joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4618d0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x49e8f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.0049526e
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00461270
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0049519c
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.00491980
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.00491980
push 1
push 0
push 0
mov ecx, esi
call fcn.00491928
push 1
push 0
push 1
mov ecx, esi
call fcn.00491928
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004952e0
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x461a50
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x49e918
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0049526e
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00461270
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0049519c
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x461b14
cmp dword [esp + 0x40], 1
jne 0x461b12
cmp ecx, eax
jge 0x461b14
mov eax, ecx
cmp eax, 0xc8
jge 0x461b20
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.004618d0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004952e0
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x462290
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x49e983
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0048fda1
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00495516
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00496a6e
test eax, eax
je 0x4623ac
mov ecx, dword [esp + 0x3c]
call fcn.00495543
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x462370
push edi
mov ecx, esi
call fcn.00492aff
mov ecx, esi
call fcn.00462510
cmp dword [esp + 0x38], 1
jne 0x4623a5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00492c69
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x464dc0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x464df3
push esi
call fcn.00467ed0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x464dec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x464e79
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x464e62
mov eax, dword [esi + 8]
test eax, eax
je 0x464e17
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x464e5e
cmp eax, 2
je 0x464e62
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x464e0a
cmp eax, 3
je 0x464e3d
cmp eax, 1
jne 0x464e0a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x464e0a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x464e0a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00464ea0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x464e88
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00464ea0
add esp, 4
pop esi
ret

Function at 0x471d00
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x471d66
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x471d66
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x471d47
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4724e0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x472518
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x473200
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x473249
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4736c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49f120
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00473270
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004732f0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004732f0
lea ecx, [esi + 0xc]
call fcn.0048e704
lea ecx, [esi + 0x10]
call fcn.0048e704
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00474880
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00474880
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00474880
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0048e779
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0048e779
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x490b96
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x490bce
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048ec20
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048ebf8
jmp 0x490bda
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x492288
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4922ca
call fcn.00498230
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4922ca
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4922c1
xor eax, eax
jmp 0x4922d2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004922d8
pop edi
pop esi
pop ebx
ret 4

Function at 0x498760
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49878e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4987ac
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004986c6
jmp 0x4987ac
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4987ac
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004986c6
test edi, edi
mov eax, edi
jne 0x498796
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x85b244
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 2], al
xchg dh, al
ror edi, 9
inc cx
push dword [esp]
lea edi, [ebx + edi]
jmp 0x85b223
shr eax, 0x19
xchg byte [esp + 1], al
lea eax, [eax + ebx]
mov ebp, 0x16bff8c2
mov word [esp + 2], sp
bswap edx
jmp 0x85b24e
bsf di, ax
lea esp, [esp + 1]
jmp 0x85b1f1
btc ecx, edi
xchg bx, ax
mov byte [esp + 3], ch
bsf dx, ax
mov byte [esp + 8], ch
lea esp, [esp + 5]
jmp 0x85b2c3
rdtsc
setbe ah
mov dx, 0x4c3b
cpuid
cmc
cmc
jmp 0x85b27c
xchg dword [esp], ecx
bswap ebp
sub esp, 0
mov cx, word [esp + 5]
neg dx
push dword [esp + 2]
jmp 0x85b294

Function at 0x85b435
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 4]
push dword [esp + 3]
pop word [esp]
mov dl, dh
push dword [esp + 4]
xchg word [esp + 4], ax
jmp 0x85b54c
lea esp, [esp + 5]
mov ax, word [esp + 4]
not ah
lea eax, reloc.KERNEL32.dll_GetFileAttributesA
jmp 0x85b412
setae ch
rdtsc
pop word [esp + 0x20]
mov dl, 0x54
pushal
pop word [esp + 0x16]
mov bx, 0xaa63
btr eax, esp
mov edx, ecx
jmp 0x85b464
push word [esp + 9]
mov ebx, ecx
mov bl, 0xc8
xchg dword [esp + 5], ebx
mov dx, word [esp]
mov bl, bh
jmp 0x85b4b4

