joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7efb8d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6dc
push ebx
push esi
push edi
lea edi, reloc.iphlpapi.dll_GetAdaptersInfo
mov ecx, 0x1b7
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov edx, dword [ecx + 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x2c]
add edx, 4
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x38]
and ecx, 0xc
je 0x7efc4e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
sub ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x40], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0
je 0x7efc18
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x38]
and ecx, 4
je 0x7efc4e
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.007f1dfd
add esp, 8
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 6]
cmp ecx, 1
jne 0x7efc45
mov eax, dword [ebp - 0x2c]
sub eax, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], eax
jmp 0x7f1d18
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x38]
shr eax, 6
and eax, 0xff
shl eax, 4
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
and eax, 0x3f
mov dword [ebp - reloc.iphlpapi.dll_GetAdaptersInfo], eax
cmp dword [ebp - reloc.iphlpapi.dll_GetAdaptersInfo], 0x25
ja 0x7f1d13
mov ecx, dword [ebp - reloc.iphlpapi.dll_GetAdaptersInfo]
jmp dword [ecx*4 + 0x1002a274]
jmp 0x7efbd7
push edx
mov ecx, ebp
push eax
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
call fcn.0081afd2
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x6dc
cmp ebp, esp
call fcn.0081afaf
mov esp, ebp
pop ebp
ret
Function at 0x7fe25d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
push ebx
push esi
push edi
lea edi, reloc.iphlpapi.dll_GetAdaptersInfo
mov ecx, 0xbf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.007e845d
add esp, 8
mov dword [ebp - 8], 0x200
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
push eax
call fcn.007e804d
add esp, 4
mov dword [ebp - reloc.iphlpapi.dll_GetAdaptersInfo], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jbe 0x7fe2b8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp - reloc.iphlpapi.dll_GetAdaptersInfo]
push edx
call fcn.007d14d0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - reloc.iphlpapi.dll_GetAdaptersInfo]
add eax, dword [ebp - 0x14]
mov dword [ebp - reloc.iphlpapi.dll_GetAdaptersInfo], eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
je 0x7fe2f6
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
je 0x7fe295
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
push eax
call fcn.007e82fd
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x7fe329
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call fcn.007e4b6d
add esp, 8
test eax, eax
ja 0x7fe329
mov dword [ebp - reloc.iphlpapi.dll_GetAdaptersInfo], 0
jmp 0x7fe333
mov dword [ebp - reloc.iphlpapi.dll_GetAdaptersInfo], 1
mov eax, dword [ebp - reloc.iphlpapi.dll_GetAdaptersInfo]
push edx
mov ecx, ebp
push eax
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
call fcn.0081afd2
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x2fc
cmp ebp, esp
call fcn.0081afaf
mov esp, ebp
pop ebp
ret
Function at 0x7fe50d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
push edi
lea edi, [ebp - 0xf4]
mov ecx, 0x3d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
call fcn.007e3fbd
add esp, 4
sub eax, 1
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 1
jmp 0x7fe54f
mov eax, dword [ebp + 0x10]
add eax, 1
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xf4], eax
