joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb270
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cb369
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403298
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x40
mov eax, dword [0x51b8a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x38], eax
mov eax, esi
call fcn.00404cdc
mov dword [ebp - 0x30], eax
mov eax, edi
call fcn.00404cdc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
call fcn.00404cdc
mov dword [ebp - 0x28], eax
xor eax, eax
mov al, byte [ebx + 0x3220]
mov eax, dword [eax*4 + 0x51adec]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x44]
mov eax, esi
call fcn.004099fc
mov eax, dword [ebp - 0x44]
call fcn.00409dd4
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x4cb350
cmp byte [ebx + 0x31f4], 1
jne 0x4cb34c
mov eax, dword [0x51b8a8]
mov eax, dword [eax]
call fcn.00466160
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 4], 0x103
jne 0x4cb347
mov eax, dword [0x51b8a8]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
je 0x4cb315
mov ebx, dword [ebp - 4]
jmp 0x4cb353
xor ebx, ebx
jmp 0x4cb353
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb370
lea eax, [ebp - 0x44]
call fcn.0040482c
ret
Function at 0x4d4114
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov esi, edx
xor ecx, ecx
mov dl, 1
mov eax, dword [0x442764]
call fcn.00452e78
mov ebx, eax
mov byte [ebx + 0x42], 1
or esi, 0x800
or esi, 0x4000
push esi
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x4d416c
call sub.shell32.dll_SHGetFileInfoA
mov edx, eax
mov eax, ebx
call fcn.004531d4
mov eax, ebx
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x4d4170
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d425a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp esi, 0xffffffff
jle 0x4d4232
mov dword [ebp - 4], 0x4010
cmp byte [ebx + 0x2aa], 1
jne 0x4d41bd
or dword [ebp - 4], 1
jmp 0x4d41c1
or dword [ebp - 4], 0
lea ecx, [ebp - 8]
mov eax, dword [ebx + 0x2d8]
mov eax, dword [eax + 0x218]
mov edx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x170]
lea edx, [ebx + 0x2a8]
call fcn.00404a88
mov edx, dword [ebp - 0x170]
lea ecx, [ebp - 0x16c]
lea eax, [ebp - 8]
call fcn.004926c4
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 8]
call fcn.004048c4
mov eax, dword [ebp - 4]
push eax
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404cdc
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x164]
jmp 0x4d4234
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4261
lea eax, [ebp - 0x170]
mov edx, 2
call fcn.00404850
lea eax, [ebp - 8]
call fcn.0040482c
ret
Function at 0x4dedf4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4df054
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4dee57
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004de8bc
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d838
cmp al, 1
jne 0x4dee57
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004debd4
test al, al
je 0x4defe3
cmp dword [ebp - 8], 0
jge 0x4dee75
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004de8bc
mov eax, dword [ebp - 0x210]
call fcn.00404ae4
cmp ebx, eax
jge 0x4deebf
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004de8bc
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x51ba88]
and eax, 0xff
bt dword [edx], eax
jae 0x4deebf
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4deed3
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004dedd0
cmp ebx, dword [ebp - 8]
je 0x4defd5
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, 0x100
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4deeff
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403c7c
and eax, 0x7f
movzx eax, word [eax*2 + 0x51af84]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4defc2
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403c7c
and eax, 0x7f
movzx eax, word [eax*2 + 0x51af84]
push eax
push 0x100
mov eax, dword [ebp - 4]
call fcn.0044c9d0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403c7c
and eax, 0x7f
movzx eax, word [eax*2 + 0x51af84]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044c9d0
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4defc9
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4df036
cmp dword [ebp - 8], 0
jge 0x4defee
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004de8bc
mov eax, dword [ebp - 0x218]
call fcn.00404ae4
cmp eax, dword [ebp - 8]
jg 0x4df028
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004de8bc
mov eax, dword [ebp - 0x21c]
call fcn.00404ae4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004dedd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df05b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404850
ret
Function at 0x4ea060
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ea1d1
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ea1ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404a0c
lea eax, [ebp - 0x118]
mov edx, 0x4ea1e8
call fcn.00404aec
mov eax, dword [ebp - 0x118]
call fcn.00404cdc
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4ea11e
lea eax, [ebp - 0x111]
call fcn.00409e20
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.0040491c
jmp 0x4ea125
mov eax, esi
call fcn.0040482c
cmp bl, 0x61
jae 0x4ea146
