joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c03
Capabilities:
Read .ini file

Disassembly:
jmp 0x41f870
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x577388
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov esi, ecx
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov eax, dword [eax + 0x94]
push eax
push 1
push str.HotkeyMode
push str.Setup
call ebp
cmp eax, 0xffffffff
jle 0x41f8b8
cmp eax, 5
jl 0x41f8bd
mov eax, 1
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
push eax
push ecx
mov ecx, edi
call fcn.004487c0
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
push str.plugin
push 0x622ea8
push edx
call sub.MFC42.DLL_operator_4
mov dword [esp + 0x1c], 0xffffffff
call fcn.00401212
mov ecx, eax
call fcn.004021f3
push edi
mov ecx, esi
call fcn.00401415
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x20]
and ecx, 0xffff
mov eax, dword [eax + 0x94]
push eax
push ecx
push str.EndHotkey
push 0x61049c
call ebp
mov ebx, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x20]
shr ecx, 0x10
mov edx, dword [eax + 0x94]
push edx
push ecx
push str.EndHotkeyMod
push 0x61049c
call ebp
mov ecx, eax
mov edx, ebx
and ecx, 0xffff
and edx, 0xffff
shl ecx, 0x10
or ecx, edx
mov edx, dword [esp + 0x28]
push eax
push ebx
mov dword [edx], ecx
call fcn.00448970
push edi
call fcn.004489b0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc

Function at 0x401c3a
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x408b50
push 0xffffffffffffffff
push 0x575c43
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x58c684
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.0043b8fa
mov dword [ebx], 0x58c66c
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.0043b8fa
or eax, 0xffffffff
push 0x621e08
mov dword [ebx], 0x58c624
push edi
mov dword [esi], 0x58c63c
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x401c44
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x41d980
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41d9e2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x401e74
Capabilities:
Delete file

Disassembly:
jmp 0x420d90
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi + 0xc]
test eax, eax
jle 0x420dce
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ebx, [edi + 4]
lea eax, [esp + 0x10]
push esi
push eax
mov ecx, ebx
call fcn.0040114f
mov ecx, dword [eax]
push ecx
call ebp
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, dword [edi + 0xc]
inc esi
cmp esi, eax
jl 0x420da9
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x401ee2
Capabilities:
Set current directory

Disassembly:
jmp 0x42a140
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x57886b
push eax
mov eax, 0x1704
mov dword fs:[0], esp
call fcn.0043c040
push esi
mov esi, ecx
lea eax, [esp + 0x208]
lea ecx, [esp + 0x108]
push eax
lea edx, [esp + 0x30c]
push ecx
mov ecx, dword [esi + 0x90]
lea eax, [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__splitpath]
add esp, 0x14
lea edx, [esp + 0x108]
mov ecx, 0x622ea4
push edx
call sub.MFC42.DLL_CString::operator
lea eax, [esp + 8]
mov ecx, 0x622ea8
push eax
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x308]
push ecx
mov ecx, 0x622ea8
call fcn.0043baec
mov edx, dword [0x622ea8]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x622ea8
mov ecx, 0x622ea8
call sub.MFC42.DLL_CString::operator_1
lea eax, [esp + 0x708]
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov cl, byte [0x6232f8]
mov al, 1
test al, cl
jne 0x42a226
or cl, al
mov byte [0x6232f8], cl
lea ecx, [esp + 0x708]
push ecx
mov ecx, 0x6232f4
call sub.MFC42.DLL_CString::CString_1
push 0x42a320
call fcn.0043c02e
add esp, 4
push 0x2e
mov ecx, 0x6232f4
call sub.MFC42.DLL_CString::ReverseFind
lea edx, [esp + 4]
push eax
push edx
mov ecx, 0x6232f4
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, 0x6232f4
mov dword [esp + 0x1714], 0
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 4]
mov dword [esp + 0x1710], 0xffffffff
call sub.MFC42.DLL_CString::CString
push str..ini
mov ecx, 0x6232f4
call fcn.0043baec
mov eax, dword [esi + 0x94]
push eax
call dword [sym.imp.MSVCRT.dll_free]
mov ecx, dword [0x6232f4]
push ecx
call dword [sym.imp.MSVCRT.dll__strdup]
add esp, 8
mov ecx, 0x6233d4
mov dword [esi + 0x94], eax
push eax
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 0x1708]
pop esi
mov dword fs:[0], ecx
add esp, 0x1710
ret
Function at 0x401fc3
Capabilities:
Create process on windows

