joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044dd
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00408e10
mov eax, dword [0x42f180]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
push esi
push edi
push dword [0x43292c]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
push ebp
lea eax, [esp + 0x18]
push eax
mov ebx, 0x425524
push ebx
push str.title
mov esi, 0x425f40
push esi
call edi
push 0x50
pop ecx
lea eax, [esp + 0x10]
mov edx, 0x431140
call fcn.00401cce
push dword [0x43292c]
lea eax, [esp + 0x14]
push ebp
push eax
push ebx
push str.info
push esi
call edi
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, 0x431580
call fcn.00401cce
push dword [0x43292c]
push 0x50
push 0x4327c0
push ebx
push str.build_info
push esi
call edi
push dword [0x43292c]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x43292c]
mov dword [0x431194], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x43292c]
mov dword [0x431190], eax
push 0xa
push 0x432590
push ebx
push str.target_version
push esi
call edi
push dword [0x43292c]
push 0x50
push 0x4312c0
push ebx
push str.name
push str.metadata
call edi
push dword [0x43292c]
push 0x104
push 0x4311a0
push ebx
push str.install_script
push esi
call edi
push dword [0x43292c]
mov ebp, 0x431550
push 0xa
push ebp
push ebx
push str.user_access_control
push esi
call edi
push 6
mov edi, str.force
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40462b
call fcn.00401cce
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.00401cce
jmp 0x4046cb
push 5
mov edi, str.auto
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404658
call fcn.00401cce
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.00401cce
test eax, eax
je 0x404688
jmp 0x404621
cmp byte [0x431550], al
je 0x404688
push 5
mov edi, str.none
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404688
push eax
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x431140
call fcn.00402766
push eax
mov dword [0x432580], eax
call fcn.00401cce
pop ecx
pop ecx
push dword [0x432814]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x43292c]
test eax, eax
je 0x4046bb
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x432930]
test eax, eax
je 0x4046cb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00407875
add esp, 0x1004
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7

Function at 0x40ed57
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x40eae0
call fcn.0040ed81
sub edi, 0x9bd1f19f
sub eax, 0xbed5c3fa
xor dword [esi], ebx
add eax, edi
inc esi
push eax
pop edi
sub eax, eax
cmp esi, edx
jne fcn.0040ed57
add eax, 1
ret
Function at 0xbbec49
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x24]
pushal
stc
rcr ch, 5
inc bl
jmp 0xbbec73
mov byte [esp], bh
pop word [esp]
push word [esp + 1]
jmp 0xbbec30
setl ch
add esp, 0
xchg ecx, ebp
bsr bx, bp
lea esp, [esp]
lea esp, [esp]
jmp 0xbbeca7
push esp
mov byte [esp + 2], ch
mov word [esp], sp
inc bl
bsr dx, bp
lea esp, [esp + 3]
jmp 0xbbec57
lea ecx, [edx*4]
btr ecx, edx
bsf bx, si
lea eax, [eax*4]
setge bh
mov eax, ebp
jmp 0xbbee89
lea edi, [ecx - 0x5b]
cld
pop dword [esp + 8]
mov si, word [esp + 0x1c]
mov al, ah
rdtsc
call fcn.00bbed43
mov cl, 0x20
mov dh, 0xd1
and cl, dl
leave
pop ebp
int 0x94
shr byte [si], 1
aas
push es
mov cl, 0xb0
mov bl, 0xff
je 0xbbed20
push dword [esp + 0xd]
bsf bp, ax
or eax, 0xe8bc0f66
rdtsc
xchg dword [esp + 9], ebp
xchg ecx, edx
mov word [esp + 0x16], sp
jmp 0xbbecd1
mov byte [esp + 0x1f], ah
xchg dword [esp + 0xe], ebp
popal
btc edi, ebx
jmp 0xbbed45