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040dcd8
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404880
jmp 0x4ea160
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040dc4c
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404880
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4ea1f4
call fcn.0040a5fc
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea1b3
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4f27c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406798
xor eax, eax
push ebp
push 0x4f288f
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x24]
cmp al, 7
jne 0x4f27fd
push esi
push 0
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
jmp 0x4f2871
cmp al, 9
jne 0x4f280d
push esi
push 0x11
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
jmp 0x4f2871
cmp al, 0xe
jne 0x4f281d
push esi
push 6
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
jmp 0x4f2871
cmp al, 0xd
jne 0x4f282d
push esi
push 5
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
jmp 0x4f2871
cmp dword [ebx + 0x28], 0
je 0x4f284a
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0x28]
call fcn.004f2b98
mov eax, dword [ebp - 0x10]
call fcn.004057d4
mov ebx, eax
jmp 0x4f2854
mov eax, dword [ebx + 0x1c]
call fcn.004057d4
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
push ebx
call sub.oleaut32.dll_SysFreeString_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2896
lea eax, [ebp - 0x10]
call fcn.0040482c
lea eax, [ebp - 4]
call fcn.00406728
ret

Function at 0x4f33d0
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4f3413
cmp dword [esp + 0x10], 2
jne 0x4f33fc
cmp dword [esp + 4], 5
jb 0x4f3413
mov bl, 1
jmp 0x4f3413
cmp dword [esp + 0x10], 1
jne 0x4f3413
cmp dword [esp + 4], 4
jb 0x4f3413
cmp dword [esp + 8], 0x5a
jb 0x4f3413
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x4f5af8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, edi
call fcn.004ed4e0
test al, al
je 0x4f5bba
mov eax, 0x105
call fcn.0040a094
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f5bb3
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetFocus
mov dword [ebp - 8], eax
mov eax, esi
call fcn.004f5134
mov ebx, eax
push ebx
call sub.user32.dll_SetFocus
mov eax, dword [ebp - 4]
push eax
push 0x104
push 0xd
push ebx
call sub.user32.dll_SendMessageA
mov eax, edi
call fcn.00404cdc
push eax
push 0
push 0xc
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0
push 0xf5
push 1
mov eax, dword [esi + 0x158]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 4]
push eax
push 0
push 0xc
push ebx
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetFocus
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5bba
mov eax, dword [ebp - 4]
call fcn.0040a0e0
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4f844c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4f84e4
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4f847c
lea eax, [ebp - 4]
mov dl, byte [0x51b004]
call fcn.00404a0c
jmp 0x4f84be
lea eax, [ebp - 4]
xor edx, edx
call fcn.00404e68
test esi, esi
jle 0x4f84be
mov edi, ebx
and edi, 0xff
mov eax, esi
cdq
idiv edi
mov dl, byte [edx + 0x51b004]
lea eax, [ebp - 8]
call fcn.00404a0c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.00404b30
mov eax, esi
cdq
idiv edi
mov esi, eax
test esi, esi
jg 0x4f848a
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
call fcn.00404880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f84eb
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404850
ret

Function at 0x500230
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x500256
cmp dword [esp + 4], 5
jb 0x500256
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x503de8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x11c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x503ece
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x11c]
mov eax, ebx
call fcn.00409a70
lea eax, [ebp - 0x11c]
mov edx, 0x503eec
call fcn.00404aec
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
call fcn.00409eb8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x503eb5
xor eax, eax
push ebp
push 0x503e91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
imul dword [ebp - 0xc]
imul dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x503eb5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503ed5
lea eax, [ebp - 0x11c]
call fcn.0040482c
ret
Function at 0x504024
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5041d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00409a70
cmp dword [ebp - 0xc], 0
jne 0x504074
lea eax, [ebp - 0x10]
call fcn.00409dc8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409a70
lea eax, [ebp - 0xc]
mov edx, 0x5041ec
call fcn.00404aec
mov eax, ebx
call fcn.0050424c
sub al, 2
jb 0x504093
je 0x5040a6
jmp case.default.0x5040fb
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x5040fb
mov edx, ebx
mov eax, 0x5041f8
call fcn.00404e20
dec eax
jne 0x5040e4
call fcn.00503fc8
test al, al
je 0x5040d1
mov eax, dword [ebp - 0xc]
call fcn.00503ef0
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x5040fb
mov dword [ebp - 8], 0x7fffffff
mov dword [ebp - 4], 0
jmp case.default.0x5040fb
mov eax, dword [ebp - 0xc]
call fcn.00404cdc
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.default.0x5040fb
