joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4934a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x234
push ebx
push esi
mov esi, eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x493568
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x240]
mov dword [esp + 0x14], edx
lea edx, [esp + 0x10]
lea eax, [esp + 0x30]
push edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0x11
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x493557
mov eax, dword [esp + 0x244]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ebx, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push esi
push eax
call edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov al, bl
pop esi
pop ebx
add esp, 0x234
ret 8
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
xor al, al
pop ebx
add esp, 0x234
ret 8

Function at 0x4945b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cf058
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [esp + 0x30], 0
mov edi, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov ecx, edi
sub ecx, ebp
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jbe 0x49462b
cmp ebp, edi
jbe 0x494600
call fcn.0049f380
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
push edi
push eax
lea eax, [esp + 0x40]
push eax
mov eax, 0x66666667
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
push ebx
push esi
call fcn.00494c30
jmp 0x494678
jae 0x494678
cmp ebp, edi
jbe 0x494636
call fcn.0049f380
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x18], edx
cmp ebp, dword [esi + 0x10]
jbe 0x494649
call fcn.0049f380
mov eax, dword [esi]
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
lea eax, [esp + 0x14]
mov dword [esp + 0x18], ebp
call fcn.00495050
mov edx, dword [esp + 0x18]
mov ecx, dword [eax + 4]
push edi
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00494b80
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x38]
test eax, eax
je 0x49469e
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x49469e
push esi
call fcn.0049e96f
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 0x28
Function at 0x496c70
Capabilities:
Set registry value

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
push 0
mov esi, eax
mov ecx, dword [esi + 0xc]
mov eax, dword [0x4fe48c]
push 0
push 0x1200
push ecx
mov dword [esp + 0x24], eax
call ebp
mov edi, eax
inc edi
xor ecx, ecx
lea eax, [edi + edi]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049e995
add esp, 4
mov dword [eax + edi*4], 0
mov edx, dword [esi + 0xc]
mov dword [esp + 0x10], eax
lea eax, [eax + edi*4 + 4]
push eax
lea ecx, [edi - 1]
push ecx
push 0x1211
push edx
call ebp
xor ebx, ebx
test edi, edi
jle 0x496d31
test ebx, ebx
jne 0x496cf5
mov ecx, dword [esi + 4]
lea eax, [esp + 0x18]
push eax
push ebx
push 0x1207
push ecx
call ebp
mov ecx, dword [esi + 4]
jmp 0x496d0c
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x18]
push edx
lea eax, [ebx - 1]
push eax
push 0x1207
push ecx
call ebp
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
push 2
lea edx, [esp + 0x1c]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, edi
jl 0x496cdb
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
lea ecx, [edi*8]
push ecx
push esi
push 3
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call fcn.0049e96f
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 4
Function at 0x496d70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 0xc]
push ebx
push ebp
mov ebp, dword [0x4fe48c]
push esi
push edi
push 0
push 0
push 0x1200
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
inc esi
xor ecx, ecx
lea eax, [esi + esi]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049e995
mov edx, dword [esp + 0x60]
add esp, 4
mov ebx, eax
lea eax, [esp + 0x1c]
push eax
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0
push edx
lea edi, [esi*8]
push ebp
mov byte [esp + 0x2f], 0
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x496e7c
cmp dword [esp + 0x18], 3
jne 0x496e7c
cmp dword [esp + 0x1c], edi
jne 0x496e7c
mov edx, dword [esp + 0x58]
lea eax, [ebx + esi*4 + 4]
push eax
mov eax, dword [edx + 0xc]
lea ecx, [esi - 1]
push ecx
push 0x1212
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test esi, esi
jle 0x496e77
cmp dword [ebx + edi*4], 0
jle 0x496e72
mov ebp, dword [ebx + edi*4]
push 0x4e
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ebp, eax
jge 0x496e72
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], ebp
push ecx
test edi, edi
jne 0x496e5b
mov edx, dword [esp + 0x5c]
mov eax, dword [edx + 4]
push edi
push 0x120c
push eax
jmp 0x496e6c
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0xc]
lea edx, [edi - 1]
push edx
push 0x120c
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
inc edi
cmp edi, esi
jl 0x496e21
mov byte [esp + 0x17], 1
push ebx
call fcn.0049e96f
mov al, byte [esp + 0x1b]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 8