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 0xf4], 0
je 0x7fe62b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.007e452d
add esp, 8
cmp eax, 3
jne 0x7fe5cf
cmp dword [ebp - 0x14], 0
je 0x7fe5ba
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.007e48cd
fstp qword [esp]
push 0x10068228
mov edx, dword [ebp + 0xc]
push edx
call fcn.0081b4f9
add esp, 0x10
test eax, eax
jle 0x7fe5ba
mov dword [ebp - 0xf4], 1
jmp 0x7fe5c4
mov dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x14], eax
jmp 0x7fe626
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.007e775d
add esp, 0xc
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x14], 0
je 0x7fe613
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push 1
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0081e703
add esp, 0x10
cmp eax, dword [ebp - 0x20]
jne 0x7fe613
mov dword [ebp - 0xf4], 1
jmp 0x7fe61d
mov dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x14], eax
jmp 0x7fe546
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.007fd6ad
add esp, 0xc
push edx
mov ecx, ebp
push eax
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
call fcn.0081afd2
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf4
cmp ebp, esp
call fcn.0081afaf
mov esp, ebp
pop ebp
ret
Function at 0x97aa99
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x97aab5
push 0x21
push 0x1002ad24
push 0x1002ad40
call fcn.0097aa09
add esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
test ebp, ebp
push edi
jne 0x97aad5
push 0x22
push 0x1002ad4c
push 0x1002ad68
call fcn.0097aa09
add esp, 0xc
mov esi, dword [esp + 0x20]
test esi, esi
jne 0x97aaf1
push 0x23
push 0x1002ad74
push 0x1002ad90
call fcn.0097aa09
add esp, 0xc
mov eax, dword [esi]
push eax
call fcn.0097aa69
add esp, 4
test eax, eax
jne 0x97ac8d
mov ecx, dword [esi + 4]
cmp ecx, 1
jl 0x97ac88
cmp ecx, 0x80
jg 0x97ac88
mov eax, dword [esi + 8]
test eax, eax
jl 0x97ac88
cmp eax, 0x80
jg 0x97ac88
test cl, 3
jne 0x97ac88
cmp eax, ecx
jne 0x97ab8d
mov eax, dword [esi]
lea edx, [eax + eax*2]
shl edx, 5
mov edi, dword [edx + reloc.iphlpapi.dll_GetAdaptersInfo]
test edi, edi
je 0x97ab8d
mov ebx, dword [esp + 0x1c]
cmp ebx, ecx
jb 0x97ab91
mov edx, dword [esi + 0xc]
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
push eax
lea eax, [esi + 0x10]
push edx
push eax
mov eax, ebx
xor edx, edx
div ecx
mov ecx, dword [esp + 0x20]
push eax
push ebp
push ecx
call edi
add esp, 0x18
test eax, eax
jne 0x97ac8d
mov eax, ebx
xor edx, edx
div dword [esi + 4]
mov ebx, edx
jmp 0x97ab91
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x97ac81
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x97ac0f
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x97abcd
test eax, eax
jle 0x97abe1
mov ecx, 0xfffffff0
lea eax, [esi + 0x10]
sub ecx, esi
mov dl, byte [eax]
inc dl
mov byte [eax], dl
jne 0x97abe1
mov edi, dword [esi + 4]
inc eax
lea edx, [ecx + eax]
cmp edx, edi
jl 0x97abb8
jmp 0x97abe1
dec eax
test eax, eax
jl 0x97abe1
mov cl, byte [esi + eax + 0x10]
inc cl
mov byte [esi + eax + 0x10], cl
jne 0x97abe1
dec eax
jns 0x97abd2
mov eax, dword [esi]
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
push ecx
lea edx, [esi + 0x90]
lea eax, [eax + eax*2]
lea ecx, [esi + 0x10]
shl eax, 5
push edx
push ecx
call dword [eax + 0x1002c224]
add esp, 0xc
test eax, eax
jne 0x97ac8d
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
test eax, eax
jne 0x97ac5b
mov edx, dword [esi + 4]
