joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c9436
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0
push 0
push 0x14b
push 0x67
push ebx
call sub.USER32.dll_SendDlgItemMessageA
push 0x57fe40
push 0x180
push 0xd
push 0x193
push dword [0x56a0e4]
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x57fe40], 0
jne 0x4c94a2
mov esi, 0x57fe40
mov edi, 0x581538
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x57fe40
push 0x56883d
push 0x5836b2
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.Main_folder
push 0
push 0x143
push 0x6c
push ebx
call sub.USER32.dll_SendDlgItemMessageA
lea eax, [ebp - 0x140]
push eax
push 0x5836b2
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c94ef
mov edi, 1
jmp 0x4c9597
xor edi, edi
jmp 0x4c9597
test byte [ebp - 0x140], 0x10
je 0x4c9508
cmp byte [ebp - 0x114], 0x2e
jne 0x4c9520
lea eax, [ebp - 0x140]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4c9597
mov edi, 1
jmp 0x4c9597
push esi
push edi
mov esi, 0x5836b2
lea edi, [ebp - 0x114]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x5836b2
push 0
push 0x158
push 0x6c
push ebx
call sub.USER32.dll_SendDlgItemMessageA
inc eax
jne 0x4c9581
push 0x5836b2
push 0
push 0x143
push 0x6c
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x4c959f
cmp eax, 0xfffffffe
je 0x4c959f
lea eax, [ebp - 0x140]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4c9597
mov edi, 1
test edi, edi
je 0x4c94f6
cmp esi, 0xffffffff
je 0x4c95aa
push esi
call sub.KERNEL32.dll_FindClose
push 0
push 0
push 0x146
push 0x6c
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
jne 0x4c95c2
xor eax, eax
mov edx, dword [0x568684]
test edx, edx
jl 0x4c95d0
cmp eax, edx
jge 0x4c95d8
xor ecx, ecx
mov dword [0x568684], ecx
push 0
push dword [0x568684]
push 0x14e
push 0x6c
push ebx
call sub.USER32.dll_SendDlgItemMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4cde82
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, 0x577e2a
call fcn.004ceb53
push 2
push dword [0x568950]
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7c
jne 0x4cdebf
cmp dword [0x55d2cc], 0
je 0x4cdee9
push 0x400
push 2
push dword [0x568950]
call sub.USER32.dll_DeleteMenu
jmp 0x4cdee9
cmp dword [0x55d2cc], 0
jne 0x4cdee9
push 0
push 0xefc
call fcn.0042c564
push eax
push 0x7c
push 0x400
push 2
push dword [0x568950]
call sub.USER32.dll_InsertMenuA
push dword [0x568950]
call sub.USER32.dll_GetMenuItemCount
mov ebx, eax
dec ebx
test ebx, ebx
jle 0x4cdf24
push ebx
push dword [0x568950]
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x82
je 0x4cdf24
push 0x400
push ebx
push dword [0x568950]
call sub.USER32.dll_DeleteMenu
dec ebx
test ebx, ebx
jg 0x4cdefb
cmp dword [0x56cee0], 0
je 0x4ce01b
push 0x568be9
push 0
push 0x800
push dword [0x568950]
call sub.USER32.dll_AppendMenuA
mov ebx, 1
mov edi, 0x320
mov esi, dword [0x56cee0]
test esi, esi
je 0x4ce01b
cmp dword [esi + 0x6bc], 0
jne 0x4cdf74
push 4
push ebp
push esi
call fcn.004bd830
jmp 0x4cdf7e
push 0x3c
push ebp
push dword [esi]
call sub.USER32.dll_GetWindowTextA
push ebp
call fcn.0054c2d0
pop ecx
cmp eax, 0x32
jbe 0x4cdf99
push esi
push edi
mov esi, 0x568bed
lea edi, [ebp + 0x32]
