joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11430
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [0x15390]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push 0x3ff
mov dword [ebp - 0x638], eax
lea eax, [ebp - 0x60b]
push ebx
push eax
mov dword [ebp - 0x644], esi
mov byte [ebp - 0x60c], bl
call sub.ntoskrnl.exe_memset
push 0x206
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call sub.ntoskrnl.exe_memset
push esi
push 0x14c32
mov edi, 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.000109fc
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add esp, 0x28
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x640]
push eax
call esi
push 0x60
lea eax, [ebp - 0x640]
mov dword [ebp - 0x62c], eax
push 1
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x634]
push eax
push 0x80100000
lea eax, [ebp - 0x610]
push eax
mov dword [ebp - 0x634], 0x18
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x628], 0x40
mov dword [ebp - 0x624], ebx
mov dword [ebp - 0x620], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jge 0x1151f
xor al, al
jmp 0x11641
push dword [ebp - 0x638]
lea eax, [ebp - 0x20c]
push 0x14c32
push edi
push eax
call fcn.000109fc
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x640]
push eax
call esi
push ebx
push ebx
push 0x60
push 5
push 2
push 0x80
lea eax, [ebp - 0x640]
mov dword [ebp - 0x62c], eax
push ebx
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x634]
push eax
push 0x40100000
lea eax, [ebp - 0x61c]
push eax
mov dword [ebp - 0x634], 0x18
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x628], 0x40
mov dword [ebp - 0x624], ebx
mov dword [ebp - 0x620], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jge 0x115bf
push dword [ebp - 0x610]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x11518
mov esi, dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov edi, 0x400
jmp 0x115f9
cmp dword [ebp - 0x614], ebx
je 0x11619
push ebx
push ebx
push dword [ebp - 0x614]
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x618]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x61c]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
push ebx
push ebx
push edi
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x618]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x610]
call esi
cmp eax, ebx
jge 0x115cc
push dword [ebp - 0x610]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwClose]
call esi
push dword [ebp - 0x61c]
call esi
cmp byte [ebp + 0x10], bl
je 0x1163f
push dword [ebp - 0x644]
call fcn.000111ce
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00012c87
leave
ret 0xc
Function at 0x12990
Capabilities:
Allocate or change rwx memory
Allocate user process rwx memory
Attach user process memory
Execute shellcode via indirect call

Disassembly:
push 0x254
push 0x15300
call fcn.0001313c
mov edi, dword [ebp + 8]
mov byte [ebp - 0x231], 0
and dword [ebp - 4], 0
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov esi, eax
mov ebx, esi
push edi
mov eax, dword [0x15424]
add eax, esi
push eax
call dword [sym.imp.ntoskrnl.exe__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x12b0a
push 0x14f40
lea eax, [ebp - 0x244]
push eax
mov ebx, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call ebx
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test eax, eax
je 0x12b25
push esi
call eax
mov edi, eax
test edi, edi
je 0x12b25
push 0x14f26
lea eax, [ebp - 0x24c]
push eax
call ebx
lea eax, [ebp - 0x264]
push eax
push esi
call sub.ntoskrnl.exe_KeStackAttachProcess
push 0x14f18
lea eax, [ebp - 0x24c]
push eax
push edi
call fcn.00012668
mov ebx, eax
test ebx, ebx
je 0x12afc
and dword [ebp - 0x238], 0
mov dword [ebp - 0x23c], 0x400
push 0x40
push 0x103000
lea eax, [ebp - 0x23c]
push eax
push 0
lea eax, [ebp - 0x238]
push eax
push 0xffffffffffffffff
call sub.ntoskrnl.exe_ZwAllocateVirtualMemory
mov edi, dword [ebp - 0x238]
test edi, edi
je 0x12afc
mov ecx, 0x80
mov esi, 0x1136a
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x230], ebx
mov eax, dword [ebx]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x228], eax
push 0x104
push 0x15440
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.ntoskrnl.exe_mbstowcs]
add esp, 0xc
mov eax, ebx
shr eax, 9
and eax, 0x7ffff8
sub eax, 0x40000000
mov edi, dword [ebp - 0x238]
add edi, 0x200
mov ecx, 0x85
lea esi, [ebp - 0x230]
rep movsd dword es:[edi], dword [esi]
or dword [eax], 0x200
mov byte [ebx], 0x68
mov eax, dword [ebp - 0x238]
mov dword [ebx + 1], eax
mov byte [ebx + 5], 0xc3
mov byte [ebp - 0x231], 1
lea eax, [ebp - 0x264]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
jmp 0x12b25
mov eax, dword [0x153f8]
add esi, eax
mov esi, dword [esi]
sub esi, eax
cmp esi, ebx
je 0x12b25
jmp 0x129b7
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x231]
call fcn.00013184
ret 4

Function at 0x15785
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x15390]
test eax, eax
mov ecx, 0xbb40e64e
je 0x1579c
cmp eax, ecx
jne 0x157b6
mov eax, dword [sym.imp.ntoskrnl.exe_KeTickCount]
mov eax, dword [eax]
xor eax, 0x15390
mov dword [0x15390], eax
jne 0x157b6
mov eax, ecx
mov dword [0x15390], eax
not eax
mov dword [0x15394], eax
pop ebp
jmp 0x1081e

Function at 0x1579c
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x15390]
test eax, eax
mov ecx, 0xbb40e64e
je 0x1579c
cmp eax, ecx
jne 0x157b6
mov eax, dword [sym.imp.ntoskrnl.exe_KeTickCount]
mov eax, dword [eax]
xor eax, 0x15390
mov dword [0x15390], eax
jne 0x157b6
mov eax, ecx
mov dword [0x15390], eax
not eax
mov dword [0x15394], eax
pop ebp
jmp 0x1081e
Function at 0x157af
Capabilities:
Create device object
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x15390]
test eax, eax
mov ecx, 0xbb40e64e
je 0x1579c
cmp eax, ecx
jne 0x157b6
mov eax, dword [sym.imp.ntoskrnl.exe_KeTickCount]
mov eax, dword [eax]
xor eax, 0x15390
mov dword [0x15390], eax
jne 0x157b6
mov eax, ecx
mov dword [0x15390], eax
not eax
mov dword [0x15394], eax
pop ebp
jmp 0x1081e
Function at 0x100047af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x108
call fcn.100092f4
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0xccd29d
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
push 0x108
call fcn.100092f4
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0xccd29d
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp - 4]
call fcn.10001107
mov eax, 0
cmp eax, ecx
jl 0x1000482f
push 0
push 0x4011022
push 1
call fcn.100092fa
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov ebx, dword [ebp - 8]
call fcn.10001107
mov eax, 0
cmp eax, ecx
jl 0x10004862
push 0x29
push 0x4011022
push 1
call fcn.100092fa
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov eax, dword [ebp - 4]
add eax, 8
mov ecx, 0x100
xor ebx, ebx
sub bl, cl
mov byte [ebx + eax], bl
loop 0x10004878
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov edi, dword [edx + 4]
add edx, 8
mov esi, dword [ebp - 8]
add esi, 8
mov ecx, 0x100
xor ebx, ebx
cmp ebx, edi
jb 0x100048a0
xor ebx, ebx
mov ah, byte [ebx + edx]
mov byte [esi], ah
inc esi
inc ebx
loop 0x1000489a
pop edi
xor ebx, ebx
sub esi, 0x100
xor eax, eax
mov ecx, 0x100
mov dl, byte [eax + esi]
add bl, dl
mov dl, byte [eax + edi]
add bl, dl
mov dl, byte [eax + edi]
mov dh, byte [ebx + edi]
mov byte [eax + edi], dh
mov byte [ebx + edi], dl
inc eax
loop 0x100048b9
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
add esi, 8
push 0x80000301
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x1bc
call fcn.1000a020
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x10004915
push ebx
call fcn.100092ee
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, 8
xor eax, eax
xor ebx, ebx
push ecx
movzx ecx, al
inc cl
push edx
mov dh, byte [ecx + edi]
add bl, dh
mov dl, byte [ebx + edi]
mov byte [ecx + edi], dl
mov byte [ebx + edi], dh
add dl, dh
movzx edx, dl
mov dl, byte [edx + edi]
mov cl, byte [eax + esi]
xor cl, dl
pop edx
mov byte [eax + edx], cl
inc eax
pop ecx
loop 0x1000492a
mov ebx, dword [ebp - 4]
push ebx
call fcn.100092ee
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.100092ee
add esp, 4
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000abb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000abce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1000abc3
pop esi
ret
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x1000df50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000df5f
pop dword [ebp - 0x40]
mov eax, 0x33049cc0
add eax, 0xdcfc429f
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xe210eb71
add dword [ebp - 0x50], 0x6c4159da
mov dword [ebp - 0x4c], 0x94df7576
sub dword [ebp - 0x4c], 0x62ac2931
mov dword [ebp - 0x48], 0x709e3621
sub dword [ebp - 0x48], 0x2451f1f3
mov dword [ebp - 0x44], 0x22df2060
sub dword [ebp - 0x44], 0x22df2060
lea eax, [ebp - 0x50]
push eax
mov eax, 0x7e90f7ca
add eax, 0x91706896
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x8183b04d
add dword [ebp - 0x50], 0xf2eeb909
mov dword [ebp - 0x4c], 0x9b5af8c3
sub dword [ebp - 0x4c], 0x59ee974e
mov dword [ebp - 0x48], 0xec3ff48d
sub dword [ebp - 0x48], 0x88d08821
mov dword [ebp - 0x44], 0xc8630712
add dword [ebp - 0x44], 0x379cf8ee
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x3c3dc724
sub eax, 0x2c3c66c0
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x36df5
push 0
call eax
mov ecx, 0x4522
mov edi, eax
mov ebx, 0x44c10ffa
add ebx, 0xcb412606
add ebx, dword [ebp - 0x40]
mov edx, 0x40c551c7
xor dword [ebp - 0x28], ebx
mov esi, dword [ebx]
add dword [ebp - 0x30], 0xe56df501
sub esi, edx
mov dword [edi], esi
sub dword [ebp - 4], edx
add edi, 4
add ebx, 0x14446e59
sub ebx, 0x14446e55
loop 0x1000e075
add eax, 0xefd5adb0
add eax, 0x102b59ab
mov ebx, eax
add eax, 0xe723594e
add eax, 0x18dca6b7
mov ecx, 0x7eb9c197
add ecx, 0x91463e69
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4a7f64
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0xc], edx
movzx si, cl
movzx esi, dl
mov dword [esp + 8], edx
pushal
bswap si
mov dword [esp + 0x24], ebx
bswap si
bswap si
not si
bswap esi
pushfd
pop dword [esp + 0x20]
push dword [esp + 4]
bts si, dx
mov dword [esp + 0x20], edi
rcl si, cl
mov dword [esp + 0x1c], eax
pushfd
mov si, 0x2c01
rcl si, cl
bt di, cx
push dword [0x4a6f62]
pop dword [esp + 0x1c]
lea esp, [esp + 0x1c]
jg 0x4a851e
pushfd
mov dword [esp], 0
clc
stc
mov esi, dword [esp + 0x30]
cmc
push ecx
stc
rol esi, 0x14
bt di, 3
cmp bh, cl
pushfd
add esi, 0xd858046b
pushfd
push eax
pushfd
lea esp, [esp + 0x14]
jmp 0x4a8335
btc si, dx
not esi
push 0
movzx si, al
rcl si, 0xa
bswap si
mov esi, dword [esp + 0x30]
cmc
clc
call fcn.004a8245
Function at 0x100138c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call sub.msvcr100.dll_memset
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call dword [sym.imp.msvcr100.dll_sprintf_s]
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001395d
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x100139a0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10023c4a
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x10013987
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100139a0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call dword [sym.imp.msvcr100.dll__mbscmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ba56
add ebp, 0x78c
leave
ret

