joyce8/EMBER2024-capa huggingface dataset:
Function at 0x555da2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.00485650
mov eax, dword [0x5b906c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x1018], ebx
call fcn.005483bd
push ebx
lea esi, [eax - 1]
mov dword [ebp - 0x1020], esi
call fcn.00561ac3
pop ecx
pop ecx
test esi, esi
jne 0x555e18
push 1
push ebx
push edi
call fcn.0055642c
mov esi, dword [ebp + 0x10]
add esp, 0xc
mov ebx, eax
inc esi
push dword [ebp - 0x1018]
call fcn.0051cb2f
pop ecx
test eax, eax
je 0x555f74
push 0
push 0
push edi
call fcn.00549a1d
jmp 0x555f6f
push str.too_many_arguments
lea eax, [esi + 0x14]
push eax
push edi
call fcn.0054988f
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov eax, dword [ebp - 0x1020]
add esp, 0xc
inc ebx
mov dword [ebp - 0x101c], esi
dec eax
mov dword [ebp - 0x1020], eax
test ebx, ebx
je 0x555df5
push esi
push edi
call fcn.00549173
pop ecx
pop ecx
cmp eax, 3
jne 0x555ee5
push esi
push edi
call fcn.0054971c
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x555e95
mov ebx, dword [ebp - 0x1018]
push ebx
call fcn.0051cf80
mov esi, eax
push ebx
push esi
call fcn.0051d6d9
push 0x5a1acc
push edi
call fcn.00548883
xor ebx, ebx
add esp, 0x14
cmp esi, 0xffffffff
setne bl
jmp 0x555edd
lea eax, [ebp - 0x1014]
push eax
push edi
call fcn.00549670
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00549fa6
push dword [ebp - 0x1018]
push esi
push 1
push eax
call fcn.0051dae1
mov esi, eax
lea eax, [ebp - 0x1014]
add dword [ebp - 0x100c], esi
push eax
call fcn.0054a025
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb ebx, ebx
neg ebx
mov esi, dword [ebp - 0x101c]
jmp 0x555f49
push 0
push esi
push edi
call fcn.0054977c
add esp, 0xc
cmp byte [eax], 0x2a
jne 0x555ef7
inc eax
movsx eax, byte [eax]
sub eax, 0x4c
je 0x555f36
sub eax, 0x15
je 0x555f23
sub eax, 0xb
je 0x555f1f
dec eax
sub eax, 1
jne 0x555f63
push dword [ebp - 0x1018]
push edi
call fcn.00556541
pop ecx
pop ecx
jmp 0x555f47
push 1
jmp 0x555f38
push dword [ebp - 0x1018]
push edi
call fcn.005563b8
pop ecx
xor ebx, ebx
pop ecx
inc ebx
jmp 0x555f49
push 0
push dword [ebp - 0x1018]
push edi
call fcn.0055642c
add esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x1020]
inc esi
mov dword [ebp - 0x101c], esi
test eax, eax
jne 0x555e3c
jmp 0x555df5
push str.invalid_format
push esi
push edi
call fcn.00549593
add esp, 0xc
jmp 0x555f8e
test ebx, ebx
jne 0x555f89
push 0xfffffffffffffffe
push edi
call fcn.00548e3e
push edi
call fcn.00548851
add esp, 0xc
sub esi, dword [ebp + 0x10]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00484900
mov esp, ebp
pop ebp
ret
Function at 0x555f9f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.005483bd
mov edi, dword [ebp + 0x10]
pop ecx
push 1
pop esi
sub eax, edi
je 0x556065
dec eax
push edi
push ebx
mov dword [ebp - 4], eax
call fcn.00549173
pop ecx
pop ecx
cmp eax, 3
jne 0x556038
push edi
push ebx
call fcn.00548478
pop ecx
pop ecx
push 0
push edi
push ebx
test eax, eax
je 0x555ffa
call fcn.00548fca
push edx
push eax
push str._lld
push dword [ebp + 0xc]
call fcn.005339cc
add esp, 0x1c
jmp 0x556015
call fcn.00549093
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [ebp + 0xc]
call fcn.005339cc
add esp, 0x10
test esi, esi
je 0x55601d
test eax, eax
jg 0x556060
xor esi, esi
mov eax, dword [ebp - 4]
inc edi
test eax, eax
jne 0x555fbe
test esi, esi
jne 0x556065
push esi
push esi
push ebx
call fcn.00549a1d
add esp, 0xc
jmp 0x556068
lea eax, [ebp + 0x10]
push eax
push edi
push ebx
call fcn.0054977c
add esp, 0xc
test esi, esi
je 0x55601d
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.0051d37b
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jne 0x55601d
xor esi, esi
inc esi
jmp 0x55601f
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5563b8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00485650
mov eax, dword [0x5b906c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1014]
push esi
mov esi, dword [ebp + 0xc]
push edi
push ecx
push eax
call fcn.00549670
pop ecx
pop ecx
mov edi, 0x1000
lea eax, [ebp - 0x1014]
push edi
push eax
call fcn.00549fa6
push esi
push edi
push 1
push eax
call fcn.0051dae1
add dword [ebp - 0x100c], eax
add esp, 0x18
cmp eax, edi
je 0x5563eb
lea eax, [ebp - 0x1014]
push eax
call fcn.0054a025
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00484900
mov esp, ebp
pop ebp
ret
Function at 0x5601df
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x5b906c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5df1d4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x5df1c4