mov esi, 0xc58128d9
je 0xbbed67
xchg edx, eax
cpuid
setge ah
not ecx
bswap ebx
jmp 0xbbed10
mov cx, 0x4ad5
btc eax, edi
setae ch
neg bx
xchg bh, cl
mov dl, dh
jmp 0xbbedfa
stc
cmc
bswap edx
setno ch
mov edx, eax
btc ebp, edi
xchg ecx, eax
lds ecx, [ebx - 0x244f030]
jmp 0xbbecf9
cmc
xchg word [esp], bx
pop cx
setae bh
mov ebx, ebp
mov bl, 0xe8
jmp 0xbbedba
mov bx, 0xa527
mov eax, ebp
inc bx
mov cl, 0x82
xchg si, ax
xchg word [esp], si
jmp 0xbbed70
xchg ah, bl
push edx
setae dh
and edx, ecx
lea edi, [eax + 0x787dc671]
lea esp, [esp + 0xe]
jmp 0xbbed87
mov di, sp
xchg ch, dl
pushal
mov word [esp + 0x1c], di
xchg word [esp + 0x14], cx
push word [esp + 0xe]
jmp 0xbbee68
push dword [esp + 7]
mov si, 0x9537
bswap ebx
inc ax
lea ebp, [ecx + 0x3bced3d3]
xchg byte [esp + 6], dl
jmp 0xbbeda6
mov eax, 0xa7a912a0
push word [esp + 1]
push edx
mov esi, dword [esp + 7]
mov al, 0xe
inc cl
jmp 0xbbedd7
mov bp, word [esp + 0x20]
cmc
not bh
xchg ch, dl
xchg byte [esp + 0x18], al
xchg bh, cl
call int.00bbee0f
fbld tbyte [esi]
mov bx, word [esp + 0xa]
xchg word [esp + 0xf], si
xchg dword [esp + 0xb], esi
mov bl, 0xb8
mov ch, byte [esp + 1]
pop dword [esp + 6]
jmp 0xbbee2b
mov ch, byte [esp + 0xc]
xchg edi, edx
mov byte [esp + 0x1f], ah
pop word [esp + 0xb]
mov edi, dword [esp + 8]
push dword [esp + 0x17]
jmp 0xbbee42
lea ecx, [edx + edi]
rdtsc
lea eax, [edi*4]
inc bl
mov byte [esp], ch
sub esp, 0x1e
jmp 0xbbed62

Function at 0xbbf1a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ah
bswap ebp
rdtsc
lea edx, [ecx*4]
push esp
mov word [esp], bx
jmp 0xbbf17c
bsf bx, ax
mov al, ah
lea ecx, [eax*4]
inc esi
jmp 0xbbf1c9
lea ecx, [ebp - 0x61a0d2e9]
pop cx
lea esi, [ebx*4]
lea ebx, [eax - 0x19]
lea esp, [esp + 1]
lea edx, [ebx*4]
jmp 0xbbf132
inc bx
xchg bh, cl
mov esi, 0xed24856c
mov edx, dword [esp + 4]
mov eax, 0xe142e5ea
push word [esp]
jmp 0xbbf147
xchg edx, eax
jmp 0xbbf15d
setbe bh
bsr di, cx
cpuid
mov cl, 0x32
mov edi, ebp
inc bl
jmp 0xbbf22e
xchg bx, dx
xchg dword [esp], ebx
sub esp, 0x16
lea ebp, [ecx - 0xe3]
mov eax, ebp
pop bp
jmp 0xbbf1a8
xchg ebp, edx
mov cx, sp
add esp, 0x1a
not eax
xchg esi, ebp
btc eax, ebx
jmp 0xbbf206
Function at 0xbbf5a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, bh
pop dx
xchg cx, si
mov dword [esp + 1], ebp
add esp, 0xf
jmp 0xbbf5d4
lea edx, [ecx*4]
shr edx, 3
xchg cx, di
mov byte [esp + 5], dh
jmp 0xbbf57b
rdtsc
jmp 0xbbf591
mov byte [esp], dh
pop esi
pop ax
setl ah
lea eax, [ebx*4]
xchg dh, al
jmp 0xbbf600
xchg dword [esp], eax
rdtsc
cld
mov ecx, dword [esp + 3]
push dword [esp]
inc ebp
jmp 0xbbf5ac
Function at 0xbbf95e
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ebp
jmp 0xbbf967
pop edx
rdtsc
mov byte [esp + 9], dh
mov bl, bh
lea edi, [ebp + 0x2f]
cpuid
jmp 0xbbf99a
mov byte [esp + 5], bh
xchg byte [esp + 6], bl
pop dword [esp + 2]
xchg bh, cl
pop edx
rdtsc
jmp 0xbbfa44
mov si, 0x2b93
sub esp, 0xe
lea eax, [esp + eax]
push dword [esp + 2]
jmp 0xbbfa02
not dh
xchg ch, dl
mov al, 0xa6
and ecx, ecx
lea edx, [eax + 0x39]
mov cl, ch
jmp 0xbbfa19
xchg word [esp + 0xd], ax
mov byte [esp + 3], bh
xchg byte [esp + 2], al
ror ch, 5
xchg si, bx
xchg bh, cl
jmp 0xbbf9e4
xchg dh, al
mov dx, word [esp + 0xe]
neg eax
setae ah
pop word [esp + 1]
xchg byte [esp + 0xe], dl
jmp 0xbbfa57
pop ecx
bsr bp, bp
bswap esi
bswap ecx
xchg ch, dl
add esp, 0
jmp 0xbbf9b0
mov byte [esp + 0xb], ah
neg di
sub esp, 0x1e
xchg word [esp + 0x14], si
mov ch, byte [esp + 0x22]
rdtsc
jmp 0xbbfb61
mov edx, dword [esp + 0x30]
xchg dh, al
mov di, bx
mov bl, bh
