int_.0
call fcn.0040b07a
mov edx, dword [esp + 0x50]
push edx
call fcn.0040b07a
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413d20
Capabilities:
Create process on windows
Set current directory

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov ebx, eax
lea edi, [esp + 0x10]
call fcn.00401300
mov esi, dword [esp + 0x10]
mov eax, dword [esi - 8]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jle 0x413dd2
push 0x40
push esi
call fcn.0040af20
add esp, 8
test eax, eax
je 0x413dd2
sub eax, esi
test eax, eax
jle 0x413dd2
cmp dword [esi - 8], 0
jle 0x413d75
push 0x3a
push esi
call fcn.0040af20
add esp, 8
test eax, eax
je 0x413d75
sub eax, esi
jns 0x413dd2
mov ecx, dword [esi - 8]
mov eax, dword [0x424d88]
push esi
push ecx
push str.mailto:
push str.mailto:
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x20]
push edx
mov ebx, eax
call fcn.00402090
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
call fcn.00401480
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, 0x424d78
je 0x413dce
lea esi, [eax - 0xc]
push esi
call ebp
test eax, eax
jg 0x413dce
push esi
call fcn.0040b07a
add esp, 4
mov esi, dword [esp + 0x10]
mov edi, dword [0x424d88]
push 0x3c
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.0040b980
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x28], str.open
mov dword [esp + 0x2c], esi
mov dword [esp + 0x38], 0xa
mov dword [esp + 0x20], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [edi - 8], 0
je 0x413e25
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [edi - 0xc]
cmp ecx, 0x424d78
je 0x413e43
add edi, 0xfffffff4
push edi
call ebp
test eax, eax
jg 0x413e43
push edi
call fcn.0040b07a
add esp, 4
lea edx, [esi - 0xc]
cmp edx, 0x424d78
je 0x413e61
add esi, 0xfffffff4
push esi
call ebp
test eax, eax
jg 0x413e61
push esi
call fcn.0040b07a
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret