joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c04f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov dword [ebp + 8], eax
mov ebx, dword [esi + 4]
bswap ebx
mov edi, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [edi + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x43c06c
mov edi, dword [ebp + 8]
xor edx, edx
lea esi, [edx + 0x10]
mov ecx, ebx
lea edx, [edx - 0x61c88647]
shr ecx, 5
mov eax, ebx
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add ebx, ecx
sub esi, 1
jne 0x43c083
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43caa4
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov edi, eax
mov eax, dword [esi + 4]
bswap eax
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp + 8], eax
mov eax, dword [ebx + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x43cac3
mov ebx, dword [ebp + 8]
mov edx, 0xe3779b90
mov esi, 0x10
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shr ecx, 5
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
lea edx, [edx + 0x61c88647]
sub edi, ecx
sub esi, 1
jne 0x43cadf
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45cd83
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x14
mov eax, dword [edx]
push ebx
mov dword [esp + 0x14], ecx
mov ebx, 0x10
mov ecx, dword [esp + 0x1c]
push ebp
push esi
mov esi, dword [edx + 4]
mov edx, dword [ecx + 4]
mov dword [esp + 0xc], edx
mov edx, dword [ecx]
mov ebp, dword [esp + 0xc]
mov dword [esp + 0x10], edx
mov edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
push edi
bswap esi
bswap eax
mov edi, 0x9e3779b9
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov edx, esi
mov ecx, esi
shr edx, 5
shl ecx, 4
add edx, ebp
add ecx, dword [esp + 0x14]
xor edx, ecx
lea ecx, [esi + edi]
xor edx, ecx
add eax, edx
mov edx, eax
mov ecx, eax
shl edx, 4
add edx, dword [esp + 0x18]
shr ecx, 5
add ecx, dword [esp + 0x1c]
xor edx, ecx
lea ecx, [eax + edi]
xor edx, ecx
lea edi, [edi - 0x61c88647]
add esi, edx
dec ebx
jne 0x45cdc4
mov ebp, dword [esp + 0x20]
bswap esi
pop edi
bswap eax
mov dword [ebp + 4], esi
mov dword [ebp], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x4621cd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov dword [ebp + 8], eax
mov ebx, dword [esi + 4]
bswap ebx
mov edi, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [edi + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x4621ea
mov edi, dword [ebp + 8]
xor edx, edx
lea esi, [edx + 0x20]
mov ecx, ebx
lea edx, [edx + 0x57e89147]
shr ecx, 5