Disassembly:
jmp 0x41dc90
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push str.open
mov edi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41dd84
lea ecx, [esp + 0x10]
push ecx
push str..htm
push closesocket
mov ecx, edi
call fcn.00401c44
test eax, eax
jne 0x41dd84
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push closesocket
mov ecx, edi
call fcn.00401c44
test eax, eax
jne 0x41dd84
lea edx, [esp + 0x10]
push str.__1_
push edx
call dword [sym.imp.MSVCRT.dll__mbsstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x41dd55
lea eax, [esp + 0x10]
push 0x610274
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x41dd55
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x41dd58
mov byte [esi], 0
push 0x60fa44
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8

Function at 0x402004
Capabilities:
Set socket configuration

Disassembly:
jmp 0x419460
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push 4
push eax
push 4
push 0xffff
push ecx
mov dword [esp + 0x14], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x41949b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00401e29
add esp, 4
or eax, 0xffffffff
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x402009
Capabilities:
Create thread
Resolve dns

Disassembly:
jmp 0x419d10
sub esp, 0x9c
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_inet_addr]
push esi
push edi
mov edi, dword [esp + 0xac]
push edi
call ebx
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x419dd4
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x419dab
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x419dab
cmp dword [esp + 0x24], 2
jne 0x419dab
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push 0
push edi
push 0x4012da
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x419dab
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x419dab
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x9c
ret
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x419dc3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x9c
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call ebx
pop edi
pop esi
pop ebx
add esp, 0x9c
ret
Function at 0x4020cc
Capabilities:
Delete file
Encode data using xor
Read file on windows
Set file attributes

Disassembly:
jmp 0x420c70
push 0xffffffffffffffff
push 0x577598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov eax, dword [esp + 0x1c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x20]
lea eax, [esp + 8]
push edx
push 4
xor esi, esi
push 1
push eax
mov dword [esp + 0x18], esi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x18]
add esp, 0x10
cmp eax, esi
jle 0x420d20
mov ecx, dword [esp + 0x1c]
push 0x61062c
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
cmp edi, esi
je 0x420d20
cmp dword [esp + 8], esi
jle 0x420d16
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fputc]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fgetc]
mov edx, dword [esp + 0x28]
push edi
push edx
call ebp
add esp, 4
xor eax, 0xcc
push eax
call ebx
mov eax, dword [esp + 0x18]
add esp, 8
inc esi
cmp esi, eax
jl 0x420cf5
pop ebp
pop ebx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4020ea
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x419620
sub esp, 0x10
mov edx, dword [esp + 0x1c]
xor ecx, ecx
xor eax, eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], edx
push eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push eax
lea edx, [esp + 0xc]
lea eax, [esp + 8]
mov dword [esp + 0x14], ecx
push edx
mov edx, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push 1
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x419671
mov eax, dword [esp]
add esp, 0x10
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
neg eax
add esp, 0x10
ret