Function at 0x497ef0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov bl, al
mov esi, ecx
mov ecx, dword [esi]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0x14]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
shr eax, 0x1c
and al, 1
cmp al, bl
setne cl
mov byte [esp + 0xf], cl
test bl, bl
je 0x497f75
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 3
call edi
push 2
mov ebx, eax
call edi
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x10]
mov edx, ecx
sub edx, eax
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
cmp byte [esp + 0x24], 0
je 0x497f53
sub eax, ebx
push 0x44
push eax
sub ecx, edx
push ecx
push 0
push edx
mov edx, dword [esi + 0x14]
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
test al, al
je 0x497f99
push 0
call fcn.00497c00
mov eax, dword [esi + 0x14]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
pop edi
pop esi
mov al, cl
pop ebx
add esp, 0x14
ret 4
Function at 0x497fb0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov bl, al
mov esi, ecx
mov ecx, dword [esi]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0xfffffffffffffff0
push ebp
call dword [sym.imp.USER32.dll_GetWindowLongW]
shr eax, 0x1c
and al, 1
cmp al, bl
setne cl
mov byte [esp + 0x40], cl
test bl, bl
je 0x498073
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 3
call ebx
push 2
mov dword [esp + 0x14], eax
call ebx
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x18]
cmp ebp, eax
jne 0x498013
mov dword [esp + 0x28], 0
jmp 0x49801d
mov edx, dword [esi + 0x84]
mov dword [esp + 0x28], edx
cmp ebp, eax
jne 0x498029
mov edi, dword [esi + 0x84]
jmp 0x498031
mov edi, dword [esp + 0x20]
sub edi, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
sub esi, dword [esp + 0x1c]
push 3
sub esi, dword [esp + 0x14]
call ebx
add eax, esi
cmp byte [esp + 0x44], 0
je 0x49804e
sub edi, dword [esp + 0x14]
push 0x44
sub eax, esi
push eax
mov eax, dword [esp + 0x30]
sub edi, eax
push edi
push esi
push eax
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
mov al, byte [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
test al, al
je 0x498098
push 0
push esi
mov eax, ebp
call fcn.00498280
push 0
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, byte [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
pop edi
pop esi
pop ebp
mov al, cl
pop ebx
add esp, 0x2c
ret 8

Function at 0x498110
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x48
push ebx
push esi
mov esi, eax
push edi
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x20]
push ecx
mov eax, esi
call fcn.00497d70
mov edx, dword [esp + 0x2c]
cmp edx, dword [esp + 0x28]
mov eax, dword [esp + 0x48]
setle bl
cmp eax, dword [esp + 0x44]
mov al, bl
setle byte [esp + 0x14]
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, esi
mov byte [esp + 0x1c], bl
call fcn.00497ef0
mov edx, dword [esp + 0x18]
mov byte [esp + 0x13], al
mov eax, dword [esi + 0x1c]
push edx
push eax
mov al, byte [esp + 0x1c]
mov ecx, esi
call fcn.00497fb0
test bl, bl
je 0x49817d
cmp byte [esp + 0x14], 0
je 0x49817d
call fcn.004980b0
jmp 0x498189
mov ecx, dword [esi + 0x20]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_SetScrollInfo]
test bl, bl
je 0x4981ab
mov eax, dword [esi + 0x14]
push 1
lea edx, [esp + 0x20]
push edx
push 2
push eax
call edi
xor eax, eax
mov ecx, esi
call fcn.00497c70
cmp byte [esp + 0x14], 0
je 0x4981ca
mov edx, dword [esi + 0x1c]
push 1
lea ecx, [esp + 0x3c]
push ecx
push 2
push edx
call edi
mov eax, dword [esi + 0x1c]
push eax
call fcn.004982e0
cmp byte [esp + 0x13], 0
je 0x4981d6
call fcn.00498740
pop edi
pop esi
pop ebx
add esp, 0x48
ret
Function at 0x49c6b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4ccce8
push eax
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push 0x4d9158
mov eax, 8
mov esi, ecx
call fcn.00490250
mov edi, dword [ebp]
test edi, edi
je 0x49c6fd
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x49c6fd
push edi
call fcn.0049e96f
add esp, 4
mov eax, ebx
mov eax, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp], eax
test eax, eax
je 0x49c711
push eax
call ebx
mov edi, dword [esi]
test edi, edi
je 0x49c72b
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x49c72b
push edi
call fcn.0049e96f
add esp, 4
mov eax, dword [ebp]
mov dword [esi], eax
test eax, eax
je 0x49c737
push eax
call ebx
mov edi, dword [esp + 0x20]
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x49c81c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x49c81c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x49c81c
movzx ecx, word [edi]
push ecx
call fcn.0049e767
movzx edx, word [edi]
push edx
mov ebx, eax
push edi
push ebx
call fcn.004a7df0
add esp, 0x10
lea ecx, [ebx + 0x28]
lea eax, [esp + 0x24]
call fcn.0049c530
push eax
mov dword [esp + 0x1c], 0
call fcn.004018d0
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x24]
test eax, eax
je 0x49c7c8
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x49c7c8
push esi
call fcn.0049e96f
add esp, 4
mov edi, str.FileDescription
mov esi, ebx
call fcn.0049c650
test eax, eax
je 0x49c7e3
mov esi, eax
mov eax, dword [esp + 0x28]
call fcn.00490590
mov edi, 0x4dde58
mov esi, ebx
call fcn.0049c650
test eax, eax
je 0x49c7fc
mov esi, eax
mov eax, ebp
call fcn.00490590
push ebx
call fcn.0049e610
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
xor al, al
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x49ccda
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4fc0c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x49cdaf
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49cd9e
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x49cd88
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x49cd9e
push eax
push edi
push dword [ebp - 0x110]
call fcn.0049cc77
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x49cdb1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004a292e
leave
ret 4

