joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451300
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x8d6c38]
test eax, eax
je 0x451328
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x8d6c38]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x8d6c38], 0
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
call fcn.004500f0
call fcn.004016d0
call fcn.004113f0
mov eax, dword [0x1425d00]
test eax, eax
je 0x451370
push edi
push 1
call eax
add esp, 4
xor eax, eax
mov ecx, 0x3b
mov edi, 0x1425d00
rep stosd dword es:[edi], eax
mov ecx, 0x80
mov edi, 0x8d4878
rep stosd dword es:[edi], eax
mov dword [0x8d4a78], eax
pop edi
ret

Function at 0x451380
Capabilities:
Terminate process

Disassembly:
call fcn.00451300
push 0x10
push str.WIN_OUT_OF_MEM_TITLE
call fcn.00450c30
add esp, 4
push eax
push str.WIN_OUT_OF_MEM_BODY
call fcn.00450c30
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0051c8f0
int3

Function at 0x4516d0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x160
mov eax, dword [0x562940]
xor eax, dword [esp + 0x160]
push edi
mov dword [esp + 0x160], eax
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x5c]
push eax
push 0x104
mov dword [esp + 0x20], 0x44
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
lea eax, [esp + 0x80]
push eax
push str.__s_s_
call fcn.00440920
add esp, 0xc
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x451790
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0x400
mov esi, eax
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [esp + 4]
push esi
push edx
push ebx
lea eax, [esp + 0x68]
push eax
push str.EXE_ERR_COULDNT_START_PROCESS
call fcn.00440920
push eax
push 1
call fcn.0042e650
add esp, 0x1c
pop esi
mov eax, dword [esp + 0x164]
test eax, eax
je 0x4517a5
mov eax, str.quit_n
call fcn.004209c0
mov ecx, dword [esp + 0x15c]
xor ecx, dword [esp + 0x160]
add esp, 0x160
jmp fcn.00523319

Function at 0x4517c0
Capabilities:
Create process on windows

Disassembly:
push 9
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jne 0x4517ee
push esi
push str.EXE_ERR_COULDNT_OPEN_URL
call fcn.00440920
push eax
push 1
call fcn.0042e650
add esp, 0x10
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x451801
push 3
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 4]
test eax, eax
je 0x451813
mov eax, str.quit_n
jmp fcn.004209c0
ret
Function at 0x451830
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x1020
call fcn.00523e50
mov eax, dword [0x562940]
xor eax, dword [esp + 0x1020]
mov ecx, dword [esp + 0x1024]
push ebx
push esi
mov dword [esp + 0x1024], eax
push edi
lea eax, [esp + 0x1034]
push eax
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.0051ab32
add esp, 0xc
lea ecx, [esp + 0x28]
call fcn.004536d0
mov ecx, 0x55a130
call fcn.004536d0
lea esi, [esp + 0x28]
call fcn.00453860
mov eax, dword [0x8d7278]
mov ecx, 1
cmp eax, ecx
mov dword [0x8d727c], ecx
je 0x4518cc
mov eax, dword [0x8d6c40]
test eax, eax
mov dword [0x8d7278], ecx
je 0x4518cc
push ecx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x8d6c44]
push 0xffff
push 0
push 0xb6
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.00451300
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
call esi
test eax, eax
jne 0x4518f9
call fcn.0042e960
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebx
jmp 0x4518e3

Function at 0x451ae0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x451b57
push edi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x451b50
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
je 0x451b4f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalSize]
push edi
call ebx
inc eax
push eax
call fcn.0042a470
add esp, 4
push edi
mov esi, eax
call ebx
mov ebx, eax
lea eax, [ebx - 1]
push eax
push ebp
push esi
call fcn.0051a040
add esp, 0xc
push edi
mov byte [ebx + esi - 1], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0x5510f0
push esi
call fcn.0051c930
add esp, 8
pop ebx
pop ebp
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
ret
Function at 0x45b2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, 0x10000
push ebx
push esi
push edi
mov ebx, ecx
jge 0x45b2f8
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
dec eax
cmp eax, 0xff
jg 0x45b2e9
movzx esi, byte [eax + 0x957ce8]
jmp 0x45b308
sar eax, 8
movzx esi, byte [eax + 0x957ce8]
add esi, 8
jmp 0x45b308
push eax
push str.MT_GetSize:_max_allocation_exceeded
call fcn.0045b0e0
add esp, 8
xor esi, esi
dec dword [0x8d7aa8]
mov ecx, esi
mov edi, 1
shl edi, cl
mov ecx, dword [0x8d7ce0]
sub ecx, edi
cmp esi, 0x10
mov dword [0x8d7ce0], ecx
je 0x45b355
lea ebx, [ebx]
movzx eax, bx
push esi
xor eax, edi
call fcn.0045ad60
add esp, 4
test al, al
je 0x45b355
not edi
and ebx, edi
inc esi
mov edi, 1
mov ecx, esi
shl edi, cl
cmp esi, 0x10
jne 0x45b330
movzx eax, bx
push eax
mov eax, esi
call fcn.0045ac20
add esp, 4
pop edi
pop esi
pop ebx
ret