Function at 0x10013b9c
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10013bbd
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10013bbd
inc esi
mov eax, esi
pop esi
ret

Function at 0x1001460e
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x1001eac9
call fcn.1001bb3b
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10014668
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.100178de
pop ecx
pop ecx
push ebx
push edi
call fcn.1000ee21
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10006d43
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10014685
call fcn.100060e0
jmp 0x10014687
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.msvcr100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100146d3
call fcn.10007f79
jmp 0x100146d3
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1001ba56
add ebp, 0x20c
leave
ret
Function at 0x100146fd
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x1001eaf9
call fcn.1001bb3b
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10014757
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.100178de
pop ecx
pop ecx
push ebx
push edi
call fcn.1000ee21
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10006d43
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10014774
call fcn.100060e0
jmp 0x10014776
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.msvcr100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100147c2
call fcn.10007f79
jmp 0x100147c2
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1001ba56
add ebp, 0x20c
leave
ret

Function at 0x10014eb7
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001eb59
call fcn.1001bb3b
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.1000ee21
test eax, eax
je 0x10014ee2
call fcn.10014ea8
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1002051c
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10014f3d
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.100178de
pop ecx
pop ecx
push edi
push esi
call fcn.1000ee21
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10006f58
push eax
push esi
push 0x10023e3c
call fcn.100178de
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x10014f36
ret
cmp ebx, edi
je 0x10014f48
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x10014ff9
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x10014fa5
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10014f01
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x10014ff9
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x10014ff9
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10014f01
mov eax, esi
call fcn.1001bbe0
ret
Function at 0x514690
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5aa14b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0059e7c8
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x514712
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0059c5bc
mov eax, dword [eax]
push 0xdcfd70
push eax
call fcn.0058ae04
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0059ea53
test bl, bl
je 0x514712
push 0xdcfd70
lea ecx, [esp + 0xc]
call fcn.0059ede3
push 0xdcfd7c
lea ecx, [esp + 0xc]
call fcn.0059ede3
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x51474e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0059ea53
jmp 0x514819
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x5147d2
lea edx, [esp + 0x7c]
push 0xdcfd78
push edx
call fcn.0058ae04
add esp, 8
test eax, eax
je 0x5147d2
lea eax, [esp + 0x7c]
push 0xdcfd74
push eax
call fcn.0058ae04
add esp, 8
test eax, eax
je 0x5147d2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x514762
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0059ea53
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x515010
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x515072
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x515080
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5aa1cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0xde6a68]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x5151b8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x5150e6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0059ea53
xor eax, eax
jmp 0x51522f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0059eb90
push esi
lea ecx, [esp + 0xc]
call fcn.0059ee1f
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x51520d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00515010
test eax, eax
jne 0x51520d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00515010
test eax, eax
jne 0x51520d
lea eax, [esp + 0x14]
push 0xdcfd8c
push eax
call fcn.0058bf70
mov esi, eax
add esp, 8
test esi, esi
jne 0x5151ec
lea ecx, [esp + 0x14]
push 0xdcfd88
push ecx
call fcn.0058bef0
mov esi, eax
add esp, 8
test esi, esi
jne 0x5151ec
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x5151ef
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0059eb40
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x5150fe
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0059ea53
xor eax, eax
jmp 0x51522f
mov byte [esi], 0
push 0xdcfd84
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0059ea53
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4

Function at 0x51b4d6
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
mov eax, dword [esi + 0x3a0]
test eax, eax
jne 0x51b4fe
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x3a0], eax
pop esi
add esp, 0x190
ret