joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3124
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x51c86c], 0
jne 0x4b316e
call fcn.004b309c
cmp dword [0x51c86c], 0
jne 0x4b3169
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x51c858], eax
cmp dword [0x51c858], 0xffffffff
jne 0x4b315f
call fcn.004b30ae
xor eax, eax
jmp 0x4b3213
mov dword [0x51c86c], 1
call fcn.004b30ae
mov eax, dword [0x51c858]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jle 0x4b31cb
cmp dword [ebp - 4], 0
jne 0x4b31c9
push 0xc
call fcn.004b2160
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b31c9
mov ecx, dword [ebp - 4]
mov edx, dword [0x4f3500]
mov dword [ecx], edx
mov eax, dword [0x4f3504]
mov dword [ecx + 4], eax
mov edx, dword [0x4f3508]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x51c858]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x4b3210
cmp dword [ebp - 4], 0
je 0x4b3210
cmp dword [ebp + 8], 0
jge 0x4b3210
push 0xc
push 0x4f3500
mov edx, dword [ebp - 4]
push edx
call fcn.00486d60
add esp, 0xc
test eax, eax
jne 0x4b3210
mov eax, dword [ebp - 4]
push eax
call fcn.004b2195
add esp, 4
push 0
mov ecx, dword [0x51c858]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4c01f5
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 2
jge 0x4c020b
mov eax, 0x17
jmp 0x4c02bd
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax]
xor edx, edx
mov dl, byte [ecx + 0x4f3388]
mov eax, edx
shl eax, 2
mov ecx, dword [ebp + 8]
add ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx - 1]
xor ecx, ecx
mov cl, byte [edx + 0x4f3388]
imul ecx, ecx, 3
xor eax, ecx
xor eax, dword [ebp + 0xc]
cdq
mov ecx, 0x7f
idiv ecx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + str.Pk_]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x4c0269
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx + 0x4f3ac4]
sub edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jl 0x4c02b8
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 0x4f3b38]
cmp ecx, dword [ebp + 0xc]
jne 0x4c02b6
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov dx, word [ecx*2 + 0x4f3bac]
add edx, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHERE
push edx
call fcn.004a2074
add esp, 0xc
test eax, eax
jne 0x4c02b6
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 0x4f3c94]
mov eax, ecx
jmp 0x4c02bd
jmp 0x4c0258
mov eax, 0x17
mov esp, ebp
pop ebp
ret
Function at 0x4c7350
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x4c7361
xor eax, eax
jmp 0x4c74b5
push 1
push 0x44
call fcn.004a1ae0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4c737d
xor eax, eax
jmp 0x4c74b5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 5]
mov byte [eax + 5], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004c6fa4
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.004c70dc
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.004c6e30
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
push ecx
call fcn.004c6fa4
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.004c6e30
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
call fcn.004c6fa4
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 4]
mov byte [eax + 4], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
push ecx
call fcn.004c7350
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
call fcn.004c6e30
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
push ecx
call fcn.004c6e30
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], 0xffffffff
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 6]
mov byte [edx + 6], cl
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 7]
mov byte [edx + 7], cl
mov edx, dword [ebp - 4]
mov byte [edx + 8], 0
mov eax, dword [ebp - 4]
mov byte [eax + 9], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], 0xffffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x407890
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x4078ac
shr eax, 1
xor eax, 0xedb88320
jmp 0x4078ae
shr eax, 1
dec edx
jne 0x40789f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407898
pop esi
ret

Function at 0x4078c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078e7
call fcn.00407890
push 1
push 0x40c558
call fcn.004043fc
mov eax, edi
test esi, esi
je 0x407912
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078ed
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x407430
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.004086a0
mov esi, dword [esp + 0x14]
mov ebp, eax
push esi
call fcn.00407320
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 4
call ebx
mov edi, eax
push ebp
call fcn.004078f0
add esp, 4
cmp al, 1
je 0x4074be
push esi
call fcn.004072a0
and eax, 0xff
add esp, 4
sub eax, 2
je 0x40750c
dec eax
je 0x4074aa
dec eax
je 0x4074f8
call ebx
sub eax, edi
cmp eax, 0xbb8
jbe 0x4074b4
mov eax, esi
and eax, 0xff
push eax
push str.Cmm_d_reply_Waitting...