Function at 0x45b390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
sub ecx, 0x8d7ce8
sar ecx, 3
jmp fcn.0045b2c0

Function at 0x45b460
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x8d7aa0]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x45b5eb
push esi
push edi
xor esi, esi
jmp 0x45b480
push 0x100000
mov dword [esi + 0x957e04], 0x10000
mov dword [esi + 0x957e18], ebx
call fcn.0051b1e7
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x45b531
push 0x100000
push ebx
push edi
call fcn.0042b1c0
mov ecx, dword [esi + 0x957e04]
shl ecx, 4
mov edx, ecx
shr ecx, 2
mov dword [esi + 0x957e10], edi
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
add esi, 4
add esp, 0xc
cmp esi, 8
rep stosb byte es:[edi], al
jl 0x45b480
push 0x40000
mov dword [0x957df4], 0x10000
mov dword [0x957df0], ebx
call fcn.0051b1e7
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x45b562
call fcn.00451300
push 0x10
push str.WIN_OUT_OF_MEM_TITLE
call fcn.00450c30
add esp, 4
push eax
push str.WIN_OUT_OF_MEM_BODY
call fcn.00450c30
add esp, 4
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0051c8f0
call fcn.00451300
push 0x10
push str.WIN_OUT_OF_MEM_TITLE
call fcn.00450c30
add esp, 4
push eax
push str.WIN_OUT_OF_MEM_BODY
call fcn.00450c30
add esp, 4
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0051c8f0
push 0x40000
push ebx
push esi
call fcn.0042b1c0
push 0x140
mov dword [0x13f8d44], esi
mov dword [0x957e0c], ebx
mov dword [0x957df8], ebx
mov dword [0x957dfc], 0x10
mov dword [0x957dec], ebx
call fcn.0051b1e7
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x45b5d4
call fcn.00451300
push 0x10
push str.WIN_OUT_OF_MEM_TITLE
call fcn.00450c30
add esp, 4
push eax
push str.WIN_OUT_OF_MEM_BODY
call fcn.00450c30
add esp, 4
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0051c8f0
push 0x140
push ebx
push esi
call fcn.0042b1c0
add esp, 0xc
pop edi
mov dword [0x13f8d50], esi
pop esi
pop ebx
ret
Function at 0x4fefe0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x562940]
xor eax, dword [esp + 0x98]
mov dword [esp], 0x94
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4ff021
push str.GLW_CheckOSVersion_____GetVersionEx_failed_n
push eax
call dword [0x15485a0]
add esp, 8
jmp 0x4ff061
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x4ff048
mov eax, 1
mov ecx, dword [esp + 0x94]
xor ecx, dword [esp + 0x98]
add esp, 0x98
jmp fcn.00523319
cmp eax, 4
jne 0x4ff061
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
jne 0x4ff061
cmp dword [esp + 8], 0xa
jae 0x4ff063
xor eax, eax
mov ecx, dword [esp + 0x94]
xor ecx, dword [esp + 0x98]
add esp, 0x98
jmp fcn.00523319
Function at 0x50ad50
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x10], 0xcc
je 0x50ad73
mov eax, dword [esi + 0x17c]
push esi
call dword [eax]
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x10], 0xcc
mov ecx, dword [esi + 0x17c]
mov al, byte [ecx + 8]
test al, al
je 0x50ad9e
mov edx, dword [esi]
mov dword [edx + 0x14], 0x2d
mov eax, dword [esi]
push esi
call dword [eax]
mov ecx, dword [esi + 0x17c]
mov al, byte [ecx + 8]
add esp, 4
test al, al
jne 0x50ad80
mov cl, byte [esi + 0x41]
xor edx, edx
test cl, cl
setne dl
mov al, 1
add edx, 0xcd
mov dword [esi + 0x10], edx
ret
Function at 0x50eea0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
cmp ebp, 0x3b9ac9f0
push esi
mov esi, dword [esp + 0x18]
mov ebx, dword [esi + 4]
push edi
mov dword [esp + 0x14], ebx
jbe 0x50eed8
mov eax, dword [esi]
mov dword [eax + 0x14], 0x33
mov ecx, dword [esi]
mov dword [ecx + 0x18], 1
mov edx, dword [esi]
push esi
call dword [edx]
add esp, 4
mov eax, ebp
and eax, 7
jbe 0x50eeec
mov ecx, 8
sub ecx, eax
add ebp, ecx
mov dword [esp + 0x24], ebp
mov edi, dword [esp + 0x20]
test edi, edi
jl 0x50eef9
cmp edi, 2
jl 0x50ef0f
mov edx, dword [esi]
mov dword [edx + 0x14], 0xb
mov eax, dword [esi]
mov dword [eax + 0x18], edi
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
