joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4168d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x416a96
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x421d80]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x416a96
test cl, 0x48
je 0x416936
mov al, byte [eax + 5]
cmp al, 0xa
je 0x416936
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416988
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x416970
call fcn.0040a8d3
mov dword [eax], 9
call fcn.0040a8dc
mov dword [eax], esi
jmp 0x416980
cmp eax, 0x6d
je 0x416a96
push eax
call fcn.0040a8e5
pop ecx
or eax, 0xffffffff
jmp 0x416a98
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x416a91
test edx, edx
je 0x4169ab
cmp byte [ebx], 0xa
jne 0x4169ab
or al, 4
jmp 0x4169ad
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x416a8b
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x416a7b
cmp al, 0xd
je 0x4169e1
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x416a6d
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x4169fb
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x4169f6
add dword [ebp + 0x10], 2
jmp 0x416a4f
mov dword [ebp + 0x10], eax
jmp 0x416a69
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416a23
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x416a69
cmp dword [ebp - 0xc], 0
je 0x416a69
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x416a44
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x416a4f
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x416a6c
cmp ebx, dword [ebp + 0xc]
jne 0x416a54
cmp byte [ebp - 1], 0xa
jne 0x416a54
mov byte [ebx], 0xa
jmp 0x416a6c
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041475c
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x416a6d
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x4169c5
jmp 0x416a8b
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x416a8b
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x416a98
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4051d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x40520d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x405216
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405220
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405241
mov al, byte [esp]
jmp 0x405243
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069b4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4069fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406950
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a03
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c04
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406c92
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c4f
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406c7c
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c63
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c72
lea edx, [ebp - 4]
call fcn.00406ac8
test ebx, ebx
je 0x406c72
dec ebx
jmp 0x406c54
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c99
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406ca0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404da8
add esp, 0x104
pop ebx
ret
Function at 0x406de8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406f20
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406f0a
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406e45
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f0a
cmp dword [ebp - 0x10], 0
jne 0x406e5a
mov eax, dword [ebp - 8]
call fcn.00403198
mov bl, 1
jmp 0x406f0a
cmp dword [ebp - 0x10], 0x70000000
jb 0x406e68
call fcn.0040584c
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.00403278
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00403420
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406e0e
test eax, eax
jne 0x406f0a
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406eb8
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f0a
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
jmp 0x406ec3
dec esi
test esi, esi
je 0x406ed1
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x406ec2
cmp dword [ebp - 0xc], 7
jne 0x406edc
test esi, esi
je 0x406edc
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004034f0
cmp dword [ebp - 0xc], 7
jne 0x406efd
test esi, esi
je 0x406efd
lea eax, [ebp - 0x14]
call fcn.00403420
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406f27
lea eax, [ebp - 0x14]
call fcn.00403198
ret

Function at 0x407868
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407884
shr eax, 1
xor eax, 0xedb88320
jmp 0x407886
shr eax, 1
dec edx
jne 0x407877
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407870
pop esi
ret

Function at 0x40789c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078bf
call fcn.00407868
push 1
push 0x40c558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4078ea
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078c5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x408f94
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f48
test al, al
jne 0x408fb5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409001
xor eax, eax
push ebp
push 0x408ff1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ff8
lea eax, [ebp - 0xc]
call fcn.00408f84
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409308
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4093f7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406ccc
mov edx, dword [ebp - 8]
mov ecx, 0x409410
xor eax, eax
call fcn.004091fc
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093c5
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409328
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408db0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c5c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0040725c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408d80
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404628
call fcn.00405858
call fcn.00402eb4
jmp 0x409328
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4093fe
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x409420
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40b07c], 2
jne 0x409487
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x409442
xor eax, eax
jmp 0x409496
lea eax, [esp + 8]
push eax
push 0x40949c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x409487
xor eax, eax
jmp 0x409496
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x4094b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40950a
inc esi
xor edi, edi
cmp edi, 1
jne 0x4094d6
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4094e4
cmp edi, 1
jle 0x4094e4
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408f94
test eax, eax
jne 0x40950a
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x40950a
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x40950a
inc edi
dec esi
jne 0x4094c6
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x409514
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x409561
xor ebx, ebx
jmp 0x409556
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00404c08
test eax, eax
jne 0x409555
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x409611
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409537
mov al, byte [ebp - 1]
sub al, 1
jb 0x40956c
je 0x409575
jmp 0x40957e
call fcn.00406ffc
mov edi, eax
jmp 0x409580
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x409580
xor edi, edi
test di, di
je 0x409611
xor ebx, ebx
jmp 0x4095bc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x4095bb
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4095b0
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x4095bb
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409611
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x40958d
xor ebx, ebx
jmp 0x409606
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x409605
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4095fa
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x409605
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409611
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4095cb
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x40997c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a4f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a68
push ebx
push 0x409a74
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4099fc
mov al, 0x62
call fcn.00409620
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409950
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a05
call fcn.00409950
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a56
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b08
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bbc
jmp 0x409bb1
cmp dword [esi + 0x10], 0x1000
jne 0x409b9d
test byte [esi + 0x15], 1
jne 0x409b9d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b5c
cmp eax, 2
je 0x409b5c
cmp eax, 0x10
je 0x409b5c
cmp eax, 0x20
jne 0x409b71
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b71
mov bl, 1
xor ebp, ebp
jmp 0x409b82
mov eax, dword [esi]
add eax, ebp
call fcn.00409b00
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b75
test bl, bl
je 0x409b9d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bbc
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b34
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x3611435f
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x444433e9
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40c56e
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0040c71e
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x40c66c
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x40c60f
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x40c652
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x40c626
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x40c641
test al, 0x40
je 0x40c638
mov ecx, dword [edi + 0x20]
jmp 0x40c63f
test al, 0x80
je 0x40c652
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x40c652
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x40c5de
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x4164b0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47760b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046bcf2
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x416532
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00469b4a
mov eax, dword [eax]
push 0x4ae200
push eax
call fcn.0045be84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046bf7d
test bl, bl
je 0x416532
push 0x4ae200
lea ecx, [esp + 0xc]
call fcn.0046c30d
push 0x4b1d70
lea ecx, [esp + 0xc]
call fcn.0046c30d
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41656e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046bf7d
jmp 0x416639
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4165f2
lea edx, [esp + 0x7c]
push 0x4b1d6c
push edx
call fcn.0045be84
add esp, 8
test eax, eax
je 0x4165f2
lea eax, [esp + 0x7c]
push 0x4b1d68
push eax
call fcn.0045be84
add esp, 8
test eax, eax
je 0x4165f2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x416582
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046bf7d
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x417890
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4178f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x417900
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47776b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4b85dc]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x417a38
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x417966
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046bf7d
xor eax, eax
jmp 0x417aaf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046c0ba
push esi
lea ecx, [esp + 0xc]
call fcn.0046c349
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x4b1da8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x417a8d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00417890
test eax, eax
jne 0x417a8d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00417890
test eax, eax
jne 0x417a8d
lea eax, [esp + 0x14]
push 0x4b1d84
push eax
call fcn.0045cec0
mov esi, eax
add esp, 8
test esi, esi
jne 0x417a6c
lea ecx, [esp + 0x14]
push 0x4b1d80
push ecx
call fcn.0045ce40
mov esi, eax
add esp, 8
test esi, esi
jne 0x417a6c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x417a6f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046c06a
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41797e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046bf7d
xor eax, eax
jmp 0x417aaf
mov byte [esi], 0
push 0x4b1d7c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046bf7d
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4