cmp ebx, edx
jb 0x97ac5b
xor ecx, ecx
test edx, edx
jle 0x97ac45
mov edx, dword [esp + 0x14]
mov eax, ebp
sub edx, ebp
mov edi, dword [esi + ecx + 0x90]
add ecx, 4
xor edi, dword [edx + eax]
add eax, 4
mov dword [eax - 4], edi
mov edi, dword [esi + 4]
cmp ecx, edi
jl 0x97ac2b
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x14]
add edi, eax
add ebp, eax
mov dword [esp + 0x14], edi
sub ebx, eax
mov dword [esi + 8], eax
jmp 0x97ac79
mov dl, byte [eax + esi + 0x90]
mov eax, dword [esp + 0x14]
xor dl, byte [eax]
mov byte [ebp], dl
mov edx, dword [esi + 8]
inc ebp
inc edx
inc eax
mov dword [esi + 8], edx
mov dword [esp + 0x14], eax
dec ebx
test ebx, ebx
jne 0x97ab99
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x97b9f9
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x310
push ebx
push ebp
mov ebp, dword [esp + reloc.iphlpapi.dll_GetAdaptersInfo]
push esi
test ebp, ebp
push edi
jne 0x97ba22
push 0x24
push 0x1002af84
push 0x1002afa8
call fcn.0097aa09
add esp, 0xc
mov edi, dword [esp + reloc.iphlpapi.dll_GetAdaptersInfo]
test edi, edi
jne 0x97ba41
push 0x25
push 0x1002afb4
push 0x1002afd8
call fcn.0097aa09
add esp, 0xc
mov ebx, dword [esp + reloc.iphlpapi.dll_GetAdaptersInfo]
test ebx, ebx
jne 0x97ba60
push 0x26
push 0x1002afe8
push 0x1002b00c
call fcn.0097aa09
add esp, 0xc
mov esi, dword [esp + reloc.iphlpapi.dll_GetAdaptersInfo]
push esi
call fcn.0097aa39
add esp, 4
test eax, eax
jne 0x97bb3f
lea eax, [esi + esi*2]
mov ecx, dword [edi]
lea esi, [esi + eax*4]
shl esi, 3
mov eax, dword [esi + reloc.iphlpapi.dll_GetAdaptersInfo]
cmp ecx, eax
jae 0x97ba9f
mov dword [edi], eax
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x310
ret
lea ecx, [esp + 0x10]
push ecx
call dword [esi + 0x1002ce5c]
add esp, 4
test eax, eax
jne 0x97bb3f
mov edx, dword [esi + reloc.iphlpapi.dll_GetAdaptersInfo]
push ebx
push 0x200
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
push 1
push eax
mov dword [edi], edx
call fcn.0097c213
mov edi, eax
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
push edi
lea edx, [esp + 0x24]
push ecx
push edx
call dword [esi + 0x1002ce60]
add esp, 0x1c
test eax, eax
jne 0x97bb3f
cmp edi, 0x200
jne 0x97bb30
push ebx
push edi
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
push 1
push eax
call fcn.0097c213
mov edi, eax
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
push edi
lea edx, [esp + 0x24]
push ecx
push edx
call dword [esi + 0x1002ce60]
add esp, 0x1c
test eax, eax
je 0x97baef
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x310
ret
lea eax, [esp + 0x10]
push ebp
push eax
call dword [esi + 0x1002ce64]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x310
ret
Function at 0xec052b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 5]
cld
mov word [esp], bx
rdtsc
push word [esp + 1]
pop eax
jmp 0xec0468
mov edi, 0x14b6ae4a
mov word [esp + 4], di
xchg word [esp + 4], dx
xchg di, ax
lea esp, [esp]
jmp 0xec038e
lea edi, [edi*4]
pop eax
push esp
xchg byte [esp + 2], al
jmp 0xec03a7
lea eax, [ebp*4]
xchg word [esp + 1], di
neg dh
bsf di, ax
mov dl, dh
btc eax, edx
jmp 0xec03c1
not edx
xchg ah, dh
bts edi, edi
rdtsc
mov edi, ecx
pop dword [esp + 0x10]
jmp 0xec0449
mov edi, dword [esp + 0x17]
pop dword [esp]
bswap edi
bt edi, edx
xchg word [esp + 3], dx
mov dx, bx
jmp 0xec03f1
pop edx
xchg word [esp + 0x17], di
push dword [esp + 0xc]
lea edi, [ebx + edi]
mov byte [esp + 8], dh
not dh
jmp 0xec0412
pop dx
mov eax, 0x98beaf8c
lea esp, [esp + 0x11]
neg eax