call fcn.00407650
add esp, 8
call ebx
push 0x64
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x407452
push 1
call fcn.00407290
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x407452
xor ecx, ecx
xor edx, edx
mov cl, byte [ebp + 5]
mov dl, byte [ebp + 2]
push ecx
xor eax, eax
mov al, byte [ebp]
xor ecx, ecx
mov cl, byte [ebp + 1]
push edx
push eax
and esi, 0xff
push ecx
push esi
push str.Cmm__d__Quit:_d__d__d__d_n
call fcn.00407650
push 0
call fcn.00407290
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
call fcn.00407290
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
and esi, 0xff
push esi
push 0x423ac4
call fcn.00407650
push 0
call fcn.00407290
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x407530
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x110
lea eax, [esp]
push ebx
push esi
push edi
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x16]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x12]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x12]
push edx
mov edx, dword [esp + 0x14]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
push str.C:_P2Debug
lea eax, [esp + 0x34]
push str._s_Y_d_02d_02d__02d_02d
push eax
call fcn.00411cb2
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
add esp, 0x20
test bl, bl
jne 0x4075b6
lea ecx, [esp + 0x1c]
push ecx
push str._s.txt
push 0x4357cc
call fcn.00411cb2
add esp, 0xc
jmp 0x4075d1
movsx edx, bl
lea eax, [esp + 0x1c]
push edx
push eax
push str._s__d_.txt
push 0x4357cc
call fcn.00411cb2
add esp, 0x10
push 0x4357cc
call esi
test eax, eax
je 0x4075e0
inc bl
jmp 0x407599
push 0x42a11c
push 0x4357cc
call fcn.00411b15
add esp, 8
mov dword [0x4358cc], eax
test eax, eax
je 0x40760b
push eax
mov byte [0x4358d0], 1
call fcn.00411950
add esp, 4
mov edi, 0x4382f4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4358d4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x40c670
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x44
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x1c], eax
call ebp
mov esi, dword [esp + 0x58]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, eax
call fcn.004078c0
cmp al, 1
je 0x40c75b
mov edx, dword [esi + 0x14]
push 0
lea ecx, [esp + 0x18]
push 0x40
push ecx
push edx
call fcn.0040c630
add esp, 0x10
test eax, eax
je 0x40c75b
lea eax, [esp + 0x10]
push eax
push 0xbb8
push 0x479174
push esi
call fcn.0040c650
add esp, 0x10
test eax, eax
je 0x40c75b
mov eax, dword [0x479178]
and eax, 0xffff
sub eax, 2
je 0x40c757
dec eax
jne 0x40c71c
mov byte [esi + 7], 1
cmp word [0x479180], 0x1122
jne 0x40c71c
push 0x479182
call fcn.0040c340
add esp, 4
mov ecx, dword [esp + 0x5c]
mov eax, dword [0x47917c]
shr ecx, 1
cmp eax, ecx
jae 0x40c75b
push 0x1f4
call ebx
call ebp
sub eax, edi
cmp eax, 0x1388
jbe 0x40c6a8
call ebp
push str.Fw_buffer_wait_5s...