mov eax, ebx
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add ebx, ecx
sub esi, 1
jne 0x462201
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x474133
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x8000
jg 0x47424d
je 0x474244
cmp eax, 0x80
jg 0x4741ca
je 0x4741c1
cmp eax, 8
jg 0x474193
je 0x47418a
cmp eax, 0x80000000
je 0x474181
cmp eax, 2
je 0x474178
cmp eax, 4
jne 0x474330
mov eax, 2
pop ebp
ret 4
mov eax, 1
pop ebp
ret 4
mov eax, 0x1f
pop ebp
ret 4
mov eax, 3
pop ebp
ret 4
cmp eax, 0x10
je 0x4741b8
cmp eax, 0x20
je 0x4741af
cmp eax, 0x40
jne 0x474330
mov eax, 6
pop ebp
ret 4
mov eax, 5
pop ebp
ret 4
mov eax, 4
pop ebp
ret 4
mov eax, 7
pop ebp
ret 4
cmp eax, 0x800
jg 0x474210
je 0x474207
cmp eax, 0x100
je 0x4741fe
cmp eax, 0x200
je 0x4741f5
cmp eax, 0x400
jne 0x474330
mov eax, 0xa
pop ebp
ret 4
mov eax, 9
pop ebp
ret 4
mov eax, 8
pop ebp
ret 4
mov eax, 0xb
pop ebp
ret 4
cmp eax, 0x1000
je 0x47423b
cmp eax, 0x2000
je 0x474232
cmp eax, 0x4000
jne 0x474330
mov eax, 0xe
pop ebp
ret 4
mov eax, 0xd
pop ebp
ret 4
mov eax, 0xc
pop ebp
ret 4
mov eax, 0xf
pop ebp
ret 4
cmp eax, 0x800000
jg 0x4742d9
je 0x4742d0
cmp eax, 0x80000
jg 0x4742a0
je 0x474297
cmp eax, 0x10000
je 0x47428e
cmp eax, 0x20000
je 0x474285
cmp eax, 0x40000
jne 0x474330
mov eax, 0x12
pop ebp
ret 4
mov eax, 0x11
pop ebp
ret 4
mov eax, 0x10
pop ebp
ret 4
mov eax, 0x13
pop ebp
ret 4
cmp eax, 0x100000
je 0x4742c7
cmp eax, 0x200000
je 0x4742be
cmp eax, 0x400000
jne 0x474330
mov eax, 0x16
pop ebp
ret 4
mov eax, 0x15
pop ebp
ret 4
mov eax, 0x14
pop ebp
ret 4
mov eax, 0x17
pop ebp
ret 4
cmp eax, 0x8000000
jg 0x47431b
je 0x474312
cmp eax, 0x1000000
je 0x474309
cmp eax, 0x2000000
je 0x474300
cmp eax, 0x4000000
jne 0x474330
mov eax, 0x1a
pop ebp
ret 4
mov eax, 0x19
pop ebp
ret 4
mov eax, 0x18
pop ebp
ret 4
mov eax, 0x1b
pop ebp
ret 4
cmp eax, 0x10000000
je 0x474348
cmp eax, 0x20000000
je 0x47433f
cmp eax, 0x40000000
je 0x474336
xor eax, eax
pop ebp
ret 4
mov eax, 0x1e
pop ebp
ret 4
mov eax, 0x1d
pop ebp
ret 4
mov eax, 0x1c
pop ebp
ret 4
Function at 0x102d86c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebx*4]
push word [esp]
jmp 0x102d86ff
jns 0x102d8690
mov dword [esp], ecx
clc
call fcn.102d8721
dec byte [ebx - 0x2c99dbfc]
loopne 0x102d869c
add al, 0x24
mov ah, byte [esp]
bswap eax
jmp 0x102d874b
push ebx
lea eax, reloc.KERNEL32.dll_GetStringTypeW
rdtsc
push dword [esp + 4]
ret 8
lea edx, [edx - 0x21]
mov al, ch
xchg ah, al
inc ah
not ah
xchg dword [esp], edx
jmp 0x102d8731

