joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404434
Capabilities:
Enumerate threads
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
push ebx
push 4
mov byte [ebp - 1], bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp eax, 6
je 0x4044c3
push esi
push edi
push 0x1c
pop esi
push esi
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.00405420
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x24], esi
call sub.KERNEL32.dll_Thread32First
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4044b3
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 8]
jne 0x4044a7
push dword [ebp - 0x1c]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, ebx
je 0x4044a7
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x4044b9
push esi
mov byte [ebp - 1], 1
call edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x40447a
jmp 0x4044bc
mov byte [ebp - 1], bl
push dword [ebp - 8]
call edi
pop edi
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret

Function at 0x4044c9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
push esi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.00405420
push 0x10
lea esi, [edi + 0x314]
push ebx
push esi
call fcn.00405420
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x250]
push eax
mov dword [ebp - 0x44], 0x44
call fcn.0040534b
lea eax, [ebp - 0x250]
push 0x5c
push eax
call fcn.004053ef
add esp, 0x2c
cmp eax, ebx
je 0x404526
xor ecx, ecx
mov word [eax], cx
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
cmp al, bl
je 0x40455f
mov ecx, dword [esi]
mov dword [edi + 0x310], ecx
mov ecx, dword [edi + 0x31c]
mov dword [edi + 0x30c], ecx
pop esi
pop ebx
leave
ret 4
Function at 0x404565
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
push edi
mov edi, dword [0x41b6e4]
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.00405420
push 0x10
lea eax, [edi + 0x314]
push ebx
push eax
call fcn.00405420
mov esi, 0x104
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x460]
push eax
call fcn.0040534b
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x254]
push eax
call fcn.0040534b
lea eax, [ebp - 0x254]
push 0x5c
push eax
call fcn.004053ef
add esp, 0x38
cmp eax, ebx
je 0x4045d3
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea ecx, [ebp - 4]
push ecx
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
lea esi, [edi + 0x314]
push esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x254]
push eax
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x460]
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
setne al
cmp al, bl
je 0x404633
mov ecx, dword [esi]
mov dword [edi + 0x310], ecx
mov ecx, dword [edi + 0x31c]
mov dword [edi + 0x30c], ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x404661
Capabilities:
Create service

Disassembly:
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push dword [esp + 0x1c]
push 1
push 3
push 0x10
push 0x10000000
push str.ANSAV_Daemon
push str.ANSAVDaemon
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, edi
mov dword [esi + 4], eax
pop edi
jne 0x4046ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x41c124], eax
call fcn.004036e2
push eax
push str.Cannot_create_service._n_s
call fcn.00404eee
push eax
call fcn.00404e57
add esp, 0xc
xor al, al
jmp 0x4046bc
mov al, 1
ret 4

Function at 0x4046e2
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [esi + 4], 0
jne 0x4046f2
xor al, al
leave
ret
push 0x24
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.00405420
and dword [ebp - 4], 0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4046ee
cmp dword [ebp - 0x24], 4
sete al
leave
ret

Function at 0x404728
Capabilities:
Start service

Disassembly:
mov eax, dword [eax + 4]
test eax, eax
jne 0x404732
xor al, al
ret
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x404767
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x41c124], eax
call fcn.004036e2
push eax
push str.Cannot_start_service.__s
call fcn.00404eee
push eax
call fcn.00404e57
add esp, 0xc
jmp 0x40472f
mov al, 1
ret
Function at 0x4047aa
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
push 0x10
push eax
mov byte [esi + 0x1ac], al
mov byte [esi + 0x1ad], al
mov dword [esi + 0x190], eax
lea eax, [esi + 0x198]
push eax
call fcn.00405420
add esp, 0xc
push esi
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x4047f7
call fcn.004036e2
push eax
push str.Error:_WSAStartup__s
call fcn.00404e57
pop ecx
pop ecx
leave
ret
movzx eax, byte [esi + 1]
mov dword [ebp - 4], eax
movzx eax, byte [esi]
fild dword [ebp - 4]
fdiv qword [0x416b50]
fstp dword [ebp - 4]
fld dword [ebp - 4]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
faddp st(1)
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esi + 0x194]
fld dword [ebp - 4]
fcomp qword [0x416b48]
fnstsw ax
test ah, 5
jp 0x40484b
fld dword [ebp - 4]
push ecx
push ecx
fstp qword [esp]
push str.Error:_unsupported_version_socket_lib__f
call fcn.00404e57
add esp, 0xc
leave
ret
mov byte [esi + 0x1ac], 1
leave
ret

Function at 0x404854
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
cmp byte [esi + 0x1ac], 0
jne 0x404864
xor al, al
jmp 0x4048f0
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [esi + 0x190], eax
cmp eax, 0xffffffff
jne 0x40488e
call fcn.004036e2
push eax
push str.Error:_socket__s
call fcn.00404e57
pop ecx
pop ecx
jmp 0x40485d
push edi
push 2
pop eax
push dword [esp + 0xc]
lea edi, [esi + 0x198]
mov word [edi], ax
call sub.WSOCK32.dll_htons
push dword [esp + 8]
mov word [esi + 0x19a], ax
call sub.WSOCK32.dll_gethostbyname
mov dword [esi + 0x1a8], eax
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
push 0x10
push edi
push dword [esi + 0x190]
mov dword [esi + 0x19c], eax
call sub.WSOCK32.dll_connect
pop edi
test eax, eax
je 0x4048e7
call fcn.004036e2
push eax
push str.Error:_connect__s
jmp 0x404885
mov byte [esi + 0x1ad], 1
mov al, 1
ret 8

Function at 0x4048f3
Capabilities:
Send data
Send data on socket

Disassembly:
xor ecx, ecx
cmp byte [eax + 0x1ac], cl
je 0x404920
cmp byte [eax + 0x1ad], cl
je 0x404920
mov eax, dword [eax + 0x190]
cmp eax, ecx
je 0x404920
push ecx
push dword [esp + 0xc]
push dword [esp + 0xc]
push eax
call sub.WSOCK32.dll_send
jmp 0x404922
xor eax, eax
ret 8

Function at 0x404925
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
xor ebx, ebx
cmp byte [esi + 0x1ac], bl
je 0x404967
cmp byte [esi + 0x1ad], bl
je 0x404967
cmp dword [esi + 0x190], ebx
je 0x404967
push dword [esp + 0xc]
push ebx
push dword [esp + 0x10]
call fcn.00405420
add esp, 0xc
push ebx
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esi + 0x190]
call sub.WSOCK32.dll_recv
jmp 0x404969
xor eax, eax
pop ebx
ret 8
Function at 0x4049ad
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4049db
cmp eax, 3
je 0x4049db
cmp esi, 0x10
je 0x4049db
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x404a5a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
xor ebx, ebx
push 0x4159fc
mov edi, 0x41c130
mov byte [0x41b63e], bl
mov dword [0x41c12c], ebx
call fcn.00404a20
pop ecx
cmp word [0x41c130], bx
jne 0x404aa0
call fcn.004036e2
push eax
push str.Cannot_get_current_path_for_LogFilePathW_in_CLog::Init______s
call fcn.00404e57
pop ecx
pop ecx
jmp 0x404b73
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.ansrv.log
call fcn.004053d5
inc eax
inc eax
push eax
push str._ansrv.log
push edi
call fcn.00405395
push 0x64
call fcn.0040559d
add esp, 0x14
cmp eax, ebx
je 0x404adb
push edi
call fcn.004037e1
mov dword [0x41c12c], eax
jmp 0x404ae1
mov dword [0x41c12c], ebx
push esi
push edi
call fcn.004049ad
mov esi, dword [0x41c12c]
pop ecx
test al, al
jne 0x404b63
push ebx
call fcn.00403916
push str.ANSAV_daemon__v2.0.7_LOG_FILE_r_n
call fcn.00403cc7
push 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.00405420
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
push str.File_created_:__02d:_02d:_d____02d__02d__d_r_n
call fcn.00404eee
add esp, 0x1c
push eax
call fcn.00403cc7
push str._______________________________________________________r_n
call fcn.00403cc7
push 0x416acc
call fcn.00403cc7
jmp 0x404b6d
mov edx, 0x40000000
call fcn.00403996
call fcn.00403d57
pop esi
pop edi
pop ebx
leave
ret
Function at 0x404b77
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
xor ebx, ebx
push 0x4159fc
mov edi, 0x41c130
mov byte [0x41b63e], bl
mov dword [0x41c12c], ebx
call fcn.00404a20
pop ecx
cmp word [0x41c130], bx
jne 0x404bbd
call fcn.004036e2
push eax
push str.Cannot_get_current_path_for_LogFilePathW_in_CLog::Init______s
call fcn.00404e57
pop ecx
pop ecx
jmp 0x404c9a
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 3
push 0x416ad0
push edi
call fcn.00405395
mov esi, str.ANSAVd.log
push esi
call fcn.004053d5
inc eax
inc eax
push eax
push esi
push edi
call fcn.00405395
push 0x64
call fcn.0040559d
add esp, 0x20
cmp eax, ebx
je 0x404c03
push edi
call fcn.004037e1
mov dword [0x41c12c], eax
jmp 0x404c09
mov dword [0x41c12c], ebx
push edi
call fcn.004049ad
mov esi, dword [0x41c12c]
pop ecx
test al, al
jne 0x404c8a
push ebx
call fcn.00403916
push str.ANSAV_daemon__v2.0.7_LOG_FILE_r_n
call fcn.00403cc7
push 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.00405420
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
push str.File_created_:__02d:_02d:_d____02d__02d__d_r_n
call fcn.00404eee
add esp, 0x1c
push eax
call fcn.00403cc7
push str._______________________________________________________r_n
call fcn.00403cc7
push 0x416acc
call fcn.00403cc7
jmp 0x404c94
mov edx, 0x40000000
call fcn.00403996
call fcn.00403d57
pop esi
pop edi
pop ebx
leave
ret