Function at 0x40211c
Capabilities:
Get common file path

Disassembly:
jmp 0x427c60
mov eax, 0x1004
call fcn.0043c040
mov cl, byte [0x623268]
mov al, 1
test al, cl
mov dword [esp], 0
jne 0x427c9f
mov dl, cl
mov ecx, 0x623264
or dl, al
mov byte [0x623268], dl
call sub.MFC42.DLL_CString::CString_3
push 0x427d30
call fcn.0043c02e
add esp, 4
mov eax, dword [0x623264]
push 0x621dc4
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x427cd6
lea ecx, [esp + 4]
push ecx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 4]
mov ecx, 0x623264
push edx
call sub.MFC42.DLL_CString::operator
push esi
mov esi, dword [esp + 0x100c]
push 0x623264
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop esi
add esp, 0x1004
ret
Function at 0x402180
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x4198c0
sub esp, 0xc
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 4], ecx
push eax
push eax
mov dword [esp + 0x10], eax
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push 1
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jne 0x41990b
mov eax, dword [esp]
add esp, 0xc
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
neg eax
add esp, 0xc
ret

Function at 0x4021ad
Capabilities:
Get common file path

Disassembly:
jmp 0x427d50
mov eax, 0x1004
call fcn.0043c040
mov cl, byte [0x623260]
mov al, 1
test al, cl
mov dword [esp], 0
jne 0x427d8f
mov dl, cl
mov ecx, 0x62325c
or dl, al
mov byte [0x623260], dl
call sub.MFC42.DLL_CString::CString_3
push 0x427e60
call fcn.0043c02e
add esp, 4
mov eax, dword [0x62325c]
push esi
push 0x621dc4
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x427df9
push ebx
push edi
lea ecx, [esp + 0x10]
push 0x1000
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x60f838
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x62325c
call sub.MFC42.DLL_CString::operator
pop edi
pop ebx
mov esi, dword [esp + 0x100c]
push 0x62325c
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop esi
add esp, 0x1004
ret
Function at 0x4021b2
Capabilities:
Delete file

Disassembly:
jmp 0x422390
push 0xffffffffffffffff
push 0x577992
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [edi], 0x58d210
mov dword [esp + 0x20], 9
call fcn.00450f30
lea esi, [edi + 0xa4]
mov dword [esp + 0x14], esi
mov dword [esi], 0x58d1f8
mov ebp, dword [esi + 4]
xor ebx, ebx
cmp ebp, ebx
mov byte [esp + 0x20], 0xa
je 0x4223f5
lea eax, [ebp + 8]
push 1
push eax
call fcn.00401fa0
mov ebp, dword [ebp]
cmp ebp, ebx
jne 0x4223e3
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
call sub.MFC42.DLL_CPlex::FreeDataChain
lea ecx, [edi + 0xa0]
mov dword [esi + 0x14], ebx
mov dword [esi], 0x58c2c0
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CString::CString
mov esi, dword [edi + 0x98]
cmp esi, ebx
je 0x42247f
lea ecx, [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x422479
cmp esi, ebx
mov dword [esp + 0x14], esi
je 0x422479
mov ecx, esi
mov byte [esp + 0x20], 0xc
call fcn.004014e2
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esi + 4]
mov byte [esp + 0x20], 0xb
call sub.MFC42.DLL_CFile::CFile
mov ecx, esi
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CString::CString
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [edi + 0x98], ebx
lea esi, [edi + 0x8c]
mov dword [esp + 0x14], esi
lea ecx, [esi + 8]
mov byte [esp + 0x20], 0xd
call sub.MFC42.DLL_CString::CString
cmp esi, ebx
je 0x42249f
lea ebp, [esi + 4]
jmp 0x4224a1
xor ebp, ebp
mov esi, dword [ebp]
cmp esi, ebx
je 0x4224f8
lea edx, [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4224f5
cmp esi, ebx
mov dword [esp + 0x14], esi
je 0x4224f5
mov ecx, esi
mov byte [esp + 0x20], 0xf
call fcn.004014e2
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esi + 4]
mov byte [esp + 0x20], 0xe
call sub.MFC42.DLL_CFile::CFile
mov ecx, esi
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CString::CString
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebp], ebx
lea esi, [edi + 0x48]
mov dword [esp + 0x14], esi
mov dword [esi], 0x58d170
mov ecx, esi
mov byte [esp + 0x20], 0x11
call fcn.0044e980
lea ecx, [esi + 0x28]
mov byte [esp + 0x20], 0x10
call fcn.0043bc6c
mov ecx, esi
mov byte [esp + 0x20], 4
call fcn.0043bd0e
lea ecx, [edi + 0x44]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x10]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 8]
mov byte [esp + 0x20], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 4]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x406db6
Capabilities:
Create process on windows