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp ebx, 1
jl 0x4cdfb9
cmp ebx, 9
jg 0x4cdfb9
push ebp
push ebx
push 0x568bf2
push 0x578211
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x4cdfe6
cmp ebx, 0xa
jne 0x4cdfd3
push ebp
push str.0__s
push 0x578211
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x4cdfe6
push ebp
push str.____s
push 0x578211
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov edx, dword [0x56cef4]
cmp edx, dword [esi]
jne 0x4cdff7
mov eax, 8
jmp 0x4cdff9
xor eax, eax
push 0x578211
push edi
push eax
push dword [0x568950]
call sub.USER32.dll_AppendMenuA
inc ebx
inc edi
mov esi, dword [esi + 0xd18]
test esi, esi
jne 0x4cdf60
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ce2fb
Capabilities:
Enumerate files on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb4
call fcn.004ceb53
push dword [0x568954]
call sub.USER32.dll_GetMenuItemCount
mov ebx, eax
lea eax, [ebx - 1]
push eax
push dword [0x568954]
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x86
jne 0x4ce334
mov esi, 5
jmp 0x4ce339
mov esi, 4
cmp esi, ebx
jge 0x4ce354
push 0x400
push 3
push dword [0x568954]
call sub.USER32.dll_DeleteMenu
dec ebx
cmp esi, ebx
jl 0x4ce33d
xor ebp, ebp
mov dword [esp + 4], 1
cmp dword [esp + 4], 1
jne 0x4ce38d
push 0x57fd38
push 0x568c14
push 0x577e2a
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x578211
push 0xf11
call fcn.0042c564
jmp 0x4ce3ed
cmp dword [esp + 4], 3
jne 0x4ce3bc
push 0x57fd38
push str._s.txt
push 0x577e2a
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x578211
push 0xf12
call fcn.0042c564
jmp 0x4ce3ed
cmp dword [esp + 4], 4
jne 0x4ce536
push 0x57fd38
push str._s.htm
push 0x577e2a
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x578211
push 0xf22
call fcn.0042c564
call sub.USER32.dll_CreatePopupMenu
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4ce536
xor eax, eax
mov dword [esp], eax
lea edx, [esp + 0xc]
push edx
push 0x577e2a
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ce423
mov edi, 1
jmp 0x4ce48d
xor edi, edi
jmp 0x4ce48d
test byte [esp + 0xc], 0x10
je 0x4ce444
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4ce48d
mov edi, 1
jmp 0x4ce48d
lea eax, [esp + 0x38]
push eax
call fcn.00554294
pop ecx
xor edx, edx
mov dl, byte [esp + 0x38]
push edx
call fcn.00554308
pop ecx
mov byte [esp + 0x38], al
push 0
lea ecx, [esp + 0x3c]
push ecx
push dword [esp + 8]
call fcn.004c6a50
mov ebx, eax
test ebx, ebx
je 0x4ce479
mov dword [esp], ebx
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4ce48d
mov edi, 1
test edi, edi
je 0x4ce427
cmp esi, 0xffffffff
je 0x4ce49c
push esi
call sub.KERNEL32.dll_FindClose
cmp dword [esp + 4], 1
jne 0x4ce4c7
mov dword [esp + 4], 2
push 0x57fd38
push str._s.chm
push 0x577e2a
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x4ce406
push 0
push 0
push dword [esp + 8]
call fcn.0050afb3
mov dword [esp], eax
xor esi, esi
mov ebx, dword [esp]
test ebx, ebx
je 0x4ce4fd
push dword [ebx]
lea eax, [ebp + 0x12c]
push eax
push 0
push dword [esp + 0x14]
call sub.USER32.dll_AppendMenuA
inc esi
inc ebp
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x4ce4e0
push esp
call fcn.004c6e81
test esi, esi
je 0x4ce524
push 0x578211
push dword [esp + 0xc]
