joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c020
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jmp 0x43c040
test edi, edi
mov al, byte [ebp + 0x46f0a0]
mov byte [esp + 0x10], al
je 0x43c0c9
cmp byte [edi], 0
mov eax, edi
je 0x43c05d
add eax, 1
cmp byte [eax], 0
jne 0x43c055
mov ecx, dword [esp + 0x20]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x19c
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x43c0b1
xor eax, eax
test ebx, ebx
mov esi, ebx
mov edx, edi
jle 0x43c0a7
movzx edi, byte [edx]
movzx edi, byte [edi + 0x46e7f8]
lea ebp, [eax*8]
xor edi, ebp
sub esi, 1
xor eax, edi
add edx, 1
test esi, esi
jg 0x43c080
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
xor edx, edx
div dword [ecx]
jmp 0x43c0b3
xor edx, edx
push edi
call fcn.0040a0a0
add esp, 4
test eax, eax
je 0x43c0c5
mov eax, dword [eax + 8]
jmp 0x43c0d0
xor eax, eax
jmp 0x43c0d0
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 8]
test eax, eax
je 0x43c0e0
movzx ecx, byte [esp + 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x43c103
add ebp, 1
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x43c040
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0x10]
pop edi
mov dword [esi + 0x10], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x4418b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push ebx
push ebp
xor ebp, ebp
test dword [ecx + 0x18], 0x4000000
push esi
push edi
mov dword [esp + 0x14], ebp
je 0x4419fa
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x24]
test edi, edi
je 0x44191c
jmp 0x4418e0
mov eax, dword [edi + 0x14]
test eax, eax
jle 0x44190d
lea edx, [edi + 0x24]
mov esi, eax
lea esp, [esp]
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x4418fc
or eax, 0xffffffff
jmp 0x441903
mov eax, 1
shl eax, cl
or ebp, eax
add edx, 8
sub esi, 1