jne 0x560269
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00515560
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x444]
call fcn.00405330
push eax
mov ecx, edi
call fcn.004052e0
push 0
push 1
lea ecx, [ebp - 0x444]
call fcn.00405bc0
push ebx
lea ecx, [ebp - 0x42c]
call fcn.004053b0
cmp dword [0x5df1d8], 8
lea ecx, [ebp - 0x444]
cmovae edi, dword [0x5df1c4]
push edi
call fcn.00405330
push str._install_path_
lea ecx, [ebp - 0x45c]
call fcn.00405330
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.00560108
add esp, 0xc
lea ecx, [ebp - 0x45c]
xor ebx, ebx
push ebx
push 1
call fcn.00405bc0
push ebx
push 1
lea ecx, [ebp - 0x444]
call fcn.00405bc0
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00515560
add esp, 0xc
lea ecx, [ebp - 0x414]
cmp dword [ebp - 0x418], 8
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
call fcn.00405330
cmp dword [esi + 0x14], 8
mov byte [ebp - 0x45d], 0x5c
mov byte [ebp - 0x45e], 0x2f
jb 0x56033c
mov ecx, dword [esi]
jmp 0x56033e
mov ecx, esi
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
lea eax, [ecx + eax*2]
jb 0x56034e
mov ecx, dword [esi]
jmp 0x560350
mov ecx, esi
lea edx, [ebp - 0x45d]
push edx
lea edx, [ebp - 0x45e]
push edx
push eax
push ecx
call fcn.00503e08
add esp, 0x10
lea ecx, [ebp - 0x42c]
push ebx
push 1
call fcn.00405bc0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00484900
mov esp, ebp
pop ebp
ret
Function at 0x560389
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5b906c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x230]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x22c
push 0
push eax
call fcn.00515560
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x560428
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x56041d
cmp dword [edi + 0x14], 8
jb 0x5603ee
mov eax, dword [edi]
jmp 0x5603f0
mov eax, edi
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x560410
lea eax, [ebp - 0x228]
mov ecx, ebx
push eax
call fcn.00560dc2
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x5603e4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00484900
mov esp, ebp
pop ebp
ret

Function at 0x560439
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x5b906c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x260]
push 0x22c
xor ebx, ebx
push ebx
push eax
call fcn.00515560
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x56047c
xor al, al
jmp 0x5604eb
lea eax, [ebp - 0x260]
mov dword [ebp - 0x260], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x5604de
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405330
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0041a300
pop ecx
pop ecx
push eax
mov ecx, edi
call fcn.00424530
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.00406070
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.00405bc0
lea eax, [ebp - 0x260]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x560495
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00484900
mov esp, ebp
pop ebp
ret
Function at 0x561606
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
push ecx
push str.kernel32.dll
mov dword [ebx], ecx
mov dword [eax], ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x56167b
push esi
push edi
call fcn.00484b8c
pop ecx
mov esi, eax
xor eax, eax
push esi
push edi
push eax
push str.kernel32.dll
mov dword [ebp + 8], eax
mov dword [ebp - 4], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x561673
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0x5a3568
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x561673
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push esi
call fcn.00484957
pop ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x561681
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
je 0x5616a3
cmp word [ebp - 0x24], 6
je 0x5616a3
xor al, al
jmp 0x5616a5
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x402640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 8]
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 0xc], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [ebp - 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00402700
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
push ebp
mov ebp, esp
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
pop ebp
shl edx, 5
add eax, edx
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x420a365d
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x6d8240aa