push 0x10
push 0x85
push dword [0x568954]
call sub.USER32.dll_InsertMenuA
jmp 0x4ce52d
push dword [esp + 8]
call sub.USER32.dll_DestroyMenu
inc dword [esp + 4]
jmp 0x4ce35e
test ebp, ebp
jle 0x4ce556
push 0x568c38
push 0
push 0x800
push 0x85
push dword [0x568954]
call sub.USER32.dll_InsertMenuA
add esp, 0x14c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d0c79
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0
push 0x96
push 0x578211
push ebx
push dword [0x568958]
call sub.USER32.dll_GetMenuStringA
test eax, eax
jle 0x4d0e53
cmp ebx, 0x513
jne 0x4d0cf1
push edi
call fcn.00411f68
mov edi, eax
test edi, edi
je 0x4d0e53
push edi
push 0
push 0
push 0
push 0x568d7e
call fcn.00524566
mov ebx, eax
mov dword [edi], ebx
push ebx
call fcn.0051dd0a
test eax, eax
jne 0x4d0ce7
push edi
call fcn.004125cd
jmp 0x4d0e53
mov eax, 1
jmp 0x4d0e5c
call fcn.00504100
mov esi, dword [0x56ba70]
test esi, esi
je 0x4d0d92
mov eax, dword [esi]
push esi
push edi
mov esi, 0x577e2a
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x568d8d
push 0x577e2a
call fcn.0054c5e4
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4d0d87
mov byte [ebx], 0
jmp 0x4d0d4e
mov byte [ebx], 0x2c
push 0x3a
push 0x577e2a
call fcn.0054c230
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d0d4b
mov ebx, 0x577e2a
jmp 0x4d0d6b
inc ebx
cmp byte [ebx], 0x2e
je 0x4d0d6a
cmp byte [ebx], 0
je 0x4d0d87
push 0x578211
push ebx
call fcn.0054c494
add esp, 8
test eax, eax
je 0x4d0d92
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x4d0d04
test esi, esi
je 0x4d0e53
cmp dword [0x56a104], 0
je 0x4d0dd5
push 0
push 1
push dword [esi]
push dword [0x56ba70]
call fcn.004c6b77
mov esi, eax
test esi, esi
je 0x4d0e53
mov eax, esi
mov dword [0x56ba70], eax
push eax
push 0x568d96
push 0x586210
call fcn.004ad151
push 0x10
call sub.USER32.dll_GetKeyState
movsx edx, ax
and edx, 0x8000
cmp edx, 0x8000
jne 0x4d0e20
push edi
call fcn.00411f68
mov edi, eax
test edi, edi
je 0x4d0e53
push edi
push 0
push 0
push 0
push 0x568da1
call fcn.00524566
mov ebx, eax
mov dword [edi], ebx
push ebx
call fcn.0051dd0a
test eax, eax
jne 0x4d0e20
push edi
call fcn.004125cd
jmp 0x4d0e53
lea eax, [edi + 0xc]
push eax
call fcn.004c6e81
push 0
push dword [esi]
push 0
call fcn.004c6a50
mov dword [edi + 0xc], eax
push edi
push dword [esi]
call fcn.00504a88
mov dword [edi + 0x14], 0xc
push edi
call fcn.004586f8
mov eax, 1
jmp 0x4d0e5c
push 0
call fcn.0042c4bf
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4d1c61
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [ebp - 8], ecx
xor esi, esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jg 0x4d1d1e
test esi, esi
jne 0x4d1ca4
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jge 0x4d1ca4
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
mov cl, byte [ecx + ebx]
inc dword [ebp - 0xc]
jmp 0x4d1cb1
mov esi, 1
mov dword [ebp - 4], edx
xor ecx, ecx
inc dword [ebp - 0xc]
test esi, esi
je 0x4d1cb9
test edx, edx
je 0x4d1cc9
and ecx, 0xff
shl dword [ebp - 8], 8
add edx, 8
or dword [ebp - 8], ecx
cmp edx, 6
jl 0x4d1d12
sub edx, 6
mov ecx, edx
mov ebx, dword [ebp - 8]
shr ebx, cl
mov ecx, ebx
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, dword [ebp + 0x10]