xchg word [esp + 0xb], si
pop word [esp + 0x20]
jmp 0xbbfaf3
xchg bp, dx
xchg byte [esp + 0x10], dl
xchg ch, dl
mov al, ah
xchg bh, cl
push word [esp + 0x11]
jmp 0xbbfa98
mov byte [esp + 1], dh
lea esp, [esp + 4]
lea ebp, [esi - 0x75]
bsf ax, ax
xchg byte [esp], dl
inc bl
jmp 0xbbfb43
add esp, 0x28
bswap ebp
xchg word [esp + 1], cx
mov edi, ebp
inc bl
bswap edi
jmp 0xbbfacb
bsr ax, cx
inc eax
bswap ebp
mov al, 0x16
push word [esp]
pop word [esp + 0x25]
jmp 0xbbfab7
mov byte [esp + 1], ch
pop bx
clc
clc
mov bl, 0x88
call fcn.00bbfb2b
mov ch, 0x3d
lodsd eax, dword [esi]
mov ah, 0x47
cmpsd dword [esi], dword es:[edi]
test dword [esi], ecx
pushfd
sti
push ss
mov cl, 0x1f
xchg cx, ax
mov ah, byte [esp + 0x1e]
clc
cmc
btc edi, ebx
not edi
xchg dh, al
jmp 0xbbfb17

Function at 0xbc12d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf bp, si
push dword [esp + 2]
clc
jmp 0xbc135d
rdtsc
rdtsc
clc
rcl bp, cl
mov bx, word [esp + 1]
mov ch, byte [esp + 1]
jmp 0xbc13d5
rdtsc
xchg ecx, esi
pop si
mov byte [esp + 1], ch
add esp, 3
mov bl, bh
jmp 0xbc1341
add esp, 1
bsf di, si
mov ch, byte [esp + 9]
xchg edx, ebp
mov bh, byte [esp + 3]
push esp
call fcn.00bc13be
invalid
sub esp, 0x10
not ah
xchg ah, bl
lea esp, [esp + 0x1e]
mov word [esp], sp
lea ebx, [ecx - 0xcb]
jmp 0xbc136e
xchg word [esp], bx
pushal
shl di, cl
xchg word [esp + 0xe], bx
bsr cx, cx
lea eax, [esi*4]
jmp 0xbc1390

Function at 0xbc16e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 6], bp
mov dh, byte [esp + 8]
pop bp
bswap edi
clc
push dword [esp + 0xd]
jmp 0xbc1601
sub esp, 0x16
xor edi, esi
jmp 0xbc1628
Function at 0xbc1897
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebx
neg bh
cpuid
mov byte [esp + 9], ah
lea esp, [esp + 9]
jmp 0xbc1718
bswap ebp
bsr bp, cx
pop bp
pop dword [esp + 0xc]
mov dword [esp + 0x11], ebp
pop ebp
jmp 0xbc16ee
add cx, 0xc31e
inc dx
xchg dh, al
push word [esp + 7]
push word [esp + 0xa]
neg bp
jmp 0xbc1778
xchg dword [esp + 0x20], ecx
xchg ebp, eax
lea edx, [ebp - 0x462427e1]
mov ebx, ecx
mov dl, 0xd4
mov ah, byte [esp + 0x1d]
jmp 0xbc1705
mov eax, 0x712280d6
bswap esi
xchg ebx, eax
lea ebp, [eax*4]
rdtsc
pop edi
jmp 0xbc17eb
rol di, cl
neg bh
inc cl
bswap edx
pop di
xchg word [esp + 7], bx
jmp 0xbc1751
xchg bh, cl
push word [esp + 0x10]
mov ebx, dword [esp + 0x11]
mov bx, word [esp + 6]
mov dh, byte [esp + 0x16]
mov si, word [esp + 0x10]
jmp 0xbc17ce
mov dword [esp + 1], ecx
mov dx, word [esp + 0xb]
neg ah
mov dword [esp + 0xd], ecx
lea edx, [eax*4]
stc
jmp 0xbc178a
xchg dword [esp + 0x11], ecx
mov byte [esp + 1], bh
inc di
btr ebx, esp
pop ecx
mov ch, byte [esp + 0xa]
jmp 0xbc187f
mov di, 0x2bc7
xchg word [esp + 8], dx
mov ecx, dword [esp + 0x10]
btc esi, edi
push dword [esp + 0xf]
jmp 0xbc17b5
mov ecx, 0xe1c9328
mov si, 0xbd7f
inc edx
push dword [esp + 6]
push dword [esp + 0x14]
rdtsc
jmp 0xbc173b
mov ah, byte [esp + 1]
inc edx
btr eax, edx
pop si
lea eax, [ecx + 0x2b]
pop ebx
jmp 0xbc1858
lea esp, [esp + 2]
cpuid
mov bl, 0x70
mov bx, 0x2f85
mov cl, 0x72
rcr ah, 1
jmp 0xbc18d5
mov bl, 0x10
lea esi, [ecx + 0x3b]
sub esp, 4
pop dword [esp]
rcr ebx, 0xb
pop edx
jmp 0xbc1821
cpuid
pop word [esp]
mov word [esp], di
cpuid
xchg ebx, esi
mov word [esp], dx
jmp 0xbc1831
mov dword [esp + 7], ebp
xchg di, bp
pop dword [esp + 7]
rcr bh, 3
mov dh, byte [esp + 6]
jmp 0xbc1847
mov ebp, 0x2de64eae
lea edi, [ecx + ebx]
bswap ebx
setne ch
cpuid
jmp 0xbc1808
clc
bsr di, cx
cpuid
shr dh, 7
mov bl, bh
bswap eax
jmp 0xbc18bf
inc ebp
lea esp, [esp]
lea esp, [esp]
clc
rdtsc
lea esi, [esi + 0x72fc125]
