joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44444c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x240], 0
je 0x444468
cmp dword [esi + 4], 0
je 0x444495
test byte [ebx + 0x55], 1
jne 0x444487
mov eax, ebx
call fcn.00442834
test eax, eax
jne 0x444487
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4445a5
mov edx, esi
mov eax, ebx
call fcn.00443e54
jmp 0x4445a5
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44459e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004464a4
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0043fc5c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0044444c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004464a4
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4445a5
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b828
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x5220a4]
cmp byte [eax + 0xc], 0
je 0x44b995
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44b98e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x526574], 0
jne 0x44b87c
push 0x44b99c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44b9a4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x526574], eax
cmp dword [0x468620], 0
jne 0x44b977
push 0x44b9b4
call sub.kernel32.dll_LoadLibraryA
mov dword [0x468620], eax
cmp dword [0x468620], 0
je 0x44b977
push 0x44b9c0
mov eax, dword [0x468620]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x526578], eax
push 0x44b9d0
mov eax, dword [0x468620]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52657c], eax
push 0x44b9e4
mov eax, dword [0x468620]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x526580], eax
push 0x44b9fc
mov eax, dword [0x468620]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x526584], eax
push 0x44ba14
mov eax, dword [0x468620]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x526588], eax
push 0x44ba28
mov eax, dword [0x468620]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52658c], eax
push 0x44ba40
mov eax, dword [0x468620]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x526590], eax
push 0x44ba58
mov eax, dword [0x468620]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x526594], eax
push 0x44ba74
mov eax, dword [0x468620]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x526598], eax
push 0x44ba80
mov eax, dword [0x468620]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52659c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b995
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x451004
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x451058]
test si, 4
je 0x451019
or bl, 1
test si, 8
je 0x451023
or bl, 4
test si, 1
je 0x45102d
or bl, 8
test si, 2
je 0x451037
or bl, 0x10
test si, 0x10
je 0x451041
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x451050
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45105c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x451098]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x451076
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x451085
or bl, 4
test esi, 0x20000000
je 0x451090
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x45874c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45875e
add esp, 0xfffffff0
call fcn.00403bf4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d8b8
mov eax, dword [0x521d54]
mov dword [eax + 4], ebx
mov dword [eax], 0x458af0
mov eax, dword [0x521d60]
mov dword [eax + 4], ebx
mov dword [eax], 0x458afc
mov eax, ebx
call fcn.00458b08
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4155f0]
call fcn.004038a0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4155f0]
call fcn.004038a0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4155f0]
call fcn.004038a0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4155f0]
call fcn.004038a0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4155f0]
call fcn.004038a0
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4545a0
push eax
push 0
push 0
mov eax, dword [0x521eb0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4213dc]
call fcn.00422c30
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4213dc]
call fcn.00422c30
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4213dc]
call fcn.00422c30
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00458f38
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458e08
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458e08
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458e08
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45889b
call fcn.00403c4c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x458bec
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x458d97
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x458d78
mov dl, 1
mov eax, dword [0x415a14]
call fcn.004038a0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404718
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x458d67
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044bb84
test al, al
je 0x458d5a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x458da8
lea eax, [ebp - 0x254]
call fcn.004096fc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x458d5a
xor eax, eax
push ebp
push 0x458d53
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x458de0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x458d3c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404988
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x458d3c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404988
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458d5a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x458c5d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.004196f4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458d9e
lea eax, [ebp - 0x260]
call fcn.00404718
ret

Function at 0x459710
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5265ac]
cmp byte [eax + 0xad], 0
jne 0x459781
cmp dword [0x5265c4], 0
jne 0x459742
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4596cc
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x5265c4], eax
cmp dword [0x5265c0], 0
jne 0x45975d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x5265c0], eax
cmp dword [0x5265c8], 0
jne 0x459781
push esp
push 0
push 0
push 0x459670
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x5265c8], eax
pop edx
ret
Function at 0x459954
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45996b
add esp, 0xfffffff0
call fcn.00403bf4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d8b8
mov eax, dword [0x521e9c]
cmp word [eax + 2], 0
jne 0x459993
mov eax, dword [0x521e9c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b404
mov eax, dword [0x521f44]
cmp word [eax + 2], 0
jne 0x4599ad
mov eax, dword [0x521f44]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b610
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4155f0]
call fcn.004038a0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4155f0]
call fcn.004038a0