mov byte [ebx + eax], cl
inc eax
cmp eax, 0x3c
jl 0x4d1cf8
mov edx, dword [ebp + 0x10]
mov byte [edx + eax], 0
jmp 0x4d1d4f
cmp eax, dword [ebp + 0x14]
jl 0x4d1d07
mov eax, 0xffffffff
mov dword [ebp - 0xc], eax
jmp 0x4d1d4f
test esi, esi
je 0x4d1d0d
xor edx, edx
cmp edx, 6
jge 0x4d1cce
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jle 0x4d1c8a
cmp dword [ebp - 4], 2
jne 0x4d1d36
mov edx, dword [ebp + 0x10]
mov byte [edx + eax], 0x3d
inc eax
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], 0x3d
inc eax
jmp 0x4d1d44
cmp dword [ebp - 4], 4
jne 0x4d1d44
mov edx, dword [ebp + 0x10]
mov byte [edx + eax], 0x3d
inc eax
test eax, eax
je 0x4d1d4f
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], 0
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [edx], ecx
mov edx, dword [ebp + 0x1c]
mov dword [edx], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4d271a
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
cmp dword [0x568e88], 0
jne 0x4d274a
cmp dword [0x568e98], 0
jne 0x4d273b
cmp dword [0x568e84], 0
je 0x4d2740
call fcn.004d2860
mov eax, 1
jmp 0x4d285a
call fcn.004d2613
mov dword [esp + 4], eax
mov eax, dword [0x568e84]
test eax, eax
je 0x4d27c4
mov ebx, eax
mov esi, dword [esp + 4]
xor edi, edi
jmp 0x4d2783
push dword [esi]
push dword [ebx]
call fcn.0054c494
add esp, 8
test eax, eax
je 0x4d277d
mov edi, 1
jmp 0x4d278b
mov ebx, dword [ebx + 0x40]
mov esi, dword [esi + 0x40]
test ebx, ebx
je 0x4d278b
test esi, esi
jne 0x4d2766
lea eax, [esp + 4]
push eax
call fcn.004c6e81
test edi, edi
jne 0x4d27ab
xor edx, edx
mov dword [0x568e8c], edx
mov eax, 1
jmp 0x4d285a
mov dword [0x568e8c], 1
call fcn.004d2860
mov eax, 1
jmp 0x4d285a
xor edx, edx
mov dword [0x568e8c], edx
xor ecx, ecx
mov dword [0x568e98], ecx
xor eax, eax
mov dword [0x568e9c], eax
mov eax, dword [esp + 4]
mov dword [0x568e84], eax
test eax, eax
jne 0x4d27ef
mov eax, 1
jmp 0x4d285a
push 0
push 0
push 1
push 0
call sub.KERNEL32.dll_CreateEventA
mov ebx, eax
mov dword [0x568e9c], ebx
test ebx, ebx
jne 0x4d2816
push 0x568e84
call fcn.004c6e81
xor eax, eax
jmp 0x4d285a
push esp
push 0
push 0
push 0x4d24f7
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov ebx, eax
mov dword [0x568e98], ebx
test ebx, ebx
jne 0x4d2855
push dword [0x568e9c]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
mov dword [0x568e9c], eax
push 0x568e84
call fcn.004c6e81
xor eax, eax
jmp 0x4d285a
mov eax, 1
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4d3729
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
or eax, 0xffffffff
mov dword [0x5699a0], eax
mov dword [0x56999c], eax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [0x56999c], eax
cmp eax, 0xffffffff
jne 0x4d3753
push 0
call fcn.004d36a9
ret
mov dx, word [0x569998]
push edx
push dword [0x56999c]
call fcn.004f18ad
test eax, eax
jne 0x4d3772
push 0
call fcn.004d36a9
ret
push 5
push dword [0x56999c]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x4d378b
push 0
call fcn.004d36a9
ret
push 8
push 0x8034
push dword [0x56cee8]
push dword [0x56999c]
call sub.WSOCK32.dll_WSAAsyncSelect
ret
Function at 0x4d5493
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0051dd0a
