joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403cee
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
test eax, eax
js 0x403d2e
add eax, dword [0x443b84]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [0x4208e0], eax
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov eax, 4
call fcn.00403aff
test eax, eax
mov ebx, eax
js 0x403e97
lea eax, [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, 0xfffffffd
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
lea edi, [ebp - 0x24]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 4
mov dword [esp], eax
call esi
sub esp, 0x14
test eax, eax
je 0x403e97
cmp dword [ebp - 0x24], 4
jne 0x403e97
mov eax, dword [ebp - 0x20]
add dword [0x4208e0], 4
call fcn.00403aff
test eax, eax
mov ebx, eax
js 0x403e97
cmp dword [ebp + 0x10], 0
jne 0x403e49
jmp 0x403e39
cmp eax, 0x4000
mov esi, 0x4000
cmovle esi, eax
mov eax, dword [0x40a010]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 0x4208e4
mov dword [esp], eax
call dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
je 0x403e8b
cmp esi, dword [ebp - 0x24]
jne 0x403e8b
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0x4208e4
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x403e92
cmp dword [ebp - 0x1c], esi
jne 0x403e92
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x20], eax
add dword [0x4208e0], eax
add ebx, eax
jmp 0x403e3c
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x20]
test eax, eax
jg 0x403db2
jmp 0x403e97
mov eax, dword [ebp - 0x20]
mov ebx, 0xfffffffd
cmp dword [ebp + 0x14], eax
cmovle eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [0x40a010]
mov dword [esp + 0xc], edi
mov dword [esp + 4], edx
mov dword [esp], eax
call esi
sub esp, 0x14
test eax, eax
je 0x403e97
mov ebx, dword [ebp - 0x24]
add dword [0x4208e0], ebx
jmp 0x403e97
mov ebx, 0xfffffffd
jmp 0x403e97
mov ebx, 0xfffffffe
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x407474
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [0x43e94c], 0x44
mov dword [esp + 0x20], 0x43e94c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor edx, edx
sub esp, 0x28
test eax, eax
je 0x4074f0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push eax
mov eax, edx
leave
ret 4

Function at 0x4077a0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
je 0x4077cb
and eax, 0xfffffffe
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
push ebx
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4077d2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, 0
cmp eax, 0xffffffff
push ecx
cmove eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc

Function at 0x40782e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x65
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x1c]
jmp 0x40788c
mov dword [ebp - 0x1c], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [ebp - 0x2c], eax
div ecx
mov dword [ebp - 0x30], edx
mov cl, byte [ebp - 0x30]
add ecx, 0x61
mov byte [ebp - 0x1a], cl
mov ecx, dword [ebp + 0xc]
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
jne 0x407894
dec esi
jne 0x407844
mov byte [ebx], 0
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4078a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x14]
cmp dword [ebp + 0x18], 1
lea edx, [ebp - 0x14]
sbb eax, eax
xor al, al
add eax, 0x20119
mov byte [ebx], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x407942
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0x2000
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x40792b
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
jbe 0x40792e
mov byte [ebx], 0
mov eax, dword [ebp - 0x14]
mov byte [ebx + 0x1fff], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x407e38
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], 0x440990
mov dword [esp + 4], eax
call fcn.00407a0d
push ebx
push ebx
mov dword [esp], 0x440990
call fcn.00407688
mov ebx, eax
xor eax, eax
test ebx, ebx
push esi
je 0x407ee6
mov dword [esp], ebx
call fcn.00407a4b
test byte [0x443b90], 0x80
push ecx
je 0x407ea6
mov al, byte [ebx]
cmp al, 0x5c
je 0x407ee4
test al, al
jne 0x407ea6
jmp 0x407ee4
call fcn.00407e00
test eax, eax
push edx
je 0x407e97
test byte [eax], 0x10
je 0x407ee4
mov dword [esp], 0x440990
call fcn.0040761c
push ecx
jmp 0x407eb2
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub ebx, 0x440990
mov dword [esp], 0x440990
call esi
cmp eax, ebx
push edx
mov dword [esp], 0x440990
jg 0x407e88
call fcn.004075a6
push ecx
mov dword [esp], 0x440990
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
setne al
push ebx
movzx eax, al
jmp 0x407ee6
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x4084e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x4436d4], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x408521
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x4084fe
mov dword [edx*4 + 0x4436d0], eax
inc edx
cmp edx, 0x100
jne 0x4084f7
mov eax, dword [ebp + 8]
not eax
jmp 0x40853b
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x4436d0]
test ebx, ebx
jne 0x408528