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x4155f0]
call fcn.004038a0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x421eec]
call fcn.00429518
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x459b64
mov eax, dword [0x521dbc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004298ec
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45bcd0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x521dbc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cf28
test eax, eax
je 0x459ab4
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004090a0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cf5c
test eax, eax
je 0x459ac8
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404988
mov byte [ebx + 0xd4], 0
push ebx
push 0x45af64
call fcn.0041ea34
mov dword [ebx + 0xc8], eax
mov eax, dword [0x521ca8]
cmp byte [eax], 0
jne 0x459b19
mov eax, ebx
call fcn.00459ca8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045beac
mov eax, ebx
call fcn.0045ca0c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x459b59
call fcn.00403c4c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459f28
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x5265ac]
cmp dword [eax + 0x30], 0
je 0x459fd2
cmp dword [ebx + 0x94], 0
jne 0x459fcc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x459eb8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x459fcc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x459f92
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x459fcc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041799c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x459fa1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45acec
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45ad21
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404808
jmp 0x45ad2e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040476c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45c090
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45c0fe
mov eax, esi
call fcn.00446844
test al, al
je 0x45c0fe
mov eax, dword [ebx + 0x84]
call fcn.004464a4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45c0fe
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45c0f2
push 0
mov eax, dword [ebx + 0x84]
call fcn.004464a4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043e8d0
jmp 0x45c0fe
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045becc
pop esi
pop ebx
ret
Function at 0x45da40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bcc
xor eax, eax
push ebp
push 0x45db3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0x20
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x415c14]
call fcn.00419ccc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45db1d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebp - 0xe], 0x5a4d
je 0x45daa8
call fcn.004041f0
jmp 0x45db24
xor ecx, ecx
mov edx, 0x3c
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
movzx edx, word [ebp - 0xe]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebp - 0xe], 0x4550
je 0x45daf9
cmp word [ebp - 0xe], 0x454e
je 0x45daf9
xor eax, eax
jmp 0x45dafb
mov al, 1
mov byte [ebp - 5], al
cmp word [ebp - 0xe], 0x4550
sete byte [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45db24
mov eax, dword [ebp - 0xc]
call fcn.004038d0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45db41
lea eax, [ebp - 4]
call fcn.00404718
ret

Function at 0x45f874
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bcc
mov eax, dword [ebp - 8]
call fcn.00404bcc
xor eax, eax
push ebp
push 0x45f943
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404bdc
push eax
call sub.kernel32.dll_LoadLibraryExA_1
test eax, eax
mov eax, dword [ebp - 4]
call fcn.00404bdc
push eax
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [0x5265f0], eax
cmp dword [0x5265f0], 0
je 0x45f91d
mov eax, dword [ebp - 8]
call fcn.00404bdc
push eax
mov eax, dword [0x5265f0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5265f4], eax
push 0x526604
push 0x40
push 0x22233f4
push 0x5265f4
call sub.kernel32.dll_VirtualProtect
mov edx, 0x5265f4
mov eax, sub.kernel32.dll_GetCPInfo
mov ecx, 4
call fcn.0045f868
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushFileBuffers
mov eax, dword [0x5265f0]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f94a
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040473c
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4092f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x468cab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045d510
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x409372
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045b2bd
mov eax, dword [eax]
push 0x48a1d0
push eax
call fcn.0044d744
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045d79b
test bl, bl
je 0x409372
push 0x48a1d0
lea ecx, [esp + 0xc]
call fcn.0045db2b
push 0x48dd4c
lea ecx, [esp + 0xc]
call fcn.0045db2b
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4093ae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045d79b
jmp 0x409479
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x409432
lea edx, [esp + 0x7c]
push 0x48dd48
push edx
call fcn.0044d744
add esp, 8
test eax, eax
je 0x409432
lea eax, [esp + 0x7c]
push 0x48dd44
push eax
call fcn.0044d744
add esp, 8
test eax, eax
je 0x409432
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4093c2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045d79b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x409c70
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x409cd2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x409ce0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x468d2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4946c8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x409e18
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x409d46
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045d79b
xor eax, eax
jmp 0x409e8f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045d8d8
push esi
lea ecx, [esp + 0xc]
call fcn.0045db67
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x409e6d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00409c70
test eax, eax
jne 0x409e6d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00409c70
test eax, eax
jne 0x409e6d
lea eax, [esp + 0x14]
push 0x48dd60
push eax
call fcn.0044e780
mov esi, eax
add esp, 8
test esi, esi
jne 0x409e4c
lea ecx, [esp + 0x14]
push 0x48dd5c
push ecx
call fcn.0044e700
mov esi, eax
add esp, 8
test esi, esi
jne 0x409e4c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x409e4f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045d888
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x409d5e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045d79b
xor eax, eax
jmp 0x409e8f
mov byte [esi], 0
push 0x48dd58
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045d79b
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4