mov edi, eax
call fcn.00407650
add esp, 4
jmp 0x40c6a8
mov byte [esi + 5], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x40ced0
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
push 0x3e8
xor edi, edi
call ebp
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esi + 1], 0
call ebx
mov dword [esp + 0x14], eax
mov al, byte [esi + 2]
test al, al
jne 0x40cf48
push 0x64
call ebp
mov ax, di
inc edi
cmp ax, 0xc8
ja 0x40cf14
cmp byte [esi + 2], 1
jne 0x40cefe
jmp 0x40cf34
mov ecx, dword [esi + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call ebx
sub eax, dword [esp + 0x14]
push eax
push 0x42b834
call fcn.00407650
add esp, 8
call ebx
sub eax, dword [esp + 0x14]
push eax
push str.Tx_task_end_delay:_dms
call fcn.00407650
add esp, 8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40cf5f
push eax
call fcn.0040ceb0
add esp, 4
mov dword [esi + 0x14], 0
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40cf70
Capabilities:
Create thread

Disassembly:
sub esp, 8
lea eax, [esp]
lea ecx, [esp + 4]
push esi
push eax
push ecx
call fcn.0040de40
mov edx, dword [esp + 0x18]
mov byte [0x42b538], al
lea esi, [edx + 0x2c]
lea eax, [esi + 0x14]
mov byte [esi + 1], 0
push eax
mov byte [esi + 2], 1
call fcn.0040ce90
add esp, 0xc
test eax, eax
jne 0x40cfe4
mov ecx, dword [0x42b538]
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
and ecx, 0xff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
push 0x42b884
call fcn.00407650
push 0x1f
call fcn.00407920
add esp, 0x14
xor eax, eax
pop esi
add esp, 8
ret
push 0
push 0
push esi
push 0x40cd20
push 0
push 0
call fcn.00412146
add esp, 0x18
mov dword [esi + 0x10], eax
test eax, eax
jne 0x40d015
push str.Create_Tx_thread_fail____r_n
call fcn.00407650
add esp, 4
xor eax, eax
pop esi
add esp, 8
ret
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov byte [esi + 1], 1
mov byte [esi + 2], 0
mov ecx, dword [0x42b538]
and edx, 0xffff
and ecx, 0xff
and eax, 0xffff
push ecx
push edx
push eax
push str.Link_Start__X_02X__d_n
call fcn.00407650
add esp, 0x10
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x40dc80
Capabilities:
Get common file path

Disassembly:
mov eax, 0x15a0
call fcn.00411dc0
push esi
push edi
push 0x4382f4
push 2
call fcn.004122a9
mov ecx, 0x12
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0x4c
add esp, 8
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x15ac]
lea ecx, [esp + 0x158]
push 0x4382f4
push ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], str.atsave_FILE_.dat_
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x54]
lea edx, [esp + 0x158]
push eax
push 0x104
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], 0x1450
mov dword [esp + 0x40], 0x42bcc4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x54]
push str.select_file_n
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], 0x81200
call fcn.00411d04
add esp, 4
lea edx, [esp + 8]
push edx
call sub.comdlg32.dll_GetOpenFileNameA
mov edx, eax
lea edi, [esp + 0x158]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x15b0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x15a0
ret

Function at 0x40dd60
Capabilities:
Get common file path

Disassembly:
mov eax, 0x15a0
call fcn.00411dc0
push ebx
push esi
push edi
push 0x4382f4
push 2
call fcn.004122a9
mov ebx, dword [esp + 0x15bc]
mov ecx, 0x12
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0x4c
add esp, 8
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x15b0]
lea ecx, [esp + 0x15c]
push ebx
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0x42bd14
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x58]
lea edx, [esp + 0x15c]
push eax
push 0x104
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], 0x1450
mov dword [esp + 0x44], 0x42bcc4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0xc]
lea ecx, [esp + 0x58]
push edx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], 0x81200
mov dword [esp + 0x40], 0x42bd00
call sub.comdlg32.dll_GetSaveFileNameA
mov edx, eax
lea edi, [esp + 0x15c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x15a0
ret
Function at 0x40e770
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
push esi
push edi
push 0x479f90
mov dword [0x479eec], ebx
call fcn.00407200
mov ecx, 0x11
mov esi, 0x479f98
mov edi, 0x479ef0
add esp, 4
rep movsd dword es:[edi], dword [esi]
push 0
push 0x4111f0
push 0
and eax, 0xff
push 0x67
push ebx
mov dword [0x47a064], eax
movsw word es:[edi], word [esi]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0x77
push ebx
mov dword [0x479ee8], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
mov eax, dword [0x479ee8]
push 0
push 0x80
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x479ee8]
push ecx
call fcn.0040e6a0
mov edx, dword [esp + 0x3c]
mov eax, dword [0x479ee8]
add esp, 4
push edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
call esi
test eax, eax
je 0x40e840
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebx
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
call esi
test eax, eax
jne 0x40e821
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x40fc10
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x458
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 0
push 0x432
push esi
call edi
push eax
call ebx
push 0
push 0x432
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebp
push 0
push 0x488
push esi
call edi
push eax
call ebx
push 0
push 0x488
push esi
call edi
push eax
call ebp
push 0
push 0x489
push esi
call edi
push eax
call ebx
push 0
push 0x489
push esi
call edi
push eax
call ebp
push 0
push 0x431
push esi
call edi
push eax
call ebx
push 0
push 0x47d
push esi
call edi
push eax
call ebx
push 0
push 0x431
push esi
call edi
push eax
call ebp
push 0
push 0x47d
push esi
call edi
push eax
call ebp
push 0
push 0x42e
push esi
call edi
push eax
call ebx
push 0
push 0x42e
push esi
call edi
push eax
call ebp
push 0
push 0x42d
push esi
call edi
push eax
call ebx
push 0
push 0x42d
push esi
call edi
push eax
call ebp
push 0
push 0x448
push esi
call edi
push eax
call ebx
push 0
push 0x448
push esi
call edi
push eax
call ebp
push 0
push 0x4a2
push esi
call edi
push eax
call ebx
push 0
push 0x4a2
push esi
call edi
push eax
call ebp
push 0
push 0x4a4
push esi
call edi
push eax
call ebx
push 0
push 0x4a4
push esi
call edi
push eax
call ebp
push 0
push 0x4a3
push esi
call edi
push eax
call ebx
push 0
push 0x4a3
push esi
call edi
push eax
call ebp
push 0
push 0x4a5
push esi
call edi
push eax
call ebx
push 0
push 0x4a5
push esi
call edi
push eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x423460
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48adab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047f122
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4234e2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047c77a
mov eax, dword [eax]
push 0x4c11f4
push eax
call fcn.0046ea94
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047f3ad
test bl, bl
je 0x4234e2
push 0x4c11f4
lea ecx, [esp + 0xc]
call fcn.0047f73d
push 0x4c4d64
lea ecx, [esp + 0xc]
call fcn.0047f73d
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42351e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047f3ad
jmp 0x4235e9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4235a2
lea edx, [esp + 0x7c]
push 0x4c4d60
push edx
call fcn.0046ea94
add esp, 8
test eax, eax
je 0x4235a2
lea eax, [esp + 0x7c]
push 0x4c4d5c
push eax
call fcn.0046ea94
add esp, 8
test eax, eax
je 0x4235a2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x423532
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047f3ad
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x423de0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x423e42
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x423e50
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48ae2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4cb574]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x423f88
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x423eb6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047f3ad
xor eax, eax
jmp 0x423fff
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0047f4ea
push esi
lea ecx, [esp + 0xc]
call fcn.0047f779
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x423fdd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.00423de0
test eax, eax
jne 0x423fdd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.00423de0
test eax, eax
jne 0x423fdd
lea eax, [esp + 0x14]
push 0x4c4d78
push eax
call fcn.0046fba0
mov esi, eax
add esp, 8
test esi, esi
jne 0x423fbc
lea ecx, [esp + 0x14]
push 0x4c4d74
push ecx
call fcn.0046fb20
mov esi, eax
add esp, 8
test esi, esi
jne 0x423fbc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x423fbf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047f49a
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x423ece
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047f3ad
xor eax, eax
jmp 0x423fff
mov byte [esi], 0
push 0x4c4d70
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047f3ad
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4