joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430e80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x24000]
push edi
jmp 0x430e9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x430ea1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x430e90
mov eax, 1
add ebx, ebx
jne 0x430eb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x430ea8
jne 0x430ec4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x430ea8
xor ecx, ecx
sub eax, 3
jb 0x430ed8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x430f4a
mov ebp, eax
add ebx, ebx
jne 0x430ee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x430ef0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x430f14
inc ecx
add ebx, ebx
jne 0x430f00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x430ef5
jne 0x430f11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x430ef5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x430f34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x430f25
jmp 0x430e96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x430f34
add edi, ecx
jmp 0x430e96
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x430f52
cmp byte [edi], 9
jne 0x430f52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x430f57
lea edi, [esi + 0x2e000]
mov eax, dword [edi]
or eax, eax
je 0x430fcf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x43f1c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x43ffc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x430f84
mov ecx, edi
jns 0x430fb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x44004]
or eax, eax
je 0x430fc9
mov dword [ebx], eax
add ebx, 4
jmp 0x430fa1
call dword [esi + 0x44000]
mov ebp, dword [esi + 0x44008]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x431003
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x402590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc74
push edi
push esi
push ebx
push 0x1f450e
push 1
push 0
call fcn.00408eac
mov dword [0x1fb8e2], eax
call fcn.00408f0c
or eax, eax
jne 0x402690
push dword [0x1fb8e2]
call fcn.00408e8e
push 0x12c
lea eax, [ebp - 0x384]
push eax
push dword [0x1fb8de]
call fcn.00408f18
push 0x12c
lea eax, [ebp - 0x12c]
push eax
call fcn.00408f2a
lea ecx, [ebp - 0x12c]
cmp byte [eax + ecx - 1], 0x5c
je 0x402602
mov word [eax + ecx], 0x5c
lea eax, [ebp - 0x12c]
push eax
push 0x1f4777
lea eax, [ebp - 0x258]
push eax
call fcn.00408e82
add esp, 0xc
lea eax, [ebp - 0x38c]
push eax
lea eax, [ebp - 0x388]
push eax
lea eax, [ebp - 0x384]
push eax
call fcn.00402760
mov edi, dword [ebp - 0x388]
cmp word [edi], 0x5a4d
jne 0x402655
add edi, dword [edi + 0x3c]
cmp dword [edi], 0x4550
jne 0x402655
xor word [edi + 0x16], 0x2000
push dword [ebp - 0x38c]
push dword [ebp - 0x388]
lea eax, [ebp - 0x258]
push eax
call fcn.004026b0
cmp eax, 0xffffffff
je 0x40267e
lea eax, [ebp - 0x258]
push eax
call fcn.00402710
push 0x8000
push 0
push dword [ebp - 0x388]
call fcn.00408fc0
push dword [0x1fb8e2]
call fcn.00408e8e
xor eax, eax
pop ebx
pop esi
pop edi
leave
ret

Function at 0x4027f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb40
push edi
push esi
push ebx
push 0x1f4788
push 0
push 4
call fcn.00408f72
or eax, eax
je 0x402868
mov dword [ebp - 0x4bc], eax
push 0
push 0
push 0
push 4
push dword [ebp - 0x4bc]
call fcn.00408f6c
mov dword [ebp - 0x4c0], eax
mov ecx, dword [eax]
mov dword [ebp - 0x4b8], ecx
add eax, 4
mov edi, eax
push 0x40
push 0x1000
push dword [ebp - 0x4b8]
push 0
call fcn.00408fba
mov dword [ebp - 0x4b4], eax
push dword [ebp - 0x4b8]
push edi
push dword [ebp - 0x4b4]
call fcn.0040e36f
jmp 0x402895
push 0x258
lea eax, [ebp - 0x4b0]
push eax
push 0
call fcn.00408f18
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.00402760
mov edi, dword [ebp - 0x4b4]
cmp word [edi], 0x5a4d
jne 0x4028b3
add edi, dword [edi + 0x3c]
cmp dword [edi], 0x4550
jne 0x4028b3
or word [edi + 0x16], 0x2000
mov edi, dword [ebp - 0x4b4]
mov esi, edi
add esi, dword [esi + 0x3c]
mov ebx, dword [esi + 0x34]
lea esi, [esi + 0x78]
mov eax, dword [esi]
push eax
push edi
call fcn.00402930
add eax, edi
mov eax, dword [eax + 0xc]
push eax
push edi
call fcn.00402930
add edi, eax
push edi
call fcn.00408ff6
push eax
push 0
push edi
call fcn.0040e3a0
push dword [ebp + 8]
push edi
call fcn.00408fea
push dword [ebp + 0xc]
call fcn.004029a0
push dword [ebp - 0x4b8]