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x414b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x414b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b80
mov eax, 1
add ebx, ebx
jne 0x414ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b98
jne 0x414bb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b98
xor ecx, ecx
sub eax, 3
jb 0x414bc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c3a
mov ebp, eax
add ebx, ebx
jne 0x414bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414c04
inc ecx
add ebx, ebx
jne 0x414bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414be5
jne 0x414c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414be5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414c15
jmp 0x414b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414c24
add edi, ecx
jmp 0x414b86
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c42
cmp byte [edi], 5
jne 0x414c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c47
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414cbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19be8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c74
mov ecx, edi
jns 0x414ca3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19c2c]
or eax, eax
je 0x414cb9
mov dword [ebx], eax
add ebx, 4
jmp 0x414c91
call dword [esi + 0x19c28]
mov ebp, dword [esi + 0x19c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cf3
sub esp, 0xffffff80
jmp 0x401150
Function at 0x2aa2580
Capabilities:
Decompress data using aplib

Disassembly:
call 0x2aa26d0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x2aa25a6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2aa2592
add dl, dl
jne 0x2aa25b1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2aa2604
xor eax, eax
add dl, dl
jne 0x2aa25be
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2aa26a5
add dl, dl
jne 0x2aa25cd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2aa25d8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2aa25e3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2aa25ee
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x2aa25fa
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x2aa259d
mov eax, 1
add dl, dl
jne 0x2aa2612
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2aa261d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2aa2609
sub eax, ebx
mov ebx, 1
jne 0x2aa2650
mov ecx, 1
add dl, dl
jne 0x2aa2636
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2aa2641
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2aa262d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2aa259d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x2aa2667
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2aa2672
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2aa265e
cmp eax, 0x7d00
jae 0x2aa2695
cmp eax, 0x500
jb 0x2aa2690
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2aa259d
cmp eax, 0x7f
ja 0x2aa2698
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2aa259d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x2aa26c6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x2aa259d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4f3590
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x90000]
push edi
or ebp, 0xffffffff
jmp 0x4f35b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4f35b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f35a8
mov eax, 1
add ebx, ebx
jne 0x4f35cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4f35dc
jne 0x4f35fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f35fb
dec eax
add ebx, ebx
jne 0x4f35e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4f35c0
add ebx, ebx
jne 0x4f35f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4f364d
xor ecx, ecx
sub eax, 3
jb 0x4f3613
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4f3682
sar eax, 1
mov ebp, eax
jmp 0x4f361e
add ebx, ebx
jne 0x4f361e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f35ec
inc ecx
add ebx, ebx
jne 0x4f362c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f35ec
add ebx, ebx
jne 0x4f3639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4f362e
jne 0x4f364a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4f362e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4f366c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4f365e
jmp 0x4f35ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4f366c
add edi, ecx
jmp 0x4f35ae
pop esi
mov edi, esi
mov ecx, 0x2c66
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4f368a
cmp byte [edi], 0x1e
jne 0x4f368a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4f368f
lea edi, [esi + 0xf0000]
mov eax, dword [edi]
or eax, eax
je 0x4f3707
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x104814]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x104918]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4f36bc
mov ecx, edi
jns 0x4f36eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10491c]
or eax, eax
je 0x4f3701
mov dword [ebx], eax
add ebx, 4
jmp 0x4f36d9
call dword [esi + 0x10492c]
mov ebp, dword [esi + 0x104920]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4f373b