Function at 0x102d9889
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts eax, esp
mov ah, 0x1b
call fcn.102d97a3
mov word [esp], bp
lea esp, [esp + 2]
push ecx
call fcn.102d98ab
add dword [edx + reloc.KERNEL32.dll_GetStringTypeW], edx
xchg ebx, eax
or cl, byte [eax - 0x7099dbcc]
mov byte [esp], dh
pop word [esp]
lea esp, [esp]
jmp 0x102d9873

Function at 0x102d98ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x102d98fc
mov word [esp], bp
push word [esp + 2]
jbe 0x102d9895
lea esp, [esp + 2]
mov dword [esp], edx
push ebx
jmp 0x102d9904
lea esp, [esp + 2]
mov dword [esp], edx
push ebx
call fcn.102d98d9

Function at 0x102d98d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x2c7218
jmp 0x102d993d
jmp 0x102d9909
mov dword [esp + 4], esi
push cx
jmp 0x102d9a97
mov word [esp + 1], ax
mov dword [esp], esp
push ebp
push esp
call fcn.102d98db
push word [esp + 3]
jle 0x102d98e5
mov dword [esp + 4], esi
push cx
mov byte [esp], cl
jmp 0x102d9983
mov ax, 0xf6aa
clc
jnp 0x102d9959
lea edx, reloc.KERNEL32.dll_GetStringTypeW
xchg esi, ebx
jmp 0x102d9967
pushfd
jmp 0x102d6007
lea edx, reloc.KERNEL32.dll_GetStringTypeW
jmp 0x102d9965
xchg esi, ebx
mov esi, dword [esp + 0x2c]
mov dx, 0xd93f
cpuid
jmp 0x102d9a61
lea esp, [esp + 1]
lea esp, [esp]
jmp 0x102d9aa1
lea edi, [esp + 4]
cpuid
jmp 0x102d9a46
pop dword [esp]
lea esp, [esp + 2]
jmp 0x102d998f
mov ebp, esp
rdtsc
add bl, dl
ja 0x102d9a76
jbe 0x102d9a7f
cmpsb byte [esi], byte es:[edi]
and al, 0xba
invalid
sub esp, 0xbc
jmp 0x102d9a30
sub esp, 0xa
je 0x102d99a5
pop dword [esp]
lea esp, [esp + 2]
call fcn.102d99c4
setl cl
jmp fcn.102d9ac3
setl cl
jmp fcn.102d9ac3
mov byte [esp], cl
lea esp, [esp + 1]
lea esp, [esp]
lea esp, [esp + 1]
mov dword [esp], edi
jmp 0x102d9953

Function at 0x102d98db
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 3], cl
lea esp, [esp + 2]
jmp 0x102d9918

Function at 0x102e4363
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x102ca54b
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x102ca565
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x102ca554
pop esi
jmp 0x102ca570
ret 4
jmp 0x102ca53e

Function at 0x10311ee5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 2]
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x10311f23
js 0x10311be1
jns 0x10311cb5

Function at 0x10312133
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
jmp 0x10312158
pushal
lea esp, [esp + 0x28]
jne 0x10311c91
je 0x10311c55
movsb byte es:[edi], byte es:[esi]
cmp bl, byte [ebp - 0x54]
push 0x51
Function at 0x10312170
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x10312188
mov eax, dword [ebp - 4]
mov dh, ch
jmp 0x10311f0d
add eax, ebx
mov dh, byte [esp]
jmp 0x10311f2f
cdq
sub eax, edx
mov edi, dword [esp]
mov dx, 0x8926
jmp 0x103123ee
pushal
rdtsc
clc
mov dword [esp + 4], edi
popal
jmp 0x103120b4
mov eax, dword [ebp - 0x10]
sar edi, 1
push esi
jmp 0x10311f63
or al, bh
add edx, dword [ebp + 8]
call 0x10311f99
lea esi, [esi*4]
lea esi, [eax + esi]
mov edx, dword [esi]
pop esi
jmp 0x10312003
lea esp, [esp + 4]
jle 0x10311cb5
jmp 0x10311c55
jmp 0x10312149
mov dl, byte [esp]
mov edi, eax
mov dh, 0x8a
dec dx
jmp 0x10311f79
Function at 0x103f34e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
setle ah
shl dx, cl
bsr ax, bp
bsr ebx, esi
jmp 0x103f351b
rdtsc
pushal
mov byte [esp + 8], al