Function at 0x85b619
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov di, 0xfcf9
xchg ch, dl
sub esp, 4
mov dword [esp], esi
btc esi, ebx
cpuid
setns ch
jmp 0x85b599
bswap ebp
lea esp, [esp + 0x1e]
rcl cx, cl
mov cl, 0xea
bswap ebp
add esp, 0
jmp 0x85b5b0
btr esi, esp
setne ch
mov esi, eax
mov bp, di
mov dl, dh
jmp 0x85b5e9

Function at 0x85be74
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, dh
mov eax, ebp
pop dword [esp]
jmp 0x85be57
Function at 0x402540
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov esi, ebx
mov dword [0x40a020], eax
mov dword [0x4090e8], edx
call fcn.00403d80
xor eax, eax
mov dword [0x40a650], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
mov byte [0x40934d], al
shr eax, 0x10
mov word [0x40934f], ax
xor eax, eax
mov ax, word [0x40934f]
and edx, 0xffff
mov dword [0x409351], eax
xor eax, eax
sar edx, 8
mov al, byte [0x40934d]
and edx, 0xff
mov dword [0x409355], eax
xor eax, eax
mov al, dl
mov byte [0x40934e], dl
mov dword [0x409359], eax
mov eax, dword [0x409355]
mov edx, dword [0x409359]
shl eax, 8
or eax, edx
mov dword [0x40935d], eax
cmp byte [0x40934d], 4
jae 0x402667
mov eax, 0x4024d8
push eax
xor edx, edx
push 0x402505
mov dword [0x409349], edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edx, eax
test eax, eax
je 0x4025fa
call edx
mov dword [0x409349], eax
push 0x104
push 0x40a024
push 0
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40a128
xor eax, eax
mov dword [0x409318], 0x40a024
call fcn.00403ec0
mov dword [0x409324], 0x40a128
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00403f60
mov edx, eax
mov bl, byte [eax]
mov dword [0x40a018], eax
cmp bl, 0x22
je 0x402671
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4034e1], 2
je 0x402689
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4034e1], 2
je 0x402690
inc eax
jmp 0x402657
mov eax, 0x4024ee
jmp 0x4025d2
inc eax
cmp bl, byte [eax]
je 0x402681
cmp byte [eax], 0
je 0x402681
inc eax
cmp byte [eax], 0x22
jne 0x402676
cmp byte [eax], 0
je 0x402657
inc eax
jmp 0x402657
test dl, dl
je 0x402657
inc eax
jmp 0x40264a
mov dword [0x409314], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
test eax, eax
je 0x402706
call fcn.00403fa0
mov edx, eax
mov bx, word [eax]
mov dword [0x40a01c], eax
cmp bx, 0x22
je 0x4026d9
xor eax, eax
mov ax, word [edx]
call fcn.00403fc7
test eax, eax
je 0x4026fb
xor eax, eax
mov ax, word [edx]
call fcn.00403fc7
test eax, eax
je 0x40270b
add edx, 2
jmp 0x4026c6
lea edx, [eax + 2]
cmp bx, word [edx]
je 0x4026f0
cmp word [edx], 0
je 0x4026f0
add edx, 2
cmp word [edx], 0x22
jne 0x4026e1
cmp word [edx], 0
je 0x4026c6
add edx, 2
jmp 0x4026c6
cmp word [edx], 0
je 0x4026c6
add edx, 2
jmp 0x4026b8
mov edx, 0x402512
mov dword [0x409320], edx
test edi, edi
jne 0x40271e
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x104
push 0x40a330
push esi
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40a434
mov eax, esi
mov dword [0x40931c], 0x40a330
call fcn.00403ec0
mov dword [0x409328], 0x40a434
mov eax, 1
pop edi
pop esi
pop ecx
ret
Function at 0x402fe0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
push ebp
sub esp, 8
mov esi, eax
mov ebp, edx
mov edi, ebx
test eax, eax
jl 0x403074
cmp eax, dword [0x409478]
jae 0x403074
call fcn.00403cb0
mov edx, eax
mov dword [esp + 4], eax
mov eax, esi
xor ebx, ebx
call fcn.00405340
test al, 0x80
je 0x403038
mov eax, esi
call dword [0x4090a0]
push 2
push 0
push 0
push edx
mov ebx, 1
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
je 0x403088
push 0
lea eax, [esp + 4]
push eax
push edi
push ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x403092
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
cmp ebx, 1
jne 0x403065
mov eax, esi
call dword [0x4090a4]
mov eax, edx
call fcn.00405100
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret
call dword [0x4090ec]
mov dword [eax + 4], 4
mov eax, 0xffffffff
jmp 0x40306c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x40305d
cmp edi, dword [esp]
je 0x4030a4
call dword [0x4090ec]
mov dword [eax + 4], 0xc
cmp ebx, 1
jne 0x4030b1
mov eax, esi
call dword [0x4090a4]
mov eax, dword [esp]
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret

Function at 0x4036d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edx
push 0x40
push 0x1000
mov edx, dword [eax]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop edx
pop ecx
ret

Function at 0x406160
Capabilities:
Terminate process

Disassembly:
push edx
push ebp
mov ebp, esp
mov eax, dword [0x409334]
add eax, 3
and al, 0xfc
mov edx, dword [0x409334]
sub esp, eax
mov eax, esp
add eax, edx
mov dword [0x409338], eax
call fcn.00406c50
mov edx, dword [0x40a668]
mov eax, dword [0x40a664]
call fcn.004018a0
jmp 0x406c52
mov ecx, eax
call dword [0x40955c]
cmp dword [0x40a020], 0
je 0x406c8f
cmp dword [0x4090dc], 0
je 0x406c7c
mov edx, 0xff
mov eax, 0x10
call dword [0x4090dc]
call dword [0x40955c]
call dword [0x409560]
mov eax, ecx
jmp fcn.00402840
mov edx, 0xff
mov eax, 0x10
call fcn.00404e30
jmp 0x406c7c
Function at 0x405aa0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46078b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00455698
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x405b22
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004535e7
mov eax, dword [eax]
push 0x63c1c0
push eax
call fcn.004464e4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00455923
test bl, bl
je 0x405b22
push 0x63c1c0
lea ecx, [esp + 0xc]
call fcn.00455cb3
push 0x63fd10
lea ecx, [esp + 0xc]
call fcn.00455cb3
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x405b5e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00455923
jmp 0x405c29
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x405be2
lea edx, [esp + 0x7c]
push 0x63fd0c
push edx
call fcn.004464e4
add esp, 8
test eax, eax
je 0x405be2
lea eax, [esp + 0x7c]
push 0x63fd08
push eax
call fcn.004464e4
add esp, 8
test eax, eax
je 0x405be2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405b72
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00455923
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x406420
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x406482
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x406490
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46080b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x6461b0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4065c8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4064f6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00455923
xor eax, eax
jmp 0x40663f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00455a60
push esi
lea ecx, [esp + 0xc]
call fcn.00455cef
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40661d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00406420
test eax, eax
jne 0x40661d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00406420
test eax, eax
jne 0x40661d
lea eax, [esp + 0x14]
push 0x63fd24
push eax
call fcn.00447520
mov esi, eax
add esp, 8
test esi, esi
jne 0x4065fc
lea ecx, [esp + 0x14]
push 0x63fd20
push ecx
call fcn.004474a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4065fc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4065ff
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00455a10
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40650e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00455923
xor eax, eax
jmp 0x40663f
mov byte [esi], 0
push 0x63fd1c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00455923
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4