mov ebx, eax
test ebx, ebx
je 0x4d54b0
cmp dword [ebx + 0x6bc], 1
je 0x4d54bc
push 0
call fcn.0042c4bf
jmp 0x4d5702
push 0
push 0x46e174
push 0x28a
push dword [ebp + 8]
call fcn.0046b0f0
mov esi, eax
test esi, esi
jle 0x4d5702
push ebx
call fcn.0051df69
test eax, eax
je 0x4d5702
test esi, 0x20
je 0x4d5546
push 0x57fc34
push 0x3e7
push 0x577e2a
push 0x569b68
lea edi, [ebx + 8]
push edi
push 0x569b5e
call fcn.004acae5
cmp byte [0x577e2a], 0
je 0x4d5546
push 0x2c
push 0x577e2a
call fcn.0054c230
add esp, 8
test eax, eax
je 0x4d5546
mov byte [eax], 0
push 0x57fc34
push 0x577e2a
push edi
push 0x569b6c
call fcn.004ac86a
test esi, 1
je 0x4d5552
xor edi, edi
jmp 0x4d558b
test esi, 2
je 0x4d5561
mov edi, 1
jmp 0x4d558b
test esi, 4
je 0x4d5570
mov edi, 2
jmp 0x4d558b
push 0x57fc34
push 0
lea eax, [ebx + 8]
push eax
push 0x569b76
call fcn.004ac86a
mov edi, dword [0x569b2c]
test esi, 0x40
je 0x4d55aa
xor eax, eax
mov dword [0x569b30], eax
test esi, 0x20
je 0x4d55aa
xor edx, edx
mov dword [ebx + 0x6dc], edx
mov ecx, esi
and ecx, 0x10
test ecx, ecx
je 0x4d55da
push 0x57fc34
push 0
lea eax, [ebx + 8]
push eax
push 0x569b80
call fcn.004ac86a
mov dword [0x569b2c], edi
mov edx, dword [ebx + 0x6dc]
mov dword [0x569b30], edx
mov dword [ebx + 0x6f4], edi
call fcn.004affec
test esi, 8
jne 0x4d5688
and esi, 0x10
test esi, esi
jne 0x4d5688
push dword [ebp + 8]
call fcn.004d5413
mov esi, eax
cmp dword [ebx + 0x6f4], 0
jne 0x4d5622
push esi
mov esi, 0x569b8a
mov edi, 0x577e2a
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
jmp 0x4d564c
cmp dword [ebx + 0x6f4], 1
jne 0x4d563d
push esi
mov esi, 0x569b91
mov edi, 0x577e2a
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4d564c
push esi
mov esi, 0x569b97
mov edi, 0x577e2a
mov eax, edi
movsd dword es:[edi], dword [esi]
pop esi
test esi, esi
je 0x4d5670
push esi
push 0x569b9c
push 0x577e2a
call fcn.0054c2d0
pop ecx
add eax, 0x577e2a
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x57fc34
push 0x577e2a
add ebx, 8
push ebx
push 0x569ba1
call fcn.004ac86a
mov ebx, dword [0x56cee0]
test ebx, ebx
je 0x4d5702
cmp dword [ebx + 0x6bc], 1
jne 0x4d56f8
push dword [ebx]
call fcn.004d5310
push dword [ebx]
call fcn.004d5709
mov esi, eax
mov dword [ebx + 0x6f4], esi
cmp esi, 2
jne 0x4d56d2
push 0
push dword [ebx + 0x820]
call sub.USER32.dll_ShowWindow
push 0
push dword [ebx + 0x820]
call sub.USER32.dll_EnableWindow
jmp 0x4d56ec
push 1
push dword [ebx + 0x820]
call sub.USER32.dll_EnableWindow
push 8
push dword [ebx + 0x820]
call sub.USER32.dll_ShowWindow
push 0x80b8
push dword [ebx]
call fcn.005207d2
mov ebx, dword [ebx + 0xd18]
test ebx, ebx
jne 0x4d5692
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4e83ee
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff41c
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
call fcn.00412773
test eax, eax
je 0x4e8607
cmp dword [esi + 0x1c90], 0
jne 0x4e8424
xor eax, eax
mov dword [esi + 0x1c94], eax
jmp 0x4e8607
mov ebx, dword [esi + 0x1c90]
test ebx, ebx
je 0x4e85ea
push dword [ebx + 4]
push dword [0x56cee8]
call sub.USER32.dll_KillTimer
xor eax, eax
mov dword [ebx + 4], eax
push 0x7f8
push 0
lea edx, [ebp - 0xbe4]
push edx
