joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437c30
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x464c98
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x437c69
inc eax
mov dword [esi + 0x10], eax
jmp 0x437d7c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x437c7d
mov eax, 0xffffffc7
jmp 0x437d7e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x437c8e
cmp dword [esi + 8], eax
jne 0x437c7d
cmp dword [esi + 8], eax
jne 0x437ca7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x437ca7
mov eax, 0xffffffc7
jmp 0x437d7e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x437cbb
push eax
mov ecx, ebx
call fcn.00437460
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00401060
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x437cec
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.004010b0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00436bd0
test eax, eax
mov dword [esp + 0x38], eax
je 0x437d1f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x48aae0
call fcn.00401290
mov eax, dword [esp + 0x38]
jmp 0x437d7e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00437a90
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x437d63
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00437ab0
mov esi, eax
test esi, esi
jne 0x437d93
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00437a90
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x437d35
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x48aae0
call fcn.00401290
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x48aae0
call fcn.00401290
mov eax, esi
jmp 0x437d7e
Function at 0x43b190
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43b1c3
push esi
call fcn.0043e140
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43b1bc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43b249
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43b232
mov eax, dword [esi + 8]
test eax, eax
je 0x43b1e7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43b22e
cmp eax, 2
je 0x43b232
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43b1da
cmp eax, 3
je 0x43b20d
cmp eax, 1
jne 0x43b1da
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43b1da
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43b1da
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043b270
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43b258
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043b270
add esp, 4
pop esi
ret

Function at 0x4580bb
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4580f3
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045aca1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045ac79
jmp 0x4580ff
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4597a9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4597eb
call fcn.00460d0e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4597eb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4597e2
xor eax, eax
jmp 0x4597f3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004597f9
pop edi
pop esi
pop ebx
ret 4

Function at 0x4613cc
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4613fa
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x461418
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00461332
jmp 0x461418
mov eax, dword [esi + 0x14]
test eax, eax
je 0x461418
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00461332
test edi, edi
mov eax, edi
jne 0x461402
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x414d19
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d053
xor ebx, ebx
cmp dword [0x4244a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x414dee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x414d59
xor eax, eax
jmp 0x414eb2
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x414d52
push eax
call fcn.0040cff0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4244a8], eax
call esi
push eax
call fcn.0040cff0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4244ac], eax
call esi
push eax
call fcn.0040cff0
mov dword [0x4244b0], eax
lea eax, [ebp - 8]
push eax
call fcn.0040f0e1
test eax, eax
pop ecx
pop ecx
je 0x414dbc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ce51
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x414dee
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040cff0
cmp eax, ebx
pop ecx
mov dword [0x4244b8], eax
je 0x414dee
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040cff0
pop ecx
mov dword [0x4244b4], eax
mov eax, dword [0x4244b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x414e67
cmp dword [0x4244b8], esi
je 0x414e67
push eax
call fcn.0040d05c
pop ecx
call eax
cmp eax, ebx
je 0x414e34
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4244b8]
call fcn.0040d05c
pop ecx
call eax
test eax, eax
je 0x414e34
test byte [ebp - 0x18], 1
jne 0x414e67
lea eax, [ebp - 0xc]
push eax
call fcn.0040f118
test eax, eax
pop ecx
je 0x414e4f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ce51
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x414e5e
or dword [ebp + 0x10], 0x200000
jmp 0x414e98
or dword [ebp + 0x10], 0x40000
jmp 0x414e98
mov eax, dword [0x4244ac]
cmp eax, esi
je 0x414e98
push eax
call fcn.0040d05c
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x414e98
mov eax, dword [0x4244b0]
cmp eax, esi
je 0x414e98
push dword [ebp - 4]
push eax
call fcn.0040d05c
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4244a8]
call fcn.0040d05c
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4ca24f
Capabilities:
Encode data using xor

Disassembly:
push 0x4c9fca
pop ecx
and ebx, ebx
call fcn.004ca283
sub ebx, 0x50a6cd78
xor dword [edx], ecx
and ebx, ebx
sub ebx, ebx
add edx, 1
or ebx, eax
add eax, eax
cmp edx, edi
jne fcn.004ca24f
add ebx, 1
ret
Function at 0x407a60
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x34], 0
jne 0x407b30
push ebx
push esi
push str.mapi32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push 0xc
mov dword [edi + 0x18], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x407ad0
xorps xmm0, xmm0
movq qword [ebx], xmm0
push str.MAPIFreeBuffer
mov dword [ebx + 8], 0
push dword [edi + 0x18]
call esi
push str.MAPIAllocateBuffer
push dword [edi + 0x18]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx + 8], esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx], vtable.MapiAllocator.0
mov dword [ebx + 4], eax
jmp 0x407ad2
xor ebx, ebx
push str.MAPIInitialize
push dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
call esi
push str.MAPIUninitialize
push dword [edi + 0x18]
mov dword [edi + 0x24], eax
call esi
push str.MAPILogonEx
push dword [edi + 0x18]
mov dword [edi + 0x28], eax
call esi
push str.MAPIAdminProfiles
push dword [edi + 0x18]
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x24]
pop esi
pop ebx
test eax, eax
je 0x407b30
cmp dword [edi + 0x28], 0
je 0x407b30
cmp dword [edi + 0x2c], 0
je 0x407b30
push 0
call eax
mov dword [edi + 0x14], eax
test eax, eax
js 0x407b30
mov dword [edi + 0x34], 1
pop edi
ret
Function at 0x41055a
Capabilities:
Create thread

