joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dd50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_recv]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
push edi
mov edi, ecx
mov dword [esi], 0
jmp 0x40dd70
mov eax, dword [esi]
push 0
mov ecx, 0x2000
sub ecx, eax
push ecx
lea edx, [eax + edi + 0x5b1]
mov eax, dword [edi + 0x34]
push edx
push eax
call ebx
test eax, eax
jle 0x40ddad
add dword [esi], eax
cmp byte [edi + 0x38], 0
je 0x40ddb7
cmp dword [esi], 0
jne 0x40de29
mov ecx, ebp
call fcn.00404cf0
push 0x42efdc
jmp 0x40de11
jl 0x40ddbd
cmp dword [esi], 0x2000
jae 0x40de05
test eax, eax
jg 0x40dd70
jmp 0x40dd96
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp dword [esi], 0
mov edi, eax
jle 0x40ddd2
cmp edi, 0x274c
je 0x40dd96
mov ecx, ebp
call fcn.00404cf0
mov esi, eax
push 0x42efa8
push 0x42b32c
mov edx, esi
call fcn.00408980
push edi
push 0x42ba04
mov edx, esi
call fcn.00408980
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4
mov ecx, ebp
call fcn.00404cf0
push 0x42efb8
push 0x42b32c
mov edx, eax
call fcn.00408980
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 4

Function at 0x40e590
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x4334ac]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
xor eax, eax
push 0x1fe
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004191e0
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push str.SoftWareSogouInput
push connect
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40e601
xor al, al
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00415c3e
add esp, 0x210
ret
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push esi
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40e5e9
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.00408560
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
mov al, 1
call fcn.00415c3e
add esp, 0x210
ret

Function at 0x40ea70
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp fcn.00410880
Function at 0x40ee30
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4277db
mov eax, dword fs:[0]
push eax
sub esp, 0x370
mov eax, dword [0x4334ac]
xor eax, esp
mov dword [esp + 0x368], eax
push ebx
push esi
push edi
mov eax, dword [0x4334ac]
xor eax, esp
push eax
lea eax, [esp + 0x380]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x1c], ecx
call fcn.00409d90
xor edi, edi
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + 0x368], 0x42f484
mov dword [esp + 0x36c], edi
mov dword [esp + 0x370], edi
push edi
push ebx
mov eax, esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x390], edi
call fcn.00409f10
test al, al
je 0x40ef16
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40eee6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x40eee6
xor esi, esi
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x374], esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40ef5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x40ef5c
xor eax, eax
jmp 0x40ef5e
mov ecx, ebx
call fcn.00404cf0
push 0x42b974
push 0x42b32c
mov edx, eax
call fcn.00408980
mov dword [esp + 0x390], 0xffffffff
add esp, 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00409e50
xor al, al
jmp 0x40efb0
mov eax, esi
mov edi, dword [esp + 0x18]
push eax
mov dword [edi + 8], eax
call fcn.00416092
mov edx, dword [edi + 8]
add esp, 4
push edx
push eax
push ebx
lea ecx, [esp + 0x374]
mov dword [edi + 4], eax
call fcn.00411bf0
test al, al
je 0x40ef16
mov dword [esp + 0x388], 0xffffffff
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00409e50
mov al, 1
mov ecx, dword [esp + 0x380]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x368]
xor ecx, esp
call fcn.00415c3e
mov esp, ebp
pop ebp
ret 8
Function at 0x40fd40
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x40fdc5
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
push ebx
lea ebx, [ebx]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x40fd60
pop ebx
test edi, edi
jle 0x40fe25
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
inc ecx
shl al, 4
cmp edi, 1
jle 0x40fded
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
cmp edi, 2
jge 0x40fe0f
mov eax, 0x3d
mov byte [ecx], al
inc ecx
mov byte [ecx], al
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret
movzx eax, byte [esi + 1]
and eax, 0xf
movsx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret
Function at 0x410db0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, ebx
call fcn.00410880
test eax, eax
jl 0x410fe8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x410e1d
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x410de0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x410fe4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x42bfa0]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x42bfa0]
and esi, 0xff
mov esi, dword [esi*4 + 0x42cba0]
and edi, 0xff
xor esi, dword [edi*4 + 0x42d3a0]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x42bfa0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x42d7a0]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x42bfa0]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x42cfa0]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x42bfa0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x42bfa0]
and esi, 0xff
mov esi, dword [esi*4 + 0x42cba0]
and edi, 0xff
xor esi, dword [edi*4 + 0x42d3a0]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x42bfa0]
and edi, 0xff
xor esi, dword [edi*4 + 0x42cfa0]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x42bfa0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x42d7a0]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x42bfa0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x42bfa0]
and esi, 0xff
mov esi, dword [esi*4 + 0x42cba0]
and edi, 0xff
xor esi, dword [edi*4 + 0x42d3a0]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x42bfa0]
and edi, 0xff
xor esi, dword [edi*4 + 0x42cfa0]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x42bfa0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x42d7a0]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x42bfa0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x42bfa0]
and esi, 0xff
mov esi, dword [esi*4 + 0x42cba0]
and edi, 0xff
xor esi, dword [edi*4 + 0x42d3a0]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x42bfa0]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x42bfa0]
and edi, 0xff
xor esi, dword [edi*4 + 0x42cfa0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x42d7a0]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x410e31
pop edi
xor eax, eax
pop esi
ret
Function at 0x411b30
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
push ebx
push esi
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x411b42
mov esi, 0x43677c
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0040fe30
add esp, 4
lea ebx, [esp + 8]
mov eax, esi
call fcn.004100d0
mov eax, esi
pop esi
pop ebx
add esp, 0x5c
ret
Function at 0x413060
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x426e88
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4334ac]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x30]
mov al, byte [esp + 0x2c]
mov edi, dword [esp + 0x28]
push str.Local_sgime_user_lock_proc
mov dword [esi + 4], ecx
push edi
mov ecx, 0x435780
mov byte [esi], al
call fcn.0040eca0
test al, al
jne 0x4130d0
push 0x42857c
push edi
call fcn.00404da0
add esp, 8
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
push str.Local_sgime_user_lock
push edi
mov ecx, 0x4359b0
call fcn.00406430
test al, al
je 0x4130ad
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.00406300
mov dword [esp + 0x10], vtable.UserManager::t_locker.0
push 0x4359b0
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
call fcn.00406340
test al, al
jne 0x41314c
push 0x42857c
push edi
call fcn.00404da0
add esp, 8
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.00406320
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
cmp byte [esi + 0xa70], 0
jne 0x4131d0
call fcn.00403a50
mov ecx, eax
call fcn.00401ce0
test al, al
jne 0x41319e
push edi
call fcn.00403a50
mov ecx, eax
call fcn.00401d10
test al, al
jne 0x41319e
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00406320
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
mov ecx, esi
call fcn.00412450
push 1
lea edx, [esp + 0x14]
push edx
push edi
mov ecx, esi
call fcn.00412dd0
test al, al
je 0x413176
lea eax, [esp + 0x10]
push eax
push edi
mov ecx, esi
call fcn.00412bc0
test al, al
je 0x413176
mov byte [esi + 0xa70], 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00406320
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc

Function at 0x415c3e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4334ac]
jne 0x415c48
repz ret
jmp fcn.00419e1d
Function at 0x42311a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041b5a1
and dword [ebp - 4], 0
cmp dword [0x436714], 0
mov ebx, eax
jne 0x4231cb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42327c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42327c
push eax
call fcn.0041b52f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x436714], eax
call esi
push eax
call fcn.0041b52f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x436718], eax
call esi
push eax
call fcn.0041b52f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43671c], eax
call esi
push eax
call fcn.0041b52f
pop ecx
mov dword [0x436724], eax
test eax, eax
je 0x4231cb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041b52f
pop ecx
mov dword [0x436720], eax
mov eax, dword [0x436720]
cmp eax, ebx
je 0x423223
cmp dword [0x436724], ebx
je 0x423223
push eax
call fcn.0041b5aa
push dword [0x436724]
mov esi, eax
call fcn.0041b5aa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x423223
test edi, edi
je 0x423223
call esi
test eax, eax
je 0x42321a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42321a
test byte [ebp - 0xc], 1
jne 0x423223
or dword [ebp + 0x10], 0x200000
jmp 0x42325c
mov eax, dword [0x436718]
cmp eax, ebx
je 0x42325c
push eax
call fcn.0041b5aa
pop ecx
test eax, eax
je 0x42325c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42325c
mov eax, dword [0x43671c]
cmp eax, ebx
je 0x42325c
push eax
call fcn.0041b5aa
pop ecx
test eax, eax
je 0x42325c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x436714]
call fcn.0041b5aa
pop ecx
test eax, eax
je 0x42327c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42327e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100052f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007aa70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.100700db
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.10005d80
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x10005344
jmp dword [ecx*4 + 0x100054ac]
mov al, byte [esi]
test al, al
je 0x10005372
cmp al, 0x20
je 0x1000535e
cmp al, 0xa1
jne 0x10005372
cmp byte [esi + 1], al
jne 0x10005372
test al, 0x80
je 0x1000536a
mov al, byte [esi + 1]
inc esi
test al, al
je 0x10005372
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10005351
test ecx, ecx
je case.default.0x10005344
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x10005344
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x100053b8
cmp dl, 0xa1
jne 0x100053ac
cmp byte [eax + 1], 0xa1
jne 0x100053ac
test ecx, ecx
jne 0x100053a4
mov edi, eax
mov ecx, 1
inc eax
jmp 0x100053cc
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x100053e6
jmp 0x100053cc
cmp dl, 0x20
jne 0x100053ca
test ecx, ecx
jne 0x100053c3
mov edi, eax
mov ecx, 1
jmp 0x100053cc
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x1000538c
cmp ecx, 1
jne case.default.0x10005344
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10005344
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10005344
mov al, byte [esi]
test al, al
je 0x1000543e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x10005424
mov cl, byte [esi + 1]
test cl, cl
je 0x1000543e
cmp al, 0xa1
jne 0x10005414
cmp cl, al
je 0x10005421
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.10006050
inc esi
jmp 0x10005436
cmp al, 0x20
je 0x10005436
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10006090
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x100053fd
push 0
lea ecx, [esp + 0x14]
call fcn.10006090
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1000f1b0
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x10005471
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x10080ad8
call fcn.10005f80
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1007006d
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x10009c70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x1007addb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.1006fde2
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x10009cf2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.1006dcf4
mov eax, dword [eax]
push 0x10095c30
push eax
call fcn.10060934
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.1007006d
test bl, bl
je 0x10009cf2
push 0x10095c30
lea ecx, [esp + 0xc]
call fcn.100703fd
push 0x10095c3c
lea ecx, [esp + 0xc]
call fcn.100703fd
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x10009d2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.1007006d
jmp 0x10009df9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x10009db2
lea edx, [esp + 0x7c]
push 0x10095c38
push edx
call fcn.10060934
add esp, 8
test eax, eax
je 0x10009db2
lea eax, [esp + 0x7c]
push 0x10095c34
push eax
call fcn.10060934
add esp, 8
test eax, eax
je 0x10009db2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10009d42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.1007006d
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x1000a600
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1000a662
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x1000a670
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x1007ae5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x1009f558]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x1000a7a8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x1000a6d6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.1007006d
xor eax, eax
jmp 0x1000a81f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.100701aa
push esi
lea ecx, [esp + 0xc]
call fcn.10070439
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x1000a7fd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.1000a600
test eax, eax
jne 0x1000a7fd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.1000a600
test eax, eax
jne 0x1000a7fd
lea eax, [esp + 0x14]
push 0x10095c4c
push eax
call fcn.100619b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000a7dc
lea ecx, [esp + 0x14]
push 0x10095c48
push ecx
call fcn.10061930
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000a7dc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x1000a7df
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.1007015a
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1000a6ee
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.1007006d
xor eax, eax
jmp 0x1000a81f
mov byte [esi], 0
push 0x10095c44
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.1007006d
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4