mov cx, 0xcd79
jmp 0xbc18ab

Function at 0xbc1e38
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x20], ebp
push esp
pop word [esp]
jmp 0xbc1e9a
push word [esp + 1]
lea esp, [esp + 3]
mov byte [esp], bh
mov byte [esp], bh
mov byte [esp], bh
call fcn.00bc1e6e

Function at 0xbc1e6e
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.00bc1009
pop word [esp]
jmp 0xbc1e78
lea esp, [esp + 2]
push edx
push word [esp + 2]
mov dword [esp], esi
pop word [esp + 2]
lea esp, [esp + 1]
jmp 0xbc1ecd
push word [esp + 8]
pushal
push edx
mov dword [esp + 0x29], eax
push word [esp + 0x39]
pop word [esp + 0x1b]
jmp 0xbc1f24
mov dword [esp + 0x20], esi
push esp
pushal
lea esp, [esp + 0xf]
mov word [esp + 0xa], dx
jmp 0xbc1eb1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xbc2322
lea esp, [esp + 3]
mov dword [esp + 0x54], edi
lea esp, [esp + 0x54]
jmp 0xbc1f06
push eax
jmp 0xbc1004
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xbc2035
Function at 0x40cdcf
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 0x20c], 0
jmp 0x40cdf3
mov eax, dword [ebp - 0x20c]
add eax, 1
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0x20c]
cmp eax, dword [edx + 8]
jge 0x40ce3f
mov ecx, dword [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0xc]
call fcn.00405b78
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0x40f30c
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x40cde4
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 8]
sub edx, 1
mov dword [ebp - 0x20c], edx
jmp 0x40ce62
mov eax, dword [ebp - 0x20c]
sub eax, 1
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jl 0x40cea6
mov ecx, dword [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x10]
call fcn.00405b78
push eax
mov eax, dword [ebp + 0xc]
push eax
push str._s_s
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
jmp 0x40ce53
mov esp, ebp
pop ebp
ret

Function at 0x40ceaa
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
cmp edx, 0x22
jne 0x40cf17
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
test edx, edx
je 0x40cefe
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x40cef3
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x40cefe
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x40ced3
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x20
jne 0x40cf12
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x40cf42
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
test edx, edx
je 0x40cf3f
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x20
jne 0x40cf34
mov eax, dword [ebp - 8]
add eax, 1
jmp 0x40cf42
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x40cf17
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40b042
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40b063
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x40b05a
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40b052
mov eax, ebx
leave
ret

Function at 0x40b089
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x40b0e8
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40b115
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40b104
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40b0f5
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x40b13b
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x40b0dc
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x40b7ba
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x40b7ca
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jle 0x40b8d8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cwde