jmp dword [eax*4 + 0x504102]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x5040fb
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x5040fb
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x5040fb
mov eax, dword [ebp - 0xc]
call fcn.00503de8
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x5040fb
mov eax, dword [ebp - 0xc]
call fcn.00503fb4
cdq
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x5040fb
mov eax, dword [ebp - 0xc]
call fcn.00503de8
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x5040fb
mov eax, dword [ebp - 0xc]
call fcn.00503ef0
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xffffffff
jne 0x50419b
cmp dword [ebp - 8], 0xffffffff
jb 0x5041b0
jmp 0x50419d
jl 0x5041b0
cmp dword [ebp - 4], 0
jne 0x5041ae
cmp dword [ebp - 8], 0x7fffffff
jbe 0x5041b7
jmp 0x5041b0
jle 0x5041b7
mov ebx, 0x7fffffff
jmp 0x5041ba
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5041dc
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404850
ret
Function at 0x448617
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.0053aa8b
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0053aa8b
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
push 0x10
call fcn.0053aa8b
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x53cee0
call fcn.0053aa85
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
je 0x4486d7
mov eax, 0
jmp 0x448843
cmp dword [ebp + 0xc], 0
jne 0x448703
mov dword [ebp - 0x1c], esp
mov eax, 0x20
call fcn.0053aa97
cmp dword [ebp - 0x1c], esp
je 0x448700
push 6
call fcn.0053aa91
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x44872b
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x448725
push ebx
call fcn.0053aa7f
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x21
call fcn.0053aa97
cmp dword [ebp - 0x1c], esp
je 0x448756
push 6
call fcn.0053aa91
add esp, 4
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x5ae653
mov eax, 0x22
call fcn.0053aa97
cmp dword [ebp - 0x1c], esp
je 0x448782
push 6
call fcn.0053aa91
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 2
mov dword [ebp - 0x1c], esp
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x23
call fcn.0053aa97
cmp dword [ebp - 0x1c], esp
je 0x448816
push 6
call fcn.0053aa91
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 8]
mov eax, 0x24
call fcn.0053aa97
cmp dword [ebp - 0x1c], esp
je 0x44883b
push 6
call fcn.0053aa91
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x448843
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0053aa7f
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0053aa7f
add esp, 4
mov ebx, dword [ebp - 0x18]
push ebx
call fcn.0053aa7f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x546770
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a7c2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0059c1b2
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x5467f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00599ffd
mov eax, dword [eax]
push 0x5e41f0
push eax
call fcn.0058c554
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0059c43d
test bl, bl
je 0x5467f2
push 0x5e41f0
lea ecx, [esp + 0xc]
call fcn.0059c7cd
push 0x5e7d6c
lea ecx, [esp + 0xc]
call fcn.0059c7cd
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x54682e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0059c43d
jmp 0x5468f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x5468b2
lea edx, [esp + 0x7c]
push 0x5e7d68
push edx
call fcn.0058c554
add esp, 8
test eax, eax
je 0x5468b2
lea eax, [esp + 0x7c]
push 0x5e7d64
push eax
call fcn.0058c554
add esp, 8
test eax, eax
je 0x5468b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x546842
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0059c43d
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x547110
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x547172
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x547180
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a7cab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5ee438]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x5472b8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x5471e6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0059c43d
xor eax, eax
jmp 0x54732f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0059c57a
push esi
lea ecx, [esp + 0xc]
call fcn.0059c809
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x54730d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.00547110
test eax, eax
jne 0x54730d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.00547110
test eax, eax
jne 0x54730d
lea eax, [esp + 0x14]
push 0x5e7d80
push eax
call fcn.0058d660
mov esi, eax
add esp, 8
test esi, esi
jne 0x5472ec
lea ecx, [esp + 0x14]
push 0x5e7d7c
push ecx
call fcn.0058d5e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x5472ec
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x5472ef
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0059c52a
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x5471fe
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0059c43d
xor eax, eax
jmp 0x54732f
mov byte [esi], 0
push 0x5e7d78
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0059c43d
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4