push dword [ebp - 0x4b4]
push dword [ebp + 0xc]
call fcn.004026b0
push 0x8000
push 0
push dword [ebp - 0x4b4]
call fcn.00408fc0
pop ebx
pop esi
pop edi
leave
ret 8
Function at 0x402930
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x3c]
add esi, ecx
movzx eax, word [esi + 6]
mov dword [ebp - 8], eax
add esi, 0xf8
mov ebx, esi
add ebx, 0x28
jmp 0x402985
mov ecx, dword [esi + 0xc]
mov eax, dword [ebx + 0xc]
cmp edi, ecx
jb 0x40296c
cmp edi, eax
jae 0x40296c
sub edi, dword [esi + 0xc]
add edi, dword [esi + 0x14]
jmp 0x40298b
cmp edi, ecx
jbe 0x40297c
cmp edi, eax
ja 0x40297c
sub edi, dword [ebx + 0xc]
add edi, dword [ebx + 0x14]
jmp 0x40298b
add ebx, 0x28
add esi, 0x28
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x402956
mov dword [ebp - 4], edi
popal
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x403624
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
pushal
mov eax, 0x3020100
mov ecx, 0x40
sub esp, 0x200
lea ebx, [esp]
push ebp
push edi
mov edx, ebx
mov dword [edx], eax
add edx, 4
add eax, 0x4040404
loop 0x40363c
push esi
shr esi, 1
push esi
shl esi, 2
push esi
shl esi, 1
push esi
xor esi, esi
xor edi, edi
xor eax, eax
xor edx, edx
lea ebp, [esp]
add al, byte [esi + ebp]
mov dl, byte [eax + ebx]
mov cl, byte [edi + ebx]
mov byte [eax + ebx], cl
mov byte [edi + ebx], dl
inc edi
inc esi
cmp esi, 0x10
jne 0x403676
xor esi, esi
cmp edi, 0x100
jb 0x40365e
add esp, 0x10
pop edi
pop ebp
inc cl
mov al, byte [ecx + ebx]
mov dl, byte [eax + ebx]
mov byte [edx + ebx], al
mov byte [eax + ebx], dl
xor byte [edi], al
inc edi
dec ebp
jne 0x403683
add esp, 0x200
popal
ret
Function at 0x408920
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [0x1fb8de], edi
add ebp, 4
mov ebx, 0xffffffff
push 0x400
push edi
call fcn.00408f4e
or eax, eax
jne 0x408969
cmp word [edi], 0x5a4d
jne 0x408969
add edi, dword [edi + 0x3c]
cmp dword [edi], 0x4550
jne 0x408969
movzx ecx, word [edi + 0x16]
test ecx, 0x2000
je 0x408969
xor ebx, ebx
or ebx, ebx
jne 0x40898a
call fcn.00402520
cmp esi, 1
jne 0x408983
mov eax, 1
pop ebx
pop esi
pop edi
leave
ret 0xc
pop ebx
pop esi
pop edi
leave
ret 0xc
sub ebp, 4
pop ebx
pop esi
pop edi
leave
ret 0xc

Function at 0x409d44
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov dword [edx], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x40ca5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x20], 0xfe
mov byte [ebp - 0x1f], 0xdc
mov byte [ebp - 0x1e], 0xba
mov byte [ebp - 0x1d], 0x98
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x54
mov byte [ebp - 0x1a], 0x32
mov byte [ebp - 0x19], 0x10
mov byte [ebp - 0x18], 0xa3
mov byte [ebp - 0x17], 0x9d
mov byte [ebp - 0x16], 0x4a
mov byte [ebp - 0x15], 0x18
mov byte [ebp - 0x14], 0xf8
mov byte [ebp - 0x13], 0x5b
mov byte [ebp - 0x12], 0x4a
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], 0xfe
mov byte [ebp - 0xf], 0xdc
mov byte [ebp - 0xe], 0xba
mov byte [ebp - 0xd], 0x98
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0xb], 0x54
mov byte [ebp - 0xa], 0x32
mov byte [ebp - 9], 0x10
mov byte [ebp - 8], 0xa3
mov byte [ebp - 7], 0x3d
mov byte [ebp - 6], 0x4a
mov byte [ebp - 5], 0x18
mov byte [ebp - 4], 0xf8
mov byte [ebp - 3], 0x5b
mov byte [ebp - 2], 0x4a
mov byte [ebp - 1], 0x52
push 0
mov dl, 2
lea ecx, [ebp - 0x48]
call fcn.0040cb2c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x33], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x2f], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x2b], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x27], eax
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp + 0xc]
shl edx, 3
push edx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x4c]
lea ecx, [ebp - 0x48]
call fcn.0040cbaf
mov esp, ebp
pop ebp
ret 8
Function at 0x40df80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
and eax, 0xff
cmp eax, 1
je 0x40dfaa
mov eax, 0xfffffff7
jmp 0x40e0d5
mov dword [ebp - 0xc], 0xffffffff
mov ecx, dword [ebp - 0xc]
shr ecx, 0x11
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x7fff
je 0x40dfcd
mov eax, 0xfffffff5
jmp 0x40e0d5
mov dword [ebp - 0x10], 0
jmp 0x40dfdf
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
shl eax, 5
cmp eax, dword [ebp - 0x14]
jge 0x40dff9
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [edx + ecx*4], 0
jmp 0x40dfd6