call fcn.0054c150
add esp, 0xc
lea ecx, [ebx + 0x74]
push ecx
push 0x3e7
lea eax, [ebp - 0xbbc]
push eax
call fcn.0042e322
cmp dword [ebx + 0x1f0], 0
je 0x4e8569
test edi, edi
jne 0x4e84f4
push dword [ebx]
call fcn.0051dd0a
test eax, eax
jne 0x4e8490
mov edx, dword [esi]
mov dword [ebx], edx
push 0x586e7f
push 0x586d7f
push 0x586c7f
push 0x586c7c
lea ecx, [ebx + 0x74]
push ecx
call fcn.0050ca44
add esp, 0x14
push 0x586e7f
push 0x586d7f
push 0
push 0x1136
call fcn.0042c564
push eax
lea eax, [ebp - 0x3ec]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
xor edx, edx
mov dword [0x56ac00], edx
push dword [0x55f8a0]
lea ecx, [ebp - 0x3ec]
push ecx
push dword [ebx]
call fcn.004ef100
jmp 0x4e8569
cmp edi, 1
jne 0x4e8569
push dword [ebx]
call fcn.0051dd0a
test eax, eax
jne 0x4e8508
mov eax, dword [esi]
mov dword [ebx], eax
push 0x586e7f
push 0x586d7f
push 0x586c7f
push 0x586c7c
lea edx, [ebx + 0x74]
push edx
call fcn.0050ca44
add esp, 0x14
push 0x586e7f
push 0x586d7f
push 0
push 0x1137
call fcn.0042c564
push eax
lea ecx, [ebp - 0x3ec]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 0x10
xor eax, eax
mov dword [0x56ac00], eax
push dword [0x55f8a0]
lea edx, [ebp - 0x3ec]
push edx
push dword [ebx]
call fcn.004ef100
cmp dword [ebx + 0x1f4], 0
je 0x4e857b
lea ecx, [ebx + 0x74]
push ecx
call sub.KERNEL32.dll_DeleteFileA
cmp dword [ebx + 0x1f8], 0
je 0x4e8590
lea eax, [ebx + 0x1f8]
push eax
call fcn.004c6e81
mov edx, dword [ebx + 0x200]
mov dword [ebp - 4], edx
push ebx
call fcn.00557ca0
pop ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x1c90], ecx
cmp dword [0x56acb4], 0
je 0x4e85d3
cmp edi, 5
je 0x4e85d3
lea eax, [ebp - 0xbe4]
push eax
push 0
push 0
push 0x31
push 0x56a78f
push 0
push 0
push esi
call fcn.004fd2f4
cmp edi, 5
je 0x4e8424
push esi
call fcn.004e8256
test eax, eax
jg 0x4e8424
cmp dword [esi + 0x1c90], 0
jne 0x4e85fb
xor edx, edx
mov dword [esi + 0x1c94], edx
push esi
call fcn.004e8fac
push esi
call fcn.004e9b96
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4e95bd
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00412773
test eax, eax
je 0x4e97bb
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], 0xffffffff
mov ecx, dword [0x56a7dc]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x4e97bb
push 0
push 0
push 0x18b
push 0x65
push dword [ebp - 0x18]
call sub.USER32.dll_SendDlgItemMessageA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4e961c
xor eax, eax
mov dword [ebp - 0xc], eax
xor edx, edx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0xc]
jge 0x4e9739
push 0
push dword [ebp - 0x10]
push 0x187
push 0x65
push dword [ebp - 0x18]
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x4e972a
test eax, eax
je 0x4e972a
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4e965e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0
push dword [ebp - 0x10]
push 0x199
push 0x65
push dword [ebp - 0x18]
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x4e972a
xor esi, esi
mov ebx, dword [edi + 0x1c90]
test ebx, ebx
je 0x4e9697
cmp eax, ebx
je 0x4e9697
mov esi, ebx
mov ebx, dword [ebx + 0x200]
test ebx, ebx
jne 0x4e9687
test ebx, ebx
je 0x4e972a
cmp ebx, dword [edi + 0x1c90]
jne 0x4e96ae