Disassembly:
jmp 0x406da0
push 0xffffffffffffffff
push 0x575a68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
mov esi, dword [esi + 0x18c]
mov dword [esp + 0x10], 0
test esi, esi
je 0x406e09
push edi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [esi + 8]
lea ecx, [esp + 8]
push eax
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 8]
mov esi, dword [esi]
push 5
push 0x621dc4
push 0x621dc4
push ecx
push str.open
push 0
call edi
test esi, esi
jne 0x406ddb
pop edi
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x42dd88
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x42dd70
push 0xffffffffffffffff
push 0x578c70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x14], 1
test eax, eax
jl 0x42ddc5
push eax
lea eax, [esp + 8]
push str.__._df
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 4]
push ecx
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
add esp, 0x10
push edx
push eax
push ecx
mov ecx, esi
call fcn.00401faa
lea ecx, [esp + 4]
mov esi, eax
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14

Function at 0x43b44d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43b4a5
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x621dc4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43b498
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x43b4a7
xor eax, eax
pop esi
leave
ret 4
Function at 0x441d20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57968f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [esp + 0x38]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00441b10
lea ecx, [esp + 8]
mov dword [esp + 0x30], 1
call fcn.00441bf0
mov esi, dword [esp + 0x38]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 4], 1
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call fcn.00441b90
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x445010
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x579f88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov eax, dword [esp + 0x1c]
push 0x60f9b4
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x445065
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push esi
call ebp
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0x10
cmp eax, 0x1000
jg 0x4450a7
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push edi
push 0
push 0x1000
push esi
call ebp
mov al, byte [esi + 0xc]
add esp, 0xc
xor edi, edi
test al, 0x10
jne 0x4450d7
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fgetc]
push esi
call ebx
not eax
add edi, eax
mov al, byte [esi + 0xc]
add esp, 4
test al, 0x10
je 0x4450c5
pop ebx
push 0
push 0x1c
push esi
call ebp
push esi
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x2c]
add esp, 0x20
xor edx, edx
cmp eax, edi
sete dl
lea ecx, [esp + 0x20]
mov esi, edx
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x445820
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x57a018
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esi + 8]
mov eax, edi
xor edx, edx
shr eax, 4
div ebp
mov ecx, dword [esi + 4]
mov dword [esp + 0x18], 0
test ecx, ecx
mov ebx, edx
je 0x44587a
mov eax, dword [ecx + ebx*4]
test eax, eax
je 0x445876
cmp dword [eax + 8], edi
je 0x445870
mov eax, dword [eax]
test eax, eax
jne 0x445863
jmp 0x445876
test eax, eax
mov edi, eax
jne 0x4458c7
test ecx, ecx
jne 0x4458a6
lea edi, [ebp*4]
push edi
call sub.MFC42.DLL_operatornew
mov edx, eax
mov ecx, edi
mov dword [esi + 4], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov dword [esi + 8], ebp
mov ecx, esi
call fcn.00445fe0
mov edi, eax
mov eax, dword [esp + 0x20]
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
mov ecx, dword [esi + 4]
mov edx, dword [ecx + ebx*4]
mov dword [edi], edx
mov eax, dword [esi + 4]
mov dword [eax + ebx*4], edi
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x2c]
mov dword [edi + 0xc], ecx
mov edx, dword [esp + 0x28]
push eax
lea ecx, [edi + 0x14]
mov dword [edi + 0x10], edx
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x30]
push ecx
lea ecx, [edi + 0x18]
call sub.MFC42.DLL_CString::operator_1
lea edx, [esp + 0x34]
lea ecx, [edi + 0x1c]
push edx
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x18