mov ecx, dword [ebx + edi*4 + 0x30]
test ecx, ecx
mov dword [esp + 0x10], 0
je 0x50ef33
nop
cmp dword [ecx + 8], ebp
jae 0x50f028
mov dword [esp + 0x10], ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x50ef20
mov eax, dword [esp + 0x10]
add ebp, 0x10
test eax, eax
jne 0x50ef47
mov edi, dword [edi*4 + 0x534b58]
jmp 0x50ef4e
mov edi, dword [edi*4 + 0x534b60]
mov eax, 0x3b9aca00
sub eax, ebp
cmp edi, eax
jbe 0x50ef5b
mov edi, eax
lea ebx, [edi + ebp]
push ebx
call fcn.0051b1e7
mov esi, eax
add esp, 4
test esi, esi
je 0x50efb9
lea ecx, [ecx]
push ebx
push 0
push esi
call fcn.0042b1c0
add esp, 0xc
test esi, esi
mov ecx, esi
jne 0x50efeb
shr edi, 1
cmp edi, 0x32
jae 0x50efa7
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
mov dword [edx + 0x14], 0x33
mov ecx, dword [eax]
mov dword [ecx + 0x18], 2
mov edx, dword [eax]
push eax
call dword [edx]
add esp, 4
lea ebx, [edi + ebp]
push ebx
call fcn.0051b1e7
mov esi, eax
add esp, 4
test esi, esi
jne 0x50ef70
call fcn.00451300
push 0x10
push str.WIN_OUT_OF_MEM_TITLE
call fcn.00450c30
add esp, 4
push eax
push str.WIN_OUT_OF_MEM_BODY
call fcn.00450c30
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.0051c8f0
mov eax, dword [esp + 0x14]
mov ebx, dword [eax + 0x48]
lea edx, [edi + ebp]
mov ebp, dword [esp + 0x24]
add ebx, edx
mov edx, dword [esp + 0x24]
add edi, edx
mov edx, dword [esp + 0x10]
test edx, edx
mov dword [eax + 0x48], ebx
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], edi
jne 0x50f026
mov edx, dword [esp + 0x20]
mov dword [eax + edx*4 + 0x30], esi
jmp 0x50f028
mov dword [edx], esi
mov edx, dword [ecx + 4]
lea eax, [edx + ecx + 0x10]
add edx, ebp
pop edi
mov dword [ecx + 4], edx
mov edx, dword [ecx + 8]
pop esi
sub edx, ebp
pop ebp
mov dword [ecx + 8], edx
pop ebx
add esp, 8
ret
Function at 0x51d38c
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x532730
call fcn.0051f5d0
mov edi, 0x94
mov eax, edi
call fcn.00523e50
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x56e1e0], ecx
mov eax, dword [esi + 4]
mov dword [0x56e1ec], eax
mov edx, dword [esi + 8]
mov dword [0x56e1f0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x56e1e4], esi
cmp ecx, 2
je 0x51d3ec
or esi, 0x8000
mov dword [0x56e1e4], esi
shl eax, 8
add eax, edx
mov dword [0x56e1e8], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x51d427
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x51d427
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x51d43f
cmp eax, 0x20b
je 0x51d42c
mov dword [ebp - 0x1c], esi
jmp 0x51d453
cmp dword [ecx + 0x84], 0xe
jbe 0x51d427
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x51d44d
cmp dword [ecx + 0x74], 0xe
jbe 0x51d427
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0052057e
pop ecx
test eax, eax
jne 0x51d467
push 0x1c
call fcn.0051d312
pop ecx
call fcn.0051efd1
test eax, eax
jne 0x51d478
push 0x10
call fcn.0051d312
pop ecx
call fcn.00523327
mov dword [ebp - 4], esi
call fcn.0052226d
test eax, eax
jge 0x51d491
push 0x1b
call fcn.0051d2ed
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x14010f8], eax
call fcn.00523d26
mov dword [0x56e228], eax
call fcn.00523c84
test eax, eax
jge 0x51d4b7
push 8
call fcn.0051d2ed
pop ecx
call fcn.00523a51
test eax, eax
jge 0x51d4c8
push 9
call fcn.0051d2ed
pop ecx
call fcn.0051c7b8
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x51d4db
push eax
call fcn.0051d2ed
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.005239e8
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x51d4fc
movzx eax, word [ebp - 0x34]
jmp 0x51d4ff
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00452750
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x51d51d
push edi
call fcn.0051c8f0
call fcn.0051c912
jmp 0x51d54f
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0051f60b
ret
Function at 0x445c40
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x445b8c
call sub.user32.dll_EnumWindows
ret

