joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417e1d
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x43e7b8
call fcn.0041e498
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.004016a6
mov ecx, eax
call fcn.00401702
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.m_strCiZu1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
call esi
mov dword [ebp - 0x10], ebx
lea ebx, [edi + 0x274]
mov ecx, ebx
call fcn.0041866f
test eax, eax
jbe 0x417ea6
push str.m_strCiZu2
call esi
push 2
mov ecx, ebx
push dword [ebp - 0x10]
call fcn.00418682
mov ecx, eax
call fcn.00401751
push eax
lea ecx, [ebp + 8]
call fcn.00401751
push eax
call fcn.0041f740
add esp, 0xc
test eax, eax
je 0x417f08
inc dword [ebp - 0x10]
mov ecx, ebx
call fcn.0041866f
cmp dword [ebp - 0x10], eax
jb 0x417e67
push str._find
call esi
push 0x4568c8
lea ecx, [edi + 0x26c]
call fcn.004360b2
cmp dword [0x456248], 0
je 0x417ee1
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x450c28
call fcn.00435fe3
mov ecx, dword [0x456248]
call fcn.00407eb5
push str._find2
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00435f75
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
push str.m_strCiZu3
call esi
mov eax, dword [ebp - 0x18]
lea ebx, [edi + 0x284]
push 0
mov dword [ebp - 0x14], 1
cmp dword [eax + 0x3b0], 0
push dword [ebp - 0x10]
mov ecx, ebx
je 0x417f44
call fcn.00418682
mov ecx, eax
call fcn.00436211
push eax
call fcn.00415657
pop ecx
jmp 0x417f5e
call fcn.00418682
mov ecx, eax
call fcn.00436211
mov ecx, eax
call fcn.004156d7
push str.m_strCiZu4
call esi
cmp dword [0x456248], 0
je 0x417f88
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.00418682
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.00435cea
mov ecx, dword [0x456248]
call fcn.00407eb5
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.00418682
push eax
lea ecx, [edi + 0x26c]
call fcn.00436062
push str.m_strCiZu
jmp 0x417ee6
Function at 0x4196c3
Capabilities:
Create thread

Disassembly:
mov eax, 0x43e858
call fcn.0041e498
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004189a6
mov ecx, 0xfa
xor eax, eax
lea edi, [esi + 0x46d]
mov dword [esi], method.CWnd.virtual_0
rep stosd dword es:[edi], eax
xor ebx, ebx
push str.padcom.dll
mov dword [ebp - 4], ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetAyscEvent
push eax
mov dword [0x456924], eax
call edi
push str.IsDriverWork
mov dword [0x456940], eax
push dword [0x456924]
call edi
push str.Connect_Driver
mov dword [0x45692c], eax
push dword [0x456924]
call edi
push str.GetDeviceType
mov dword [0x456920], eax
push dword [0x456924]
call edi
mov dword [0x456928], eax
call dword [0x45692c]
test al, al
jne 0x41976f
call dword [0x456920]
test al, al
je 0x41976f
call dword [0x456928]
mov dword [0x45691c], eax
push ebx
push ebx
push 1
mov byte [0x456938], 1
pop edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x45693c], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 0x4192a3
push 0x1000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [0x45693c]
mov dword [0x456934], eax
call dword [0x456940]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x7c], eax
mov dword [esi + 0xc40], edi
mov dword [esi + 0x74], 0xff0000
mov dword [esi + 0x78], 0xffffff
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4019a0
Capabilities:
Create process on windows
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40a5b8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
call fcn.004039b0
mov ecx, dword [esi + 0x18c]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
sub edx, ecx
push 0xffffffffffffffff
sub edx, 0xa0
xor ebx, ebx
push edx
lea edi, [esi + 0x16c]
push ebx
push 0x40d0dc
push ebx
mov ecx, edi
call sub.MFC42.DLL_CListCtrl::InsertColumn
push 0xffffffffffffffff
push 0x3c
push 1
push 0x40d0d4
push 1
mov ecx, edi
call sub.MFC42.DLL_CListCtrl::InsertColumn
push 0xffffffffffffffff
push 0x50
push ebx
push 0x40d0cc
push 2
mov ecx, edi
call sub.MFC42.DLL_CListCtrl::InsertColumn
mov ecx, dword [esi + 0x1b0]
cmp ecx, ebx
je 0x401a4a
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 0x1b0]
cmp ecx, ebx
je 0x401a44
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov dword [esi + 0x1b0], ebx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFile::CFile
push ebx
mov ecx, esi
mov dword [esp + 0x40], ebx
call sub.MFC42.DLL_CWnd::UpdateData
mov ecx, dword [esi + 0x1c8]
cmp ecx, ebx
je 0x401a70
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, esi
call fcn.00403dc0
test eax, eax
jne 0x401ab9
push str.C:Program_Filescleardiskcleardisk.exe
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [esp + 0xc]
push 5
push ecx
mov byte [esp + 0x44], 1
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, esi
call fcn.00404200
cmp dword [esi + 0x60], 1
jne 0x401aaf
mov ecx, esi
call fcn.00404d50
mov byte [esp + 0x3c], bl
lea ecx, [esp + 0xc]
jmp 0x401b0e
mov ecx, esi
call fcn.00401b40
push str.C:Program_Filescleardisk_version.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:Program_Filescleardiskcleardisk.exe
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esp + 0x10]
push 5
push edx
mov byte [esp + 0x44], 2
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, esi
call fcn.00403360
mov ecx, esi
call fcn.00404200
cmp dword [esi + 0x60], 1
jne 0x401b06
mov ecx, esi
call fcn.00404d50
mov byte [esp + 0x3c], bl
lea ecx, [esp + 0x10]
call fcn.00409d12
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00409eaa
mov ecx, dword [esp + 0x34]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x4037f0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xffffffffffffffff
push 0x40a926
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push esi