sub esp, 0xffffff80
jmp 0x45f076
Function at 0x412e85
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
push 0
push 0
push getpeername
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_FoldersCookies
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x41cbb0
call fcn.0041b3ee
add esp, 0x28
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x412eec
push ebx
call fcn.0041b3fa
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
push str..txt
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 2
call fcn.004012a4
add esp, 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push eax
push 1
push 0
push dword [ebp - 0xc]
mov eax, 0
call fcn.0041b3e8
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x412f3a
push ebx
call fcn.0041b3fa
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x412f4e
push ebx
call fcn.0041b3fa
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x49e373
push dword [ebp - 4]
call fcn.0040100b
add esp, 8
cmp eax, 0
je 0x413099
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0x80000301
push 0
push 1
push getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x412f98
mov eax, 0x49e373
push eax
push getpeername
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x412fac
mov eax, 0x49e373
push eax
push 4
mov ebx, 0x41b910
call fcn.0041b3ee
add esp, 0x34
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x412feb
push 0x49e373
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.0040100b
add esp, 8
cmp eax, 0
je 0x412feb
xor eax, eax
jmp 0x412ff0
mov eax, 1
test eax, eax
je 0x41305f
push dword [ebp - 4]
push 0x4a4e64
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 3
call fcn.004012a4
add esp, 0xc
mov dword [ebp - 0xc], eax
push getpeername
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x413028
mov eax, 0x49e373
push eax
push 1
mov ebx, 0x41c640
call fcn.0041b3ee
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41304e
push ebx
call fcn.0041b3fa
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x41305f
mov dword [ebp - 8], 1
lea eax, [ebp - 0x20]
push eax
push 1
push 0
push 0
mov eax, 0
call fcn.0041b3e8
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x413090
push ebx
call fcn.0041b3fa
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x412f52
mov eax, dword [ebp - 8]
jmp 0x4130a1
push eax
push dword [ebp - 0x20]
mov eax, 1
call fcn.0041b3e8
add esp, 4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4130c2
push ebx
call fcn.0041b3fa
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x426040
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x497c1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048c686
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4260c2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048a59d
mov eax, dword [eax]
push 0x4b71cc
push eax
call fcn.0047d214
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0048c911
test bl, bl
je 0x4260c2
push 0x4b71cc
lea ecx, [esp + 0xc]
call fcn.0048cca1
push 0x4bae84
lea ecx, [esp + 0xc]
call fcn.0048cca1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4260fe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0048c911
jmp 0x4261c9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x426182
lea edx, [esp + 0x7c]
push 0x4bae80
push edx
call fcn.0047d214
add esp, 8
test eax, eax
je 0x426182
lea eax, [esp + 0x7c]
push 0x4bae7c
push eax
call fcn.0047d214
add esp, 8
test eax, eax
je 0x426182
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x426112
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0048c911
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4269c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x426a22
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x426a30
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x497c9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4c4358]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x426b68
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x426a96
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048c911
xor eax, eax
jmp 0x426bdf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0048ca4e
push esi
lea ecx, [esp + 0xc]
call fcn.0048ccdd
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x426bbd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.004269c0
test eax, eax
jne 0x426bbd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.004269c0
test eax, eax
jne 0x426bbd
lea eax, [esp + 0x14]
push 0x4bae98
push eax
call fcn.0047e360
mov esi, eax
add esp, 8
test esi, esi
jne 0x426b9c
lea ecx, [esp + 0x14]
push 0x4bae94
push ecx
call fcn.0047e2e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x426b9c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x426b9f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0048c9fe
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x426aae
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048c911
xor eax, eax
jmp 0x426bdf
mov byte [esi], 0
push 0x4bae90
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0048c911
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4