mov dword [ebp - 0x10], 0
jmp 0x40e00b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
shl ecx, 2
cmp ecx, dword [ebp - 0x14]
jge 0x40e0d3
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ebp - 8], al
cmp dword [ebp + 0xc], 0
je 0x40e036
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 8]
mov byte [ecx], dl
movsx eax, byte [ebp - 8]
cmp eax, 0x30
jl 0x40e054
movsx ecx, byte [ebp - 8]
cmp ecx, 0x39
jg 0x40e054
movsx edx, byte [ebp - 8]
sub edx, 0x30
mov dword [ebp - 4], edx
jmp 0x40e097
movsx eax, byte [ebp - 8]
cmp eax, 0x61
jl 0x40e072
movsx ecx, byte [ebp - 8]
cmp ecx, 0x66
jg 0x40e072
movsx edx, byte [ebp - 8]
sub edx, 0x57
mov dword [ebp - 4], edx
jmp 0x40e097
movsx eax, byte [ebp - 8]
cmp eax, 0x41
jl 0x40e090
movsx ecx, byte [ebp - 8]
cmp ecx, 0x46
jg 0x40e090
movsx edx, byte [ebp - 8]
sub edx, 0x37
mov dword [ebp - 4], edx
jmp 0x40e097
mov eax, 0xfffffffe
jmp 0x40e0d5
mov eax, dword [ebp - 0x10]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov ecx, dword [ebp - 0x10]
xor ecx, 1
and ecx, 7
shl ecx, 2
mov edx, dword [ebp - 4]
shl edx, cl
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + eax*4]
or ecx, edx
mov eax, dword [ebp - 0x10]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], ecx
jmp 0x40e002
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4120a8
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
mov eax, dword [ebp + 0x10]
shl eax, 3
mov dword [ebp - 4], eax
mov dword [0x1fae18], 0x67452301
mov dword [0x1fae1c], 0xefcdab89
mov dword [0x1fae20], 0x98badcfe
mov dword [0x1fae24], 0x10325476
cmp dword [ebp + 0x10], 0x40
jle 0x412115
push dword [ebp + 0xc]
lea edx, [ebp - 0xc8]
push edx
call fcn.004122b5
add esp, 8
lea ecx, [ebp - 0xc8]
push ecx
call fcn.0041230e
pop ecx
add dword [ebp + 0xc], 0x40
sub dword [ebp + 0x10], 0x40
cmp dword [ebp + 0x10], 0x40
jg 0x4120e8
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov byte [edx + ebp - 0x88], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x80
jl 0x41211a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x88]
push eax
call fcn.0040e36f
mov eax, dword [ebp + 0x10]
mov byte [eax + ebp - 0x88], 0x80
cmp dword [ebp + 0x10], 0x37
jg 0x412188
push dword [ebp - 4]
lea edx, [ebp - 0x50]
push edx
call fcn.0041227a
add esp, 8
lea ecx, [ebp - 0x88]
push ecx
lea eax, [ebp - 0xc8]
push eax
call fcn.004122b5
add esp, 8
lea edx, [ebp - 0xc8]
push edx
call fcn.0041230e
pop ecx
jmp 0x4121da
push dword [ebp - 4]
lea ecx, [ebp - 0x10]
push ecx
call fcn.0041227a
add esp, 8
lea eax, [ebp - 0x88]
push eax
lea edx, [ebp - 0xc8]
push edx
call fcn.004122b5
add esp, 8
lea ecx, [ebp - 0xc8]
push ecx
call fcn.0041230e
pop ecx
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0xc8]
push edx
call fcn.004122b5
add esp, 8
lea ecx, [ebp - 0xc8]
push ecx
call fcn.0041230e
pop ecx
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov byte [edx + ebp - 0x88], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x80
jl 0x4121df
lea ecx, [ebp - 0x88]
push ecx
lea eax, [ebp - 0xc8]
push eax
call fcn.004122b5
add esp, 8
push dword [0x1fae18]
push dword [ebp + 8]
call fcn.0041227a
add esp, 8
push dword [0x1fae1c]
mov edx, dword [ebp + 8]
add edx, 4
push edx
call fcn.0041227a
add esp, 8
push dword [0x1fae20]
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
call fcn.0041227a
add esp, 8
push dword [0x1fae24]
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
call fcn.0041227a
add esp, 8
xor edx, edx
mov dword [0x1fae24], edx
mov dword [0x1fae20], edx
mov dword [0x1fae1c], edx
mov dword [0x1fae18], edx
mov esp, ebp
pop ebp
ret
Function at 0x4e3d80
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5cde5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.005bd580
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4e3e02
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.005ba1f1
mov eax, dword [eax]
push 0xdaee60
push eax
call fcn.005ab794
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.005bd80b
test bl, bl
je 0x4e3e02
push 0xdaee60
lea ecx, [esp + 0xc]
call fcn.005bdb9b
push 0xdaee6c
lea ecx, [esp + 0xc]
call fcn.005bdb9b
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4e3e3e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.005bd80b
jmp 0x4e3f09
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4e3ec2
lea edx, [esp + 0x7c]