Function at 0x103f354c
Capabilities:
Execute anti-debugging instructions

Disassembly:
setp dl
mov bx, 0x457f
adc ebx, ebp
xchg word [esp + 0x14], bx
mov dh, 2
mov dh, 0x3f
jmp 0x103f3564
jmp 0x103f352e
not dl
mov bl, byte [esp + 3]
bsr ebx, esi
xchg bx, dx
mov dh, 0x8d
jmp 0x103f35f9
mov word [esp + 6], dx
mov dword [esp + 0x14], ebx
lea edx, [edi + edi]
pop dword [esp + 0x12]
mov dh, bl
xchg edx, eax
jmp 0x103f354e
push dword [esp + 2]
bt eax, esi
push word [esp + 8]
mov dword [esp + 1], eax
pop dword [esp + 3]
mov edx, 0xad990d8e
jmp 0x103f35db
push word [esp + 0x18]
lea esp, [esp + 0x1c]
mov word [esp + 1], ax
lea ebx, [edx + esi]
lea edx, [edx*4]
mov byte [esp + 6], bl
jmp 0x103f3597
rdtsc
mov ah, bl
xchg word [esp + 2], bx
pushfd
lea esp, [esp + 2]
xchg dx, ax
jmp 0x103f3613
mov ebx, dword [esp + 9]
sub esp, 5
sub esp, 1
push dword [esp + 0x14]
mov word [esp + 6], bx
xchg word [esp + 8], bx
jmp 0x103f35bd
pop dword [esp + 2]
neg edx
rdtsc
lea ebx, [edi + ebp]
mov ebx, ecx
mov edx, 0xe000604b
jmp 0x103f3668
mov al, 0xc0
xchg bx, dx
call fcn.103f3698
dec eax
popal
jo 0x103f36a5
jae 0x103f36d8
jb 0x103f36d5
jns 0x103f3668
pop word [esp + 2]
xchg dword [esp], edx
xchg word [esp], dx
lea eax, reloc.KERNEL32.dll_GetStringTypeW
pop word [esp]
mov dh, 0xfe
jmp 0x103f3652
inc esp
and al, 7
mov dx, sp
pop word [esp + 5]
pop edx
pop word [esp]
mov ax, dx
jmp 0x103f4410
invalid
xchg byte [esp], dh
xor al, 0x24
mov dh, ah
rcr dl, 5
mov ebx, 0xf4ae6668
not dx
xchg byte [esp + 2], bh
jmp 0x103f3748
mov dx, 0x9877
pop dword [esp + 1]
mov byte [esp + 2], dh
mov al, 0x32
xchg dx, bx
add esp, 5
jmp 0x103f36d7
lea edx, [esi + 0x82]
push word [esp + 7]
pop word [esp]
call fcn.103f375c
jns 0x103f377e
pop word [esp + 7]
mov dword [esp + 7], ebp
xchg dx, ax
mov dh, bh
lea edx, [eax - 0xbc]
mov word [esp + 5], dx
jmp 0x103f3710
sub esp, 9
stc
xchg byte [esp], al
xchg byte [esp + 0xc], dl
mov dword [esp], ebp
mov bx, 0xae01
jmp 0x103f3726
test byte [ebp + 0xad04], 0
add byte [ebx + 0x124548b], dl
lea eax, [ebp*4]
xchg ebx, eax
mov edx, dword [esp + 1]
setnp dl
mov al, byte [esp + 1]
sub esp, 0xa
jmp 0x103f36fa
mov word [esp], di
lea ebx, reloc.KERNEL32.dll_GetStringTypeW
lea esp, [esp]
mov ebx, 0x59249a18
mov ax, word [esp + 3]
or bx, 0xdf4a
jmp 0x103f377f
mov eax, edi
pop word [esp + 0x15]
lea ebx, [edx + ebx]
push word [esp + 7]
bsf edx, ecx
lea esp, [esp + 0x1a]
jmp 0x103f37cf
mov dh, bl
mov bh, 0x92
setb dh
mov eax, dword [esp + 0xb]
mov dword [esp + 0x19], esi
lea ebx, reloc.KERNEL32.dll_GetStringTypeW
jmp 0x103f3954
bswap eax
mov ebx, ebp
clc
dec bx
sub esp, 0x11
sub esp, 0xc
jmp 0x103f3c2b
add esp, 1
xchg byte [esp], bh
mov dl, 0x93
setp dh
dec ax
lea eax, [eax - 0x98]
jmp 0x103f3e79