xchg word [esp], di
push word [esp]
call fcn.00ec0478
hlt
bswap edi
mov dh, 0x90
pushal
inc dl
rol dh, 3
mov dword [esp + 0xd], ebp
jmp 0xec0434
lea edi, [ecx*4]
mov ax, word [esp + 4]
mov byte [esp + 5], dh
xchg di, ax
xchg byte [esp + 2], dl
mov edi, 0x2847dbd8
jmp 0xec03d8
ror dh, 5
rol dx, cl
pop dx
inc di
xchg word [esp], di
jmp 0xec0493

Function at 0xec06da
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
setg dh
and dh, bh
pushal
jmp 0xec06f7
lea esp, [esp + 0x4e]
and ax, 0x9ef2
mov edx, edi
lea edi, [eax - 0x29]
mov edi, 0x47539a8c
jmp 0xec0795
mov di, 0x7185
not dh
lea edi, [esp + ebp]
lea esp, [esp + 1]
mov edx, dword [esp]
pop ax
jmp 0xec0728
xchg byte [esp + 0x1d], al
neg edx
mov eax, 0xad9e6aa8
add esp, 0x1d
neg di
jmp 0xec0742
push esp
sub esp, 0x1c
lea edx, [ebx + esi]
xchg edi, edx
mov dh, bh
bswap edx
jmp 0xec0767
sub dh, ah
dec eax
mov dh, bh
mov edi, ebp
inc ax
lea edx, [edi*4]
jmp 0xec077e
Function at 0xec0c41
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
mov edx, ecx
push word [esp + 0xd]
rdtsc
xchg di, ax
shl eax, 0x13
jmp 0xec094a
push word [esp + 0xd]
lea edi, [ebp - 0x97]
mov al, 0x86
mov dx, 0xd033
rdtsc
push word [esp + 0xb]
jmp 0xec0911
btc eax, ebx
mov edi, eax
xchg ah, dh
not dh
rdtsc
mov di, word [esp + 8]
jmp 0xec0a23
bswap edi
mov byte [esp + 0x13], ch
rcr di, cl
mov eax, esp
lea esp, [esp]
not dh
jmp 0xec0930
mov byte [esp + 0x1b], bh
pop dword [esp + 0xb]
lea edi, [edx + esi]
push esp
bsf di, ax
bswap edx
jmp 0xec09e3
lea edi, reloc.iphlpapi.dll_GetAdaptersInfo
mov dh, byte [esp + 0x18]
inc edx
sub esp, 0xc
mov dx, cx
lea edi, [esp + eax]
jmp 0xec097e
pop edi
mov al, ah
push word [esp + 0x20]
not di
shr dh, 5
pop edi
jmp 0xec0a70
mov dword [esp + 0x15], ebp
rdtsc
rdtsc
sub edi, ebp
setp dh
mov dh, 0xf8
jmp 0xec09ae
pop dx
mov edi, eax
xchg byte [esp + 0xa], dh
inc ax
xchg ah, dh
mov edx, dword [esp + 0xe]
jmp 0xec09ca
mov dh, byte [esp + 0xf]
inc edi
xchg word [esp + 0xe], di
mov al, ah
rdtsc
mov word [esp + 0x15], di
jmp 0xec0998
mov edi, eax
mov edx, 0x3bdc437c
mov dword [esp + 0x11], ebp
xchg byte [esp + 6], dh
inc eax
lea edi, reloc.iphlpapi.dll_GetAdaptersInfo
jmp 0xec0a09
mov ax, bp
rdtsc
lea eax, [ecx*4]
pop dword [esp + 2]
push edx
mov dh, ch
jmp 0xec0a85
lea eax, [ebp*4]
lea eax, [esp + edx]
mov ah, byte [esp + 0x15]
cmc
jmp 0xec0a3b
mov edi, esi
rcr edi, 3
add esp, 0xa
push word [esp + 8]
mov di, 0x8471
rdtsc
jmp 0xec0a59
sub esp, 0x1e
mov dx, word [esp + 0x31]
pushal
lea esp, [esp + 0x55]
mov edx, 0xa44fcf74
call fcn.00ec0bce
mov esi, 0xc4832889
or dword [ebx + reloc.iphlpapi.dll_GetAdaptersInfo], ecx
wait
invalid
add esp, 9
mov edx, dword [esp + 3]
setnp dh
mov ah, byte [esp + 0x14]
xchg word [esp + 0x10], dx
pop ax
jmp 0xec096c
xchg word [esp + 0xc], di
xchg dh, dl
jmp 0xec0a9f

Function at 0xec12de
Capabilities:
Execute anti-debugging instructions

Disassembly:
setg dh
add esp, 1
pop word [esp + 1]
stc
pop edi
mov byte [esp + 1], bh
mov edi, ebp
xchg word [esp], di
jmp 0xec1193
add esp, 3
bsr dx, bp
add esp, 0
sub esp, 8
inc di
xchg dh, al
jmp 0xec11c2
xchg edx, eax
lea esp, [esp + 0x23]
mov dh, byte [esp + 1]
lea eax, [edx + esi]
lea esp, [esp + 1]
pop word [esp + 1]
jmp 0xec11ee
inc dh
mov di, word [esp + 0x1e]
xchg word [esp + 0x25], dx
lea edx, [eax*4]
jmp 0xec1294
Function at 0xec60bb
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Parse pe header

Disassembly:
call fcn.00ec506e
pop word [esp]
mov byte [esp], bh
mov byte [esp], dh
jmp 0xec60f6