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x570cf0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x43b644
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
mov esi, dword [esp]
add esp, 4
inc ebx
sub edi, ebx
add edi, 0x48dc7438
call fcn.0043b683
sub edi, 0x161cbb84
xor dword [ecx], esi
add ebx, ebx
or ebx, ebx
sub ebx, ebx
inc ecx
and ebx, ebx
cmp ecx, edx
jne fcn.0043b644
or ebx, edi
add edi, ebx
sub ebx, ebx
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x3eed309b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x2b97c7a
nop
nop
nop
nop
test eax, eax
je 0x432084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x403e59
pop dword [ebp - 0x14]
mov eax, 0xa3d03447
sub eax, 0xa38ff5ee
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xc09d3c4f
add dword [ebp - 0x24], 0x8db508fc
mov dword [ebp - 0x20], 0x16e1fc72
add dword [ebp - 0x20], 0x1b514fd3
mov dword [ebp - 0x1c], 0xd2e40b88
sub dword [ebp - 0x1c], 0x8697c75a
mov dword [ebp - 0x18], 0xf660d0c6
add dword [ebp - 0x18], 0x99f2f3a
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xdbe0bfeb
add dword [ebp - 0x24], 0x9891a96b
mov dword [ebp - 0x20], 0x8295d3e0
add dword [ebp - 0x20], 0xbed68d95
mov dword [ebp - 0x1c], 0xc2003aff
add dword [ebp - 0x1c], 0xa16f316d
mov dword [ebp - 0x18], 0x53eb72d2
sub dword [ebp - 0x18], 0x53eb72d2
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xf389402e
add eax, 0xcb740a6
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3c995
push 0
call eax
mov ecx, 0x5f68
xor esi, esi
add esi, eax
mov edi, 0x411000
add edi, dword [ebp - 0x14]
mov edx, 0xe45d6d4f
sub edx, 0x15e9629f
sub dword [ebp - 0xc], 0xca496073
mov ebx, dword [edi]
add ebx, edx
xor dword [ebp - 0x10], eax
mov dword [esi], ebx
add dword [ebp - 0x10], edi
add esi, 0xe62e2569
sub esi, 0xe62e2565
add edi, 0x8cd48509
sub edi, 0x8cd48505
loop 0x403f6c
add eax, 0x90b75d27
sub eax, 0x90b5ecb4
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x418430
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a339b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00497e71
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4184b2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00495d4b
mov eax, dword [eax]
push 0x4c3ce8
push eax
call fcn.00487ce4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004980fc
test bl, bl
je 0x4184b2
push 0x4c3ce8
lea ecx, [esp + 0xc]
call fcn.0049848c
push 0x4c3cf4
lea ecx, [esp + 0xc]
call fcn.0049848c
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4184ee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004980fc
jmp 0x4185b9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x418572
lea edx, [esp + 0x7c]
push 0x4c3cf0
push edx
call fcn.00487ce4
add esp, 8
test eax, eax
je 0x418572
lea eax, [esp + 0x7c]
push 0x4c3cec
push eax
call fcn.00487ce4
add esp, 8
test eax, eax
je 0x418572
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418502
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004980fc
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x418dc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x418e22
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x418e30
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a341b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4d3140]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x418f68
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x418e96
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004980fc
xor eax, eax
jmp 0x418fdf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00498239
push esi
lea ecx, [esp + 0xc]
call fcn.004984c8
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x418fbd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00418dc0
test eax, eax
jne 0x418fbd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00418dc0
test eax, eax
jne 0x418fbd
lea eax, [esp + 0x14]
push 0x4c3d04
push eax
call fcn.00488d60
mov esi, eax
add esp, 8
test esi, esi
jne 0x418f9c
lea ecx, [esp + 0x14]
push 0x4c3d00
push ecx
call fcn.00488ce0
mov esi, eax
add esp, 8
test esi, esi
jne 0x418f9c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x418f9f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004981e9
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x418eae
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004980fc
xor eax, eax
jmp 0x418fdf
mov byte [esi], 0
push 0x4c3cfc
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004980fc
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4