lea eax, [esp + 0x248]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x240], 3
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 4]
mov byte [esp + 0x23c], 4
push ecx
push 0x40bbd0
push 1
push 0
push 0x40bbc0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x403932
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x244]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x24c]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x250]
push 0
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x44]
mov eax, dword [esp + 4]
lea ecx, [esp + 0xc]
push ecx
push 0x40bbe0
mov edx, dword [eax]
push eax
call dword [edx]
mov esi, eax
test esi, esi
jl 0x403928
push str..lnk
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 8]
lea edx, [esp + 0x2c]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 8]
push 0
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x244], 5
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x403909
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x2c]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
test esi, esi
je 0x403917
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
lea ecx, [esp + 0x10]
mov byte [esp + 0x23c], 4
call fcn.00409e68
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [esp + 8]
mov byte [esp + 0x23c], 3
call fcn.00409d12
lea ecx, [esp + 0x244]
mov byte [esp + 0x23c], 2
call fcn.00409d12
lea ecx, [esp + 0x248]
mov byte [esp + 0x23c], 1
call fcn.00409d12
lea ecx, [esp + 0x24c]
mov byte [esp + 0x23c], 0
call fcn.00409d12
lea ecx, [esp + 0x250]
mov dword [esp + 0x23c], 0xffffffff
call fcn.00409d12
mov ecx, dword [esp + 0x234]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x23c
ret 0x10
Function at 0x4039b0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x10c
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov dword [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallClearDisk_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x403ab9
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallClearDisk
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, 0x40d26c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x18]
push ecx
push 1
push eax
push str.DisplayName
push edx
call ebp
mov edi, str.C:Program_FilescleardiskCDUnInstall.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x18]
push ecx
push 1
push eax
push str.UninstallString
push edx
call ebp
lea eax, [esp + 0xc]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x403b19
mov edi, str.C:Program_FilescleardiskCDInit.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x18]
push ecx
push 1
push eax
push str.CDInit
push edx
call ebp
pop edi
pop esi
pop ebp
add esp, 0x10c
ret
Function at 0x404030
Capabilities:
Create shortcut via ishelllink
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x40a9b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push esi
lea eax, [esp + 0x248]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x240], 3
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 8]
mov byte [esp + 0x23c], 4
push ecx
push 0x40bbd0
push 1
push 0
push 0x40bbc0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x40417d
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x244]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x24c]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x250]
push 0
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x44]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x40bbe0
mov edx, dword [eax]
push eax
call dword [edx]
mov esi, eax
test esi, esi
jl 0x404173
push str..lnk
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 4]
lea edx, [esp + 0x2c]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 4]
push 0
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x244], 5
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x404149
lea ecx, [esp + 0x10]
mov byte [esp + 0x23c], 4
call fcn.00409e68
jmp 0x40417d
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
je 0x404162
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [esp + 0x10]
mov byte [esp + 0x23c], 4
call fcn.00409e68
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
lea ecx, [esp + 4]
mov byte [esp + 0x23c], 3
call fcn.00409d12
lea ecx, [esp + 0x244]
mov byte [esp + 0x23c], 2
call fcn.00409d12
lea ecx, [esp + 0x248]
mov byte [esp + 0x23c], 1
call fcn.00409d12
lea ecx, [esp + 0x24c]
mov byte [esp + 0x23c], 0
call fcn.00409d12
lea ecx, [esp + 0x250]
mov dword [esp + 0x23c], 0xffffffff
call fcn.00409d12
mov ecx, dword [esp + 0x234]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x23c
ret 0x10
Function at 0x404d50
Capabilities:
Create directory
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x40ab36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdc
push ebp
mov ebp, ecx
push str.C:Program_FilesMuFreeMUFree.exe
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
push str.C:Program_FilesMuFree_
lea ecx, [ebp + 0xd4]
mov dword [esp + 0xec], 0
call fcn.00409e80
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [esp + 4]
push 0
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0xf0], 1
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x404eb8
mov ecx, dword [str.update1.mufree.com]
mov eax, dword [0x40d5d8]
mov edx, dword [0x40d5d4]
mov dword [esp + 0xc], ecx
mov ecx, dword [0x40d5dc]
mov dword [esp + 0x14], eax
mov al, byte [0x40d5e2]
push esi
mov dword [esp + 0x14], edx
mov dx, word [0x40d5e0]
push edi
mov dword [esp + 0x20], ecx
mov byte [esp + 0x26], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x27]
mov word [esp + 0x24], dx
mov esi, str.http:__update1.mufree.com_cleardisk_MUFreeInstallX.exe
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xd
lea edi, [esp + 0x98]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 6