Function at 0x4a292e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4fc0c4]
jne 0x4a2938
repz ret
jmp fcn.004b11bb
Function at 0x4b3a28
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004a4b7b
and dword [ebp - 4], 0
cmp dword [0x4fe1d4], 0
mov ebx, eax
jne 0x4b3ad9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4b3b8a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4b3b8a
push eax
call fcn.004a4b09
mov dword [esp], 0x4d726c
push edi
mov dword [0x4fe1d4], eax
call esi
push eax
call fcn.004a4b09
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4fe1d8], eax
call esi
push eax
call fcn.004a4b09
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4fe1dc], eax
call esi
push eax
call fcn.004a4b09
pop ecx
mov dword [0x4fe1e4], eax
test eax, eax
je 0x4b3ad9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004a4b09
pop ecx
mov dword [0x4fe1e0], eax
mov eax, dword [0x4fe1e0]
cmp eax, ebx
je 0x4b3b31
cmp dword [0x4fe1e4], ebx
je 0x4b3b31
push eax
call fcn.004a4b84
push dword [0x4fe1e4]
mov esi, eax
call fcn.004a4b84
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4b3b31
test edi, edi
je 0x4b3b31
call esi
test eax, eax
je 0x4b3b28
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4b3b28
test byte [ebp - 0xc], 1
jne 0x4b3b31
or dword [ebp + 0x10], 0x200000
jmp 0x4b3b6a
mov eax, dword [0x4fe1d8]
cmp eax, ebx
je 0x4b3b6a
push eax
call fcn.004a4b84
pop ecx
test eax, eax
je 0x4b3b6a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4b3b6a
mov eax, dword [0x4fe1dc]
cmp eax, ebx
je 0x4b3b6a
push eax
call fcn.004a4b84
pop ecx
test eax, eax
je 0x4b3b6a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4fe1d4]
call fcn.004a4b84
pop ecx
test eax, eax
je 0x4b3b8a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4b3b8c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4013d4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x413ff0
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x414237
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
nop dword [eax]
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x40
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x41
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x96
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xd8
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xb4
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x5e
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 6
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xd1
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x71
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x2c
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x7a
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x28
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x96
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x4c
push str.Aristo_Halloween_Beats
push 0x50b4a8
call fcn.00402e32
push eax
call fcn.00406325
add esp, 0xc
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x35
inc edi
cmp edi, ebx
jb 0x414010
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x4036ed
Capabilities:
Terminate process

Disassembly:
jmp 0x454699
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4546aa
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405aec
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x414900
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4733cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00467cc5
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x414982
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00465b10
mov eax, dword [eax]
push 0x48b240
push eax
call fcn.00457e44
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00467f50
test bl, bl
je 0x414982
push 0x48b240
lea ecx, [esp + 0xc]
call fcn.004682e0
push 0x48edb4
lea ecx, [esp + 0xc]
call fcn.004682e0
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4149be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00467f50
jmp 0x414a89
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x414a42
lea edx, [esp + 0x7c]
push 0x48edb0
push edx
call fcn.00457e44
add esp, 8
test eax, eax
je 0x414a42
lea eax, [esp + 0x7c]
push 0x48edac
push eax
call fcn.00457e44
add esp, 8
test eax, eax
je 0x414a42
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4149d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00467f50
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x415280
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4152e2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4152f0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47344b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x495540]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x415428
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x415356
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00467f50
xor eax, eax
jmp 0x41549f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046808d
push esi
lea ecx, [esp + 0xc]
call fcn.0046831c
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41547d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00415280
test eax, eax
jne 0x41547d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00415280
test eax, eax
jne 0x41547d
lea eax, [esp + 0x14]
push 0x48edc8
push eax
call fcn.00458e80
mov esi, eax
add esp, 8
test esi, esi
jne 0x41545c
lea ecx, [esp + 0x14]
push 0x48edc4
push ecx
call fcn.00458e00
mov esi, eax
add esp, 8
test esi, esi
jne 0x41545c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41545f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046803d
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41536e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00467f50
xor eax, eax
jmp 0x41549f
mov byte [esi], 0
push 0x48edc0
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00467f50
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4