Function at 0x404f70
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, eax
or ebx, 0xffffffff
xor ecx, ecx
xor edx, edx
test esi, esi
jbe 0x404fb2
push ebp
movzx eax, byte [edx + edi]
movzx ebp, bl
shl ecx, 4
xor ebp, eax
add ecx, eax
shr ebx, 8
xor ebx, dword [ebp*4 + 0x415a30]
mov eax, ecx
and eax, 0xf0000000
je 0x404fa8
mov ebp, eax
shr ebp, 0x18
xor ecx, ebp
not eax
inc edx
and ecx, eax
cmp edx, esi
jb 0x404f80
pop ebp
mov eax, 0x6eecbe1
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
mov edx, eax
imul edx, edx, 0x3e5
mov eax, ecx
mov ecx, esi
shl esi, 0x10
shr ecx, 0x10
sub eax, edx
add ecx, esi
not ebx
xor eax, ecx
pop esi
xor eax, ebx
pop ebx
ret

Function at 0x409d40
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4199f4]
jne 0x409d4a
repz ret
jmp fcn.0040d7cb
Function at 0x40d617
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407b77
and dword [ebp - 4], 0
cmp dword [0x41b1fc], 0
mov ebx, eax
jne 0x40d6c8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d779
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x414504
push edi
call esi
test eax, eax
je 0x40d779
push eax
call fcn.00407b05
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41b1fc], eax
call esi
push eax
call fcn.00407b05
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41b200], eax
call esi
push eax
call fcn.00407b05
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41b204], eax
call esi
push eax
call fcn.00407b05
pop ecx
mov dword [0x41b20c], eax
test eax, eax
je 0x40d6c8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407b05
pop ecx
mov dword [0x41b208], eax
mov eax, dword [0x41b208]
cmp eax, ebx
je 0x40d720
cmp dword [0x41b20c], ebx
je 0x40d720
push eax
call fcn.00407b80
push dword [0x41b20c]
mov esi, eax
call fcn.00407b80
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d720
test edi, edi
je 0x40d720
call esi
test eax, eax
je 0x40d717
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d717
test byte [ebp - 0xc], 1
jne 0x40d720
or dword [ebp + 0x10], 0x200000
jmp 0x40d759
mov eax, dword [0x41b200]
cmp eax, ebx
je 0x40d759
push eax
call fcn.00407b80
pop ecx
test eax, eax
je 0x40d759
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d759
mov eax, dword [0x41b204]
cmp eax, ebx
je 0x40d759
push eax
call fcn.00407b80
pop ecx
test eax, eax
je 0x40d759
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41b1fc]
call fcn.00407b80
pop ecx
test eax, eax
je 0x40d779
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d77b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40e0f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4925bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00487397
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40e172
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004852a9
mov eax, dword [eax]
push 0x58eca8
push eax
call fcn.00477d44
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00487622
test bl, bl
je 0x40e172
push 0x58eca8
lea ecx, [esp + 0xc]
call fcn.004879b2
push 0x58ecb4
lea ecx, [esp + 0xc]
call fcn.004879b2
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40e1ae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00487622
jmp 0x40e279
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40e232
lea edx, [esp + 0x7c]
push 0x58ecb0
push edx
call fcn.00477d44
add esp, 8
test eax, eax
je 0x40e232
lea eax, [esp + 0x7c]
push 0x58ecac
push eax
call fcn.00477d44
add esp, 8
test eax, eax
je 0x40e232
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e1c2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00487622
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40ea70
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40ead2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40eae0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49263b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x59f37c]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40ec18
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40eb46
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00487622
xor eax, eax
jmp 0x40ec8f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0048775f
push esi
lea ecx, [esp + 0xc]
call fcn.004879ee
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40ec6d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040ea70
test eax, eax
jne 0x40ec6d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040ea70
test eax, eax
jne 0x40ec6d
lea eax, [esp + 0x14]
push 0x58ecc4
push eax
call fcn.00478de0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40ec4c
lea ecx, [esp + 0x14]
push 0x58ecc0
push ecx
call fcn.00478d60
mov esi, eax
add esp, 8
test esi, esi
jne 0x40ec4c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40ec4f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0048770f
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40eb5e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00487622
xor eax, eax
jmp 0x40ec8f
mov byte [esi], 0
push 0x58ecbc
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00487622
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4