Function at 0x103f385f
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr ah, 4
mov ebx, 0x97880ef5
btr edx, eax
mov byte [esp + 3], dh
mov edx, 0x4bcd65b8
jmp 0x103f38d1
mov ah, 0x3b
pop ebx
setb ah
xchg byte [esp], dl
mov bx, 0x9c47
lea eax, [eax*4]
jmp 0x103f38b1
Function at 0x1043ba09
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x103f3026
call fcn.103f302b
call 0x103f823e
jmp 0x1043ba2b
lea esp, [esp + 0x2c]
jmp 0x1043b9e1
mov byte [esp + 8], bh
lea esp, [esp + 2]
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], edi
jmp 0x1043b99a
mov dword [esp + 0x2c], ebp
pushfd
pop word [esp]
push word [esp + 1]
push word [esp]
push dword [esp + 2]
jmp 0x1043b9b0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x1043b9f3
mov eax, dword [eax]
jmp 0x1043ba9d
push word [esp + 1]
pop word [esp + 1]
jmp 0x1043b9c9
pop eax
sub eax, 0x3f823e
push eax
jmp 0x103f2c4e
mov eax, dword [eax + 8]
push eax
jmp 0x103f8239
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x173a2d45
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x74067bd
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44507c]
jne 0x401e1f
repz ret
jmp fcn.00402897

Function at 0x40844c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44507c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406251
and dword [ebp - 0x14], 0
cmp dword [0x4487b8], 0
mov dword [ebp - 0x18], eax
jne 0x4084ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4085a7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4085a7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4487b8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4487bc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4487c0], eax
call edi
push eax
call esi
mov dword [0x4487c8], eax
test eax, eax
je 0x4084ff
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4487c4], eax
mov eax, dword [0x4487c4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408558
cmp dword [0x4487c8], ecx
je 0x408558
push eax
call esi
push dword [0x4487c8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408558
test ebx, ebx
je 0x408558
call edi
test eax, eax
je 0x40854f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40854f
test byte [ebp - 8], 1
jne 0x408558
or dword [ebp + 0x10], 0x200000
jmp 0x40858b
mov eax, dword [0x4487bc]
cmp eax, dword [ebp - 0x18]
je 0x40858b
push eax
call esi
test eax, eax
je 0x40858b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40858b
mov eax, dword [0x4487c0]
cmp eax, dword [ebp - 0x18]
je 0x40858b
push eax
call esi
test eax, eax
je 0x40858b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4487b8]
call esi
test eax, eax
je 0x4085a7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4085a9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401e15
leave
ret
Function at 0x40ae10
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4656cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045a6ab
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40ae92
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004585fa
mov eax, dword [eax]
push 0x47c1f4
push eax
call fcn.0044b1f4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045a936
test bl, bl
je 0x40ae92
push 0x47c1f4
lea ecx, [esp + 0xc]
call fcn.0045acc6
push 0x47fd40
lea ecx, [esp + 0xc]
call fcn.0045acc6
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40aece
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045a936
jmp 0x40af99
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40af52
lea edx, [esp + 0x7c]
push 0x47fd3c
push edx
call fcn.0044b1f4
add esp, 8
test eax, eax
je 0x40af52
lea eax, [esp + 0x7c]
push 0x47fd38
push eax
call fcn.0044b1f4
add esp, 8
test eax, eax
je 0x40af52
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40aee2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045a936
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40b790
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40b7f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40b800
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46574b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4862bc]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40b938
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40b866
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045a936
xor eax, eax
jmp 0x40b9af
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045aa73
push esi
lea ecx, [esp + 0xc]
call fcn.0045ad02
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40b98d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040b790
test eax, eax
jne 0x40b98d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040b790
test eax, eax
jne 0x40b98d
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.0044c270
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b96c
lea ecx, [esp + 0x14]
push 0x47fd50
push ecx
call fcn.0044c1f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b96c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40b96f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045aa23
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40b87e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045a936
xor eax, eax
jmp 0x40b9af
mov byte [esi], 0
push 0x47fd4c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045a936
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4