Function at 0x445d64
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x445de1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004457b0
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x445d89
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00445408
cmp dword [ebp - 4], 0
je 0x445dcb
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004a2f84
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445de8
lea eax, [ebp - 4]
call fcn.004a2ad4
ret

Function at 0x44dab8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004a2ad4
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44db07
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.004a2d3c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x454084
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x45408a
ret

Function at 0x456558
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4565a9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x456590
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x456580
jmp 0x4565a9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x456591
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ab438
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
test eax, eax
je 0x4ab49a
call fcn.004ab3e8
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004a5a90
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004a5a90
pop ecx
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile
push ebx
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4ab518
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4e518c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4ab5f2
cmp dword [0x4e5188], 0
jne 0x4ab5f2
cmp dword [0x4e536c], 0
je 0x4ab5ac
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004ab2e8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4ab592
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004ab2e8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4ab592
lea ebx, [ebp - 0x84]
jmp 0x4ab593
inc ebx
call fcn.004ab4d4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.user32.dll_MessageBoxA
jmp 0x4ab62d
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4e5190
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004a5a90
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4e5193
push ebx
call sub.kernel32.dll_WriteFile
jmp 0x4ab62d
cmp dword [0x4e5188], 0
je 0x4ab60c
cmp dword [0x4e5188], 0xffffffff
je 0x4ab62d
push esi
call dword [0x4e5188]
pop ecx
mov eax, dword [0x4e518c]
test eax, eax
je 0x4ab62d
cmp dword [0x4e518c], 0xffffffff
je 0x4ab62d
cmp byte [eax], 0
je 0x4ab62d
push esi
push eax
call fcn.004ab438
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d340
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47af0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046d629
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40d3c2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046ad6d
mov eax, dword [eax]
push 0x5a41e0
push eax
call fcn.0045d0e4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046d8b4
test bl, bl
je 0x40d3c2
push 0x5a41e0
lea ecx, [esp + 0xc]
call fcn.0046dc90
push 0x5a7d5c
lea ecx, [esp + 0xc]
call fcn.0046dc90
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40d3fe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046d8b4
jmp 0x40d4c9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40d482
lea edx, [esp + 0x7c]
push 0x5a7d58
push edx
call fcn.0045d0e4
add esp, 8
test eax, eax
je 0x40d482
lea eax, [esp + 0x7c]
push 0x5a7d54
push eax
call fcn.0045d0e4
add esp, 8
test eax, eax
je 0x40d482
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40d412
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046d8b4
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40dcc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40dd22
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40dd30
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47af8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5af140]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40de68
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40dd96
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046d8b4
xor eax, eax
jmp 0x40dedf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046da3d
push esi
lea ecx, [esp + 0xc]
call fcn.0046dccc
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40debd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocStringLen
call fcn.0040dcc0
test eax, eax
jne 0x40debd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocStringLen
mov ecx, edi
call fcn.0040dcc0
test eax, eax
jne 0x40debd
lea eax, [esp + 0x14]
push 0x5a7d70
push eax
call fcn.0045e290
mov esi, eax
add esp, 8
test esi, esi
jne 0x40de9c
lea ecx, [esp + 0x14]
push 0x5a7d6c
push ecx
call fcn.0045e210
mov esi, eax
add esp, 8
test esi, esi
jne 0x40de9c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40de9f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046d9ed
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40ddae
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046d8b4
xor eax, eax
jmp 0x40dedf
mov byte [esi], 0
push 0x5a7d68
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046d8b4
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4