xor eax, eax
lea edi, [esp + 0xcf]
mov esi, str.C:Program_FilesMuFreeMUFreeInstallX.exe
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0xa
lea edi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x8f], ecx
mov word [esp + 0x93], cx
mov byte [esp + 0x95], cl
mov ecx, ebp
call fcn.00404ce0
pop edi
pop esi
test eax, eax
jne 0x404eb8
push str.C:Program_FilesMuFree
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
lea edx, [esp + 0x5c]
lea eax, [esp + 0x90]
lea ecx, [esp + 0xc]
push edx
push eax
push ecx
mov ecx, ebp
call fcn.00403b30
push str.C:Program_FilesMuFreeMUFreeInstallX.exe
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esp + 8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 8]
call fcn.00409d12
lea ecx, [esp + 0x40]
mov byte [esp + 0xe8], 0
call fcn.00409e68
lea ecx, [esp + 4]
mov dword [esp + 0xe8], 0xffffffff
call fcn.00409d12
mov ecx, dword [esp + 0xe0]
pop ebp
mov dword fs:[0], ecx
add esp, 0xe8
ret
Function at 0x41f2a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49cffb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004912fa
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41f322
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048ee9b
mov eax, dword [eax]
push 0x54ed14
push eax
call fcn.00481154
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00491585
test bl, bl
je 0x41f322
push 0x54ed14
lea ecx, [esp + 0xc]
call fcn.00491915
push 0x54ed20
lea ecx, [esp + 0xc]
call fcn.00491915
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41f35e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00491585
jmp 0x41f429
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41f3e2
lea edx, [esp + 0x7c]
push 0x54ed1c
push edx
call fcn.00481154
add esp, 8
test eax, eax
je 0x41f3e2
lea eax, [esp + 0x7c]
push 0x54ed18
push eax
call fcn.00481154
add esp, 8
test eax, eax
je 0x41f3e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41f372
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00491585
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41fc50
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41fcb2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x41fcc0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49d07b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x558858]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x41fdf8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x41fd26
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00491585
xor eax, eax
jmp 0x41fe6f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004916c2
push esi
lea ecx, [esp + 0xc]
call fcn.00491951
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41fe4d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0041fc50
test eax, eax
jne 0x41fe4d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0041fc50
test eax, eax
jne 0x41fe4d
lea eax, [esp + 0x14]
push 0x54ed30
push eax
call fcn.004821d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41fe2c
lea ecx, [esp + 0x14]
push 0x54ed2c
push ecx
call fcn.00482150
mov esi, eax
add esp, 8
test esi, esi
jne 0x41fe2c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41fe2f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00491672
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41fd3e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00491585
xor eax, eax
jmp 0x41fe6f
mov byte [esi], 0
push 0x54ed28
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00491585
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x424b2a
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x49d6c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00492b34
xor ebp, ebp
mov dword [esi], 0x537970
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x40], ebp
lea edi, [esi + 0x44]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x14], edi
lea ecx, [edi + 0x18]
mov dword [edi], 0x53715c
call fcn.00418310
lea ecx, [edi + 0x30]
mov byte [esp + 0x38], 1
call fcn.00490780
lea ebx, [edi + 0x44]
mov ecx, ebx
call fcn.00418310
mov dword [ebx], 0x5376ec
mov dword [edi], 0x537888
mov dword [esi + 0xa0], ebp
mov dword [esi + 0x9c], 0x5372e8
lea ecx, [esi + 0xb0]
call fcn.00418310
lea edi, [esi + 0xc8]
mov dword [edi + 4], ebp
mov dword [edi], 0x537964
mov byte [esp + 0x38], 5
mov dword [esi], 0x537890
mov dword [esi + 0xac], ebp
call fcn.0049b1d5
mov eax, dword [eax + 0xc]
push 0x40e
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
mov ecx, edi
call fcn.004981cc
mov ecx, dword [esi + 0xcc]
lea eax, [esp + 0x18]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [esp + 0x1c]
mov eax, 0x55555556
imul ecx
mov ecx, dword [esp + 0x20]
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esi + 0xd4], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0xd0], edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x424cc0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x49d755
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x537890
mov dword [esp + 0x18], 0
lea ecx, [esi + 0xc8]
mov dword [esp + 0xc], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x18], 4
call fcn.00498223
lea ecx, [esi + 0xb0]
mov byte [esp + 0x18], 2
mov dword [ecx], 0x537150
call fcn.00418510
lea ecx, [esi + 0x9c]
mov dword [esp + 0xc], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x18], 5
call fcn.00498223
lea edi, [esi + 0x44]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x44]
mov byte [esp + 0x18], 7
mov dword [ecx], 0x537150
call fcn.00418510
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 6
call fcn.004907b3
lea ecx, [edi + 0x18]
mov byte [esp + 0x18], 0
mov dword [ecx], 0x537150
call fcn.00418510
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.0049961f
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret