joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025f0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x13c
mov eax, dword [0x414018]
cmp eax, 0xffffffff
je 0x402620
mov edx, dword [0x41d074]
test edx, edx
jne 0x402630
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x414018], 0xffffffff
sub esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
add esp, 0x13c
ret
call sym._BE_onCleanup
mov eax, dword [0x414018]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], eax
lea eax, [esp + 0x24]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.WS2_32.dll_select]
sub esp, 0x14
cmp eax, 0xffffffff
je 0x402698
mov eax, dword [0x414018]
jmp 0x40260a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0xc], str.____F_END__ERROR____UDP_socket_select_Err_d
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x3e0
mov dword [esp], 0x45dde8
call dword [sym.imp.msvcrt.dll__snprintf_s]
lea edx, [eax - 1]
cmp edx, 0x3df
mov edx, 0x3e0
cmovae eax, edx
mov dword [0x45e1d0], eax
call sym._QSPY_printError
jmp 0x40268b

Function at 0x4026f0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x2c
mov eax, dword [0x41d074]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x402710
add esp, 0x2c
ret
mov dword [esp + 0x14], eax
mov eax, dword [0x414018]
mov dword [esp + 0x10], 0x41d078
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_sendto]
sub esp, 0x18
cmp eax, 0xffffffff
jne 0x402704
mov dword [0x41d074], 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0xc], str.____F_END__ERROR____UDP_socket_failed_Err_d
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x3e0
mov dword [esp], 0x45dde8
call dword [sym.imp.msvcrt.dll__snprintf_s]
lea edx, [eax - 1]
cmp edx, 0x3df
mov edx, 0x3e0
cmovae eax, edx
mov dword [0x45e1d0], eax
add esp, 0x2c
jmp sym._QSPY_printError

Function at 0x4027b0
Capabilities:
Execute command

Disassembly:
sub esp, 0x1c
mov dword [esp], 0x415475
call sym._system
add esp, 0x1c
ret
Function at 0x4027d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [0x414018]
mov ebx, dword [esp + 0x64]
cmp eax, 0xffffffff
je 0x4028f8
lea edx, [esp + 0x2c]
lea esi, [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov edx, dword [ebx]
mov dword [esp + 0x2c], 0x10
mov dword [esp + 8], edx
mov edx, dword [esp + 0x60]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.WS2_32.dll_recvfrom]
sub esp, 0x18
cmp eax, 0xffffffff
je 0x402960
mov ecx, dword [0x41d074]
mov edx, dword [esp + 0x2c]
test ecx, ecx
jne 0x402890
cmp edx, 0x10
jg 0x402908
mov edi, 0x41d078
mov ecx, esi
cmp edx, 4
jae 0x402988
xor esi, esi
test dl, 2
je 0x402865
movzx esi, word [ecx]
mov word [edi], si
mov esi, 2
test dl, 1
je 0x402871
movzx ecx, byte [ecx + esi]
mov byte [edi + esi], cl
mov dword [ebx], eax
mov eax, 2
mov dword [0x41d074], edx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ecx, edx
jne 0x4028b0
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
xor edx, dword [0x41d080]
xor ecx, dword [0x41d084]
or ecx, edx
je 0x4029b0
mov dword [esp + 0x10], str.UDP_socket_in_use
mov dword [esp + 0xc], str.____F_END__WARN______s
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x3e0
mov dword [esp], 0x45dde8
call dword [sym.imp.msvcrt.dll__snprintf_s]
lea edx, [eax - 1]
cmp edx, 0x3df
mov edx, 0x3e0
cmovae eax, edx
mov dword [0x45e1d0], eax
call sym._QSPY_printError
xor eax, eax
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.____F_END__ERROR____UDP_address_error_size_d
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x3e0
mov dword [esp], 0x45dde8
call dword [sym.imp.msvcrt.dll__snprintf_s]
lea edx, [eax - 1]
cmp edx, 0x3df
mov edx, 0x3e0
cmovae eax, edx
mov dword [0x45e1d0], eax
call sym._QSPY_printError
add esp, 0x4c
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4028f8
mov dword [0x41d074], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.____F_END__ERROR____UDP_socket_failed_Err_d
jmp 0x402914
mov edi, edx
xor ecx, ecx
and edi, 0xfffffffc
mov ebp, dword [esi + ecx]
add ecx, 4
mov dword [ecx + 0x41d074], ebp
cmp ecx, edi
jb 0x40298f
lea edi, [ecx + 0x41d078]
add ecx, esi
jmp 0x402853
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
xor edx, dword [0x41d078]
xor ecx, dword [0x41d07c]
or ecx, edx
jne 0x4028b0
mov dword [ebx], eax
mov eax, 2
jmp 0x4028fa
Function at 0x4029e0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
cmp byte [0x41d0a1], 0
mov ebx, dword [esp + 0x54]
je 0x402a22
mov ebp, dword [sym.imp.msvcrt.dll__kbhit]
mov edi, dword [sym.imp.msvcrt.dll__getwch]
xor esi, esi
jmp 0x402a17
call edi
mov esi, eax
test ax, ax
je 0x402a80
cmp ax, 0xe0
je 0x402a80
call ebp
test eax, eax
jne 0x402a08
test si, si
jne 0x402a90
mov eax, dword [esp + 0x50]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._PAL_receiveBe
test eax, eax
je 0x402a40
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov eax, dword [ebx]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 4], eax
mov eax, dword [0x41d09c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x402ab0
mov edx, dword [ebx]
xor eax, eax
test edx, edx
setne al
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
call edi
mov esi, eax
jmp 0x402a17
mov ecx, dword [esp + 0x50]
mov eax, esi
mov byte [ecx], al
mov eax, 3
mov dword [ebx], 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0xc], str.____COMMS__ERROR____Reading_COM_port_failed_Err_d
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x3e0
mov dword [esp], 0x45dde8
call dword [sym.imp.msvcrt.dll__snprintf_s]
lea edx, [eax - 1]
cmp edx, 0x3df
mov edx, 0x3e0
cmovae eax, edx
mov dword [0x45e1d0], eax
call sym._QSPY_printError
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [0x41d09c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov dword [ebx], 0
mov eax, 5
sub esp, 0xc
jmp 0x402a36
Function at 0x402f70
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
cmp byte [0x41d0a1], 0
mov ebx, dword [esp + 0x34]
je 0x402fb2
mov ebp, dword [sym.imp.msvcrt.dll__kbhit]
mov edi, dword [sym.imp.msvcrt.dll__getwch]
xor esi, esi
jmp 0x402fa7
call edi
mov esi, eax
test ax, ax
je 0x403010
cmp ax, 0xe0
je 0x403010
call ebp
test eax, eax
jne 0x402f98
test si, si
jne 0x403020
mov eax, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._PAL_receiveBe
test eax, eax
je 0x402fd0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x41d070]
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sym._fread
mov edx, eax
mov eax, 4
test edx, edx
je 0x402fc6
mov dword [ebx], edx
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
call edi
mov esi, eax
jmp 0x402fa7
mov ecx, dword [esp + 0x30]
mov eax, esi
mov byte [ecx], al
mov eax, 3
mov dword [ebx], 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x406350
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [0x42068c]
mov ebx, dword [esp + 0x20]
test eax, eax
je 0x406369
mov dword [esp], eax
call sym._fclose
mov dword [0x42068c], ebx
mov dword [0x4202d4], 0
add esp, 0x18
pop ebx
jmp sym._QSEQ_genHeader
Function at 0x407310
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x11c
mov edx, dword [0x4202d8]
mov esi, dword [esp + 0x134]
mov ebx, dword [esp + 0x138]
test edx, edx
je 0x407494
mov eax, dword [0x42068c]
test eax, eax
je 0x407494
imul eax, dword [0x4202d4], 0xc28f5c29
add eax, 0x51eb850
ror eax, 2
cmp eax, 0x28f5c28
jbe 0x4074b8
mov eax, dword [esp + 0x130]
lea edi, [esp + 0x26]
mov dword [esp + 0xc], str._010u
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0xea
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__snprintf_s]
mov eax, dword [0x4202d8]
lea ecx, [eax + eax*4 - 5]
shl ecx, 2
cmp ecx, 0xfffffff8
jl 0x4074c8
mov edx, 0xfffffff7
lea esi, [esi]
imul eax, edx, 0xcccccccd
add eax, 0x19999998
ror eax, 2
cmp eax, 0xccccccc
ja 0x4074a0
mov byte [esp + edx + 0x39], 0x7c
add edx, 1
cmp edx, ecx
jne 0x4073b0
lea edx, [ecx + 0x13]
lea eax, [ecx + 0x14]
lea ebp, [ecx + 0x15]
mov byte [esp + edx + 0x26], 0x7c
mov byte [esp + eax + 0x26], 0xa
lea eax, [esi + esi*4]
mov dword [esp], ebx
lea esi, [eax*4 + 0x13]
call sym._strlen
mov edx, 0xf
cmp eax, 0xf
cmovg eax, edx
add eax, 1
mov edx, eax
shr edx, 0x1f
add eax, edx
movzx edx, byte [ebx]
sar eax, 1
sub esi, eax
mov byte [esp + esi + 0x26], 0x28
lea ecx, [esi + 0xf]
lea eax, [esi + 1]
test dl, dl
je 0x407443
sub ebx, esi
jmp 0x407434
test dl, dl
je 0x407443
mov byte [edi + eax], dl
add eax, 1
movzx edx, byte [ebx + eax - 1]
cmp ecx, eax
jge 0x407430
lea edx, [eax + 1]
mov byte [esp + eax + 0x26], 0x29
cmp edx, ebp
jb 0x407457
mov byte [esp + eax + 0x27], 0xa
lea ebp, [eax + 2]
mov eax, dword [0x4202d0]
test eax, eax
js 0x407468
lea eax, [eax + eax*4]
mov byte [esp + eax*4 + 0x39], 0x2f
cmp ebp, 0xea
ja 0x4074e0
mov eax, dword [0x42068c]
mov dword [esp + 8], ebp
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], edi
call sym._fwrite
add dword [0x4202d4], 1
add esp, 0x11c
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [esp + edx + 0x39], 0x20
add edx, 1
cmp edx, ecx
jne 0x4073b0
jmp 0x4073d5
call sym._QSEQ_genHeader
jmp 0x407360
mov ebp, 0xc
mov eax, 0xb
mov edx, 0xa
jmp 0x4073de
mov dword [esp + 4], 0x23c
mov dword [esp], str..._source_qspy_seq.c
call sym._Q_onError
jmp 0x407470
Function at 0x407500
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [0x4202d8]
test edx, edx
je 0x407658
mov eax, dword [0x42068c]
test eax, eax
je 0x407658
push edi
push esi
push ebx
sub esp, 0x110
imul eax, dword [0x4202d4], 0xc28f5c29
add eax, 0x51eb850
ror eax, 2
cmp eax, 0x28f5c28
jbe 0x407628
mov eax, dword [esp + 0x124]
lea esi, [esp + 0x26]
mov dword [esp + 0xc], str.__Tick__1u__Ctr_010u
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x120]
mov dword [esp + 4], 0xea
mov dword [esp + 0x10], eax
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__snprintf_s]
mov eax, dword [0x4202d8]
lea ebx, [eax + eax*4]
shl ebx, 2
cmp ebx, 0x1b
jle 0x407638
lea edi, [ebx - 0xc]
mov eax, 0xf
lea esi, [esi]
nop
imul ecx, eax, 0xcccccccd
mov edx, 0x7c
ror ecx, 2
cmp ecx, 0xccccccc
jbe 0x4075c7
lea edx, [eax + 0x13]
and edx, 1
cmp edx, 1
sbb edx, edx
and edx, 7
add edx, 0x20
mov byte [esp + eax + 0x39], dl
add eax, 1
cmp edi, eax
jne 0x4075a0
mov eax, dword [0x4202d0]
lea edx, [ebx + 7]
add ebx, 8
test eax, eax
js 0x4075e9
lea eax, [eax + eax*4]
mov byte [esp + eax*4 + 0x39], 0x2f
mov byte [esp + edx + 0x26], 0xa
cmp ebx, 0xeb
je 0x407660
mov eax, dword [0x42068c]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
call sym._fwrite
add dword [0x4202d4], 1
add esp, 0x110
pop ebx
pop esi
pop edi
ret
call sym._QSEQ_genHeader
jmp 0x407541
mov eax, dword [0x4202d0]
test eax, eax
js 0x407649
lea eax, [eax + eax*4]
mov byte [esp + eax*4 + 0x39], 0x2f
mov byte [esp + 0x48], 0xa
mov ebx, 0x23
jmp 0x4075f6
ret
mov dword [esp + 4], 0x25e
mov dword [esp], str..._source_qspy_seq.c
call sym._Q_onError
jmp 0x4075f6

Function at 0x4117d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x411830
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x45d91c]
test esi, esi
jle 0x411930
mov eax, dword [0x45d920]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x411860
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4118df
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x411850
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x411957
mov eax, dword [0x45d920]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x45d920]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x411937
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4118d8
sub eax, 4
and eax, 0xfffffffb
jne 0x4118e6
add dword [0x45d91c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x45d920]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4118d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
xor esi, esi
jmp 0x41186a
mov eax, dword [0x45d920]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x411e10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x45d938
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x45d930]
sub esp, 4
test ebx, ebx
je 0x411e65
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x411e5e
test esi, esi
je 0x411e5e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x411e40
mov dword [esp], 0x45d938
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4562b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x38000]
push edi
or ebp, 0xffffffff
jmp 0x4562d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4562d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4562c8