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
mov eax, dword fs:[0x30]
jmp 0xec6188
mov eax, dword [eax + 8]
push eax
jmp 0xec5069
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0xec614a

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x40a2a2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x40a2da
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x40a2c8
mov al, 1
jmp 0x40a324
cmp dword [ebx + 0x54], ecx
jne 0x40a2d1
mov al, 2
jmp 0x40a324
cmp dword [ebx + 0x7c], ecx
jne 0x40a324
mov al, 3
jmp 0x40a324
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x40a2ef
mov al, 4
jmp 0x40a324
cmp ecx, 5
jne 0x40a30f
cmp ebx, 0
jne 0x40a2fd
mov al, 5
jmp 0x40a324
cmp ebx, 1
jne 0x40a306
mov al, 6
jmp 0x40a324
cmp ebx, 2
jne 0x40a30f
mov al, 7
jmp 0x40a324
cmp ecx, 6
jne 0x40a31b
cmp ebx, 0
jne 0x40a31d
mov al, 8
jmp 0x40a324
cmp ebx, 1
jne 0x40a324
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e580
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4bcf6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004b15d4
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x45e602
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004af2aa
mov eax, dword [eax]
push 0x662208
push eax
call fcn.004a1f74
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004b185f
test bl, bl
je 0x45e602
push 0x662208
lea ecx, [esp + 0xc]
call fcn.004b1bef
push 0x665da8
lea ecx, [esp + 0xc]
call fcn.004b1bef
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x45e63e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004b185f
jmp 0x45e709
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x45e6c2
lea edx, [esp + 0x7c]
push 0x665da4
push edx
call fcn.004a1f74
add esp, 8
test eax, eax
je 0x45e6c2
lea eax, [esp + 0x7c]
push 0x665da0
push eax
call fcn.004a1f74
add esp, 8
test eax, eax
je 0x45e6c2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x45e652
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004b185f
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x45ef00
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x45ef62
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x45ef70
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4bcfeb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x66c278]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x45f0a8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x45efd6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004b185f
xor eax, eax
jmp 0x45f11f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004b199c
push esi
lea ecx, [esp + 0xc]
call fcn.004b1c2b
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x45f0fd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.0045ef00
test eax, eax
jne 0x45f0fd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.0045ef00
test eax, eax
jne 0x45f0fd
lea eax, [esp + 0x14]
push 0x665dbc
push eax
call fcn.004a3080
mov esi, eax
add esp, 8
test esi, esi
jne 0x45f0dc
lea ecx, [esp + 0x14]
push 0x665db8
push ecx
call fcn.004a3000
mov esi, eax
add esp, 8
test esi, esi
jne 0x45f0dc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x45f0df
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004b194c
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x45efee
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004b185f
xor eax, eax
jmp 0x45f11f
mov byte [esi], 0
push 0x665db4
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004b185f
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4