call fcn.0040b8e8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5a4d
jne 0x40b8d8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call fcn.0040b8e8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4550
jne 0x40b8d8
pop eax
push eax
mov eax, dword [eax + 0x7c]
call fcn.0040b8e8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40b8d8
pop eax
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push eax
mov eax, dword [eax + 0x20]
add eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
pop eax
mov eax, dword [eax + 0x18]
dec eax
mov dword [ebp - 4], eax
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x40b8d5
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.0040b8fb
test eax, eax
je 0x40b8c4
push ecx
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop ecx
leave
ret 8
push dword [ebp - 8]
call fcn.0040b92f
add dword [ebp - 0xc], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x40b87f
add esp, 0xc
mov eax, 0
jmp 0x40b8e2
mov esp, ebp
pop ebp
ret 8
Function at 0x417340
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a5c8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0049a751
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4173c2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049850a
mov eax, dword [eax]
push 0x59b230
push eax
call fcn.0048a3e4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0049a9dc
test bl, bl
je 0x4173c2
push 0x59b230
lea ecx, [esp + 0xc]
call fcn.0049ad6c
push 0x59ed7c
lea ecx, [esp + 0xc]
call fcn.0049ad6c
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4173fe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0049a9dc
jmp 0x4174c9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x417482
lea edx, [esp + 0x7c]
push 0x59ed78
push edx
call fcn.0048a3e4
add esp, 8
test eax, eax
je 0x417482
lea eax, [esp + 0x7c]
push 0x59ed74
push eax
call fcn.0048a3e4
add esp, 8
test eax, eax
je 0x417482
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x417412
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0049a9dc
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x417cc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x417d22
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x417d30
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a5d0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5ac678]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x417e68
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x417d96
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0049a9dc
xor eax, eax
jmp 0x417edf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0049ab19
push esi
lea ecx, [esp + 0xc]
call fcn.0049ada8
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x417ebd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00417cc0
test eax, eax
jne 0x417ebd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00417cc0
test eax, eax
jne 0x417ebd
lea eax, [esp + 0x14]
push 0x59ed90
push eax
call fcn.0048b5c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x417e9c
lea ecx, [esp + 0x14]
push 0x59ed8c
push ecx
call fcn.0048b540
mov esi, eax
add esp, 8
test esi, esi
jne 0x417e9c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x417e9f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0049aac9
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x417dae
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0049a9dc
xor eax, eax
jmp 0x417edf
mov byte [esi], 0
push 0x59ed88
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0049a9dc
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4