push 0xdaee68
push edx
call fcn.005ab794
add esp, 8
test eax, eax
je 0x4e3ec2
lea eax, [esp + 0x7c]
push 0xdaee64
push eax
call fcn.005ab794
add esp, 8
test eax, eax
je 0x4e3ec2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4e3e52
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.005bd80b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4e4bb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4e4c12
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4e4c20
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5cdf1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0xdcbf84]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4e4d58
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4e4c86
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005bd80b
xor eax, eax
jmp 0x4e4dcf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.005bd948
push esi
lea ecx, [esp + 0xc]
call fcn.005bdbd7
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0xdaeea8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4e4dad
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.004e4bb0
test eax, eax
jne 0x4e4dad
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.004e4bb0
test eax, eax
jne 0x4e4dad
lea eax, [esp + 0x14]
push 0xdaee84
push eax
call fcn.005aca30
mov esi, eax
add esp, 8
test esi, esi
jne 0x4e4d8c
lea ecx, [esp + 0x14]
push 0xdaee80
push ecx
call fcn.005ac9b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4e4d8c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4e4d8f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.005bd8f8
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4e4c9e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005bd80b
xor eax, eax
jmp 0x4e4dcf
mov byte [esi], 0
push 0xdaee7c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.005bd80b
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x4ed1aa
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5cea18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.005beefa
xor ebp, ebp
mov dword [esi], 0xd866a4
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x40], ebp
lea edi, [esi + 0x44]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x14], edi
lea ecx, [edi + 0x18]
mov dword [edi], 0xd852fc
call fcn.004d8220
lea ecx, [edi + 0x30]
mov byte [esp + 0x38], 1
call fcn.005bc444
lea ebx, [edi + 0x44]
mov ecx, ebx
call fcn.004d8220
mov dword [ebx], 0xd8602c
mov dword [edi], 0xd865bc
mov dword [esi + 0xa0], ebp
mov dword [esi + 0x9c], 0xd85488
lea ecx, [esi + 0xb0]
call fcn.004d8220
lea edi, [esi + 0xc8]
mov dword [edi + 4], ebp
mov dword [edi], 0xd86698
mov byte [esp + 0x38], 5
mov dword [esi], 0xd865c4
mov dword [esi + 0xac], ebp
call fcn.005c8643
mov eax, dword [eax + 0xc]
push 0x40e
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
mov ecx, edi
call fcn.005c47ea
mov ecx, dword [esi + 0xcc]
lea eax, [esp + 0x18]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [esp + 0x1c]
mov eax, 0x55555556
imul ecx
mov ecx, dword [esp + 0x20]
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esi + 0xd4], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0xd0], edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x4ed340
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5ceaa5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0xd865c4
mov dword [esp + 0x18], 0
lea ecx, [esi + 0xc8]
mov dword [esp + 0xc], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x18], 4
call fcn.005c4841
lea ecx, [esi + 0xb0]
mov byte [esp + 0x18], 2
mov dword [ecx], 0xd852f0
call fcn.004d8420
lea ecx, [esi + 0x9c]
mov dword [esp + 0xc], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x18], 5
call fcn.005c4841
lea edi, [esi + 0x44]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x44]
mov byte [esp + 0x18], 7
mov dword [ecx], 0xd852f0
call fcn.004d8420
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 6
call fcn.005bc477
lea ecx, [edi + 0x18]
mov byte [esp + 0x18], 0
mov dword [ecx], 0xd852f0
call fcn.004d8420
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.005c655a
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4f77d6
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
mov eax, dword [esi + 0x3a0]
test eax, eax
jne 0x4f77fe
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x3a0], eax
pop esi
add esp, 0x190
ret