mov eax, 1
add ebx, ebx
jne 0x4562eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4562fc
jne 0x45630c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45630c
dec eax
add ebx, ebx
jne 0x456308
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4562e0
xor ecx, ecx
sub eax, 3
jb 0x456324
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x456396
sar eax, 1
mov ebp, eax
jmp 0x45632f
add ebx, ebx
jne 0x45632f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45633c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x456360
inc ecx
add ebx, ebx
jne 0x45634c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x456341
jne 0x45635d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x456341
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x456380
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x456371
jmp 0x4562ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x456380
add edi, ecx
jmp 0x4562ce
pop esi
mov edi, esi
mov ecx, 0x68
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45639e
cmp byte [edi], 3
jne 0x45639e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4563a3
lea edi, [esi + 0x54000]
mov eax, dword [edi]
or eax, eax
je 0x456412
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5641c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5646c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4563d0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x56470]
or eax, eax
je 0x45640c
mov dword [ebx], eax
add ebx, 4
jmp 0x4563ed
call dword [esi + 0x56474]
popal
jmp 0x4015c0
Function at 0x40b8f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46febb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004648b1
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40b972
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00462630
mov eax, dword [eax]
push 0x5541f0
push eax
call fcn.00455264
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00464b3c
test bl, bl
je 0x40b972
push 0x5541f0
lea ecx, [esp + 0xc]
call fcn.00464ecc
push 0x557d64
lea ecx, [esp + 0xc]
call fcn.00464ecc
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40b9ae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00464b3c
jmp 0x40ba79
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40ba32
lea edx, [esp + 0x7c]
push 0x557d60
push edx
call fcn.00455264
add esp, 8
test eax, eax
je 0x40ba32
lea eax, [esp + 0x7c]
push 0x557d5c
push eax
call fcn.00455264
add esp, 8
test eax, eax
je 0x40ba32
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b9c2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00464b3c
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40c290
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40c2f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40c300
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46ff3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x55e6c0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40c438
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40c366
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00464b3c
xor eax, eax
jmp 0x40c4af
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00464c79
push esi
lea ecx, [esp + 0xc]
call fcn.00464f08
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40c48d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040c290
test eax, eax
jne 0x40c48d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040c290
test eax, eax
jne 0x40c48d
lea eax, [esp + 0x14]
push 0x557d78
push eax
call fcn.004562a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c46c
lea ecx, [esp + 0x14]
push 0x557d74
push ecx
call fcn.00456220
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c46c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40c46f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00464c29
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40c37e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00464b3c
xor eax, eax
jmp 0x40c4af
mov byte [esi], 0
push 0x557d70
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00464b3c
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4