mov dword [ebp - 8], 1
cmp dword [ebx + 0x1f4], 0
je 0x4e96c0
lea eax, [ebx + 0x74]
push eax
call sub.KERNEL32.dll_DeleteFileA
cmp dword [ebx + 0x1f8], 0
je 0x4e96d5
lea edx, [ebx + 0x1f8]
push edx
call fcn.004c6e81
test esi, esi
je 0x4e96ee
mov ecx, dword [ebx + 0x200]
mov dword [esi + 0x200], ecx
push ebx
call fcn.00557ca0
pop ecx
jmp 0x4e9707
mov eax, dword [edi + 0x1c90]
mov ebx, dword [eax + 0x200]
push eax
call fcn.00557ca0
pop ecx
mov dword [edi + 0x1c90], ebx
mov dword [ebp - 4], 1
push 0
push dword [ebp - 0x10]
push 0x182
push 0x65
push dword [0x56a7dc]
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x4e9621
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4e962d
cmp dword [ebp - 4], 0
jne 0x4e9748
push 0
call fcn.0042c4bf
jmp 0x4e97bb
push 0xffffffffffffffff
push 0
push 0x185
push 0x65
push dword [ebp - 0x18]
call sub.USER32.dll_SendDlgItemMessageA
cmp dword [ebp - 0x14], 0
jl 0x4e9797
push 0
push dword [ebp - 0x14]
push 0x19e
push 0x65
push dword [ebp - 0x18]
call sub.USER32.dll_SendDlgItemMessageA
inc eax
je 0x4e978e
push dword [ebp - 0x14]
push 1
push 0x185
push 0x65
push dword [ebp - 0x18]
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x4e9797
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jge 0x4e9761
cmp dword [ebp - 8], 0
je 0x4e97af
push edi
call fcn.004e8256
test eax, eax
jle 0x4e97af
push edi
push 2
call fcn.004e83ee
push edi
call fcn.004e8fac
push edi
call fcn.004e9b96
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f56a4
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xfffffef4
mov byte [0x5847c4], 0
lea eax, [esp + 4]
push eax
push str.http_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4f5700
mov dword [esp], 0x104
push esp
lea edx, [esp + 0xc]
push edx
push 0x56b106
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x4f56f7
push 0x5847c4
lea ecx, [esp + 0xc]
push ecx
call fcn.004f562b
push dword [esp + 4]
call sub.ADVAPI32.dll_RegCloseKey
cmp byte [0x5847c4], 0
jne 0x4f5758
lea eax, [esp + 4]
push eax
push str.htmlfile_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4f5758
mov dword [esp], 0x104
push esp
lea edx, [esp + 0xc]
push edx
push 0x56b124
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x4f574f
push 0x5847c4
lea ecx, [esp + 0xc]
push ecx
call fcn.004f562b
push dword [esp + 4]
call sub.ADVAPI32.dll_RegCloseKey
add esp, 0x10c
ret

Function at 0x4f57cb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
cmp byte [0x5846c0], 0
je 0x4f57f6
push 1
push 0x5846c0
call fcn.0042c9b5
test eax, eax
jne 0x4f5875
mov byte [0x5846c0], 0
xor ebx, ebx
test ebx, ebx
jne 0x4f5812
lea eax, [esp + 4]
push eax
push str.mailto_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
jmp 0x4f5826
lea edx, [esp + 4]
push edx
push str..sta_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4f5861
mov dword [esp], 0x104
push esp
lea ecx, [esp + 0xc]
push ecx
push str.command
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x4f5858
push 0x5846c0
lea eax, [esp + 0xc]
push eax
call fcn.004f562b
push dword [esp + 4]
call sub.ADVAPI32.dll_RegCloseKey
cmp byte [0x5846c0], 0
jne 0x4f5875
test ebx, ebx
jne 0x4f5875
mov ebx, 1
jmp 0x4f57f8
add esp, 0x10c
pop ebx
ret