Disassembly:
push esi
push 4
mov esi, ecx
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
xor edx, edx
pop ecx
test eax, eax
je 0x41056f
mov dword [eax], edx
jmp 0x410571
mov eax, edx
push edx
push edx
push esi
push 0x41058b
push edx
push edx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
ret

Function at 0x410a85
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x415ed0
call fcn.00410e60
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.MSVCR120.dll___crtGetShowWindowMode]
movzx ebx, ax
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, esi
mov esi, 0x4177f0
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x41091f
cmp eax, edx
jne 0x410908
xor esi, esi
inc esi
mov edi, esi
jmp 0x410922
xor esi, esi
inc esi
cmp dword [0x4177f4], esi
jne 0x410934
push 0x1f
call sub.MSVCR120.dll__amsg_exit
pop ecx
jmp 0x41096f
cmp dword [0x4177f4], 0
jne 0x410969
mov dword [0x4177f4], esi
push 0x41324c
push 0x41323c
call sub.MSVCR120.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41096f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x410a7f
mov dword [0x41739c], esi
cmp dword [0x4177f4], esi
jne 0x410992
push 0x413238
push 0x41321c
call sub.MSVCR120.dll__initterm
pop ecx
pop ecx
mov dword [0x4177f4], 2
test edi, edi
jne 0x41099f
xor eax, eax
mov ecx, 0x4177f0
xchg dword [ecx], eax
cmp dword [0x4177f8], 0
je 0x4109c3
push 0x4177f8
call main
pop ecx
test eax, eax
je 0x4109c3
push 0
push 2
push 0
call dword [0x4177f8]
mov eax, dword [sym.imp.MSVCR120.dll__wcmdln]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x20]
movzx eax, word [ecx]
cmp ax, si
ja 0x410a1c
test ax, ax
je 0x4109e4
test edx, edx
jne 0x410a1c
movzx eax, word [ecx]
test ax, ax
je 0x4109f9
cmp ax, si
ja 0x4109f9
add ecx, 2
mov dword [ebp - 0x1c], ecx
jmp 0x4109e4
push ebx
push ecx
push 0
push 0x400000
call main
mov dword [0x4173a0], eax
cmp dword [0x4173a4], 0
jne 0x410a64
push eax
call dword [sym.imp.MSVCR120.dll_exit]
cmp eax, 0x22
jne 0x410a2d
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x20], edx
add ecx, 2
mov dword [ebp - 0x1c], ecx
jmp 0x4109d3
cmp dword [0x41739c], 0
jne 0x410a78
call dword [sym.imp.MSVCR120.dll__cexit]
mov eax, dword [0x4173a0]
mov dword [ebp - 4], 0xfffffffe
call fcn.00410ea5
ret
call main
jmp 0x4108d8
Function at 0x401374
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov esi, dword [esp + 0x8c]
and esi, 0xffff0000
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x401393
add eax, dword [eax + 0x3c]
sub esi, 0x10000
cmp word [eax], 0x4550
jne 0x401387
add esi, 0x10000
push esi
mov eax, 0x403011
pop dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004012dc
mov dword [0x4030f5], eax
push 0x40300c
push 0x3e8
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x4013d7
leave
ret 8
push eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
or eax, eax
jne 0x4013e8
leave
ret 8
mov dword [ebp - 8], eax
pop eax
push eax
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x4013fc
leave
ret 8
push eax
call sub.kernel32.dll_LockResource
or eax, eax
jne 0x40140a
leave
ret 8
mov dword [ebp - 0xc], eax
push 4
push 0x3000
push dword [ebp - 8]
push 0
call sub.kernel32.dll_VirtualAlloc
or eax, eax
jne 0x401426
leave
ret 8
push eax
mov esi, dword [ebp - 0xc]
mov edi, eax
mov ecx, dword [ebp - 8]
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
push dword [esp + 0xc]
call fcn.004011cf
mov ebx, dword [esp]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
pop eax
push ebx
push 0x8000
push 0
push eax
call sub.kernel32.dll_VirtualFree
mov ebx, dword [ebp + 0xc]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
mov dword [ebp - 4], ebx
mov ebx, dword [esp]
add ebx, dword [ebp + 0xc]
and ebx, 0xffff0000
add ebx, 0x10000
push 0x40
push 0x3000
push dword [ebp - 4]
push ebx
call sub.kernel32.dll_VirtualAlloc
or eax, eax
je 0x401479
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
push eax
sub eax, dword [ebp + 0xc]
add dword [ebp + 8], eax
mov ebx, 0x4014ef
add ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov ebx, 0x401b8b
add ebx, dword [ebp + 8]
sub ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x14]
push ebx
push 0x40119a
push dword [ebp + 0xc]
call fcn.00401168
pop eax
pop ebx
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
add dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov eax, 0x40175a
add eax, dword [ebp + 8]
call eax
leave
ret 8

Function at 0x432003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4028a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4028b1
pop dword [ebp - 0x2c]
mov eax, 0x4028b1
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xa0c3d403
sub dword [ebp - 0x3c], 0x52718eb8
mov dword [ebp - 0x38], 0x648ac6a6
sub dword [ebp - 0x38], 0x32577a61
mov dword [ebp - 0x34], 0x2c834116
add dword [ebp - 0x34], 0x1fc90318
mov dword [ebp - 0x30], 0xcbd0ac7c
sub dword [ebp - 0x30], 0xcbd0ac7c
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x32119ea
add eax, 0xfd1f5632
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xf841a175
sub dword [ebp - 0x3c], 0x83cf381f
mov dword [ebp - 0x38], 0x278192c0
add dword [ebp - 0x38], 0x19eaceb5
mov dword [ebp - 0x34], 0x6cb982ed
sub dword [ebp - 0x34], 0x94a1681
mov dword [ebp - 0x30], 0x59e36d8
add dword [ebp - 0x30], 0xfa61c928
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x906144e1
add eax, 0x6fdf2b3f
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x38ef8
push 0
call eax
mov ecx, 0xdb5c19ec
add ecx, 0x24a432f5
mov esi, eax
mov edx, 0x40c800
add edx, dword [ebp - 0x2c]
mov ebx, 0xa8eddd85
sub ebx, 0xcab66528
mov edi, dword [edx]
add edi, ebx
xor dword [ebp - 0x28], 0xacee791c
mov dword [esi], edi
xor dword [ebp - 0x24], 0x63c31632
add esi, 0x19f6a227
sub esi, 0x19f6a223
add edx, 0xce0ba68a
add edx, 0x31f4597a
loop 0x4029c8
add eax, 0x12657
mov ebx, eax
add eax, 0x38fe0d21
sub eax, 0x38fe0d1c
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004028a2
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004028a2
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x408c20
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x481c5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00474467
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x408ca2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00471bbd
mov eax, dword [eax]
push 0x4d0200
push eax
call fcn.00463f24
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004746f2
test bl, bl
je 0x408ca2
push 0x4d0200
lea ecx, [esp + 0xc]
call fcn.00474ace
push 0x4d3d74
lea ecx, [esp + 0xc]
call fcn.00474ace
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x408cde
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004746f2
jmp 0x408da9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x408d62
lea edx, [esp + 0x7c]
push 0x4d3d70
push edx
call fcn.00463f24
add esp, 8
test eax, eax
je 0x408d62
lea eax, [esp + 0x7c]
push 0x4d3d6c
push eax
call fcn.00463f24
add esp, 8
test eax, eax
je 0x408d62
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408cf2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004746f2
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4095a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x409602
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x409610
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x481cdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4e0a88]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x409748
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x409676
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004746f2
xor eax, eax
jmp 0x4097bf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0047487b
push esi
lea ecx, [esp + 0xc]
call fcn.00474b0a
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40979d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocStringLen
call fcn.004095a0
test eax, eax
jne 0x40979d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocStringLen
mov ecx, edi
call fcn.004095a0
test eax, eax
jne 0x40979d
lea eax, [esp + 0x14]
push 0x4d3d88
push eax
call fcn.00465000
mov esi, eax
add esp, 8
test esi, esi
jne 0x40977c
lea ecx, [esp + 0x14]
push 0x4d3d84
push ecx
call fcn.00464f80
mov esi, eax
add esp, 8
test esi, esi
jne 0x40977c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40977f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047482b
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40968e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004746f2
xor eax, eax
jmp 0x4097bf
mov byte [esi], 0
push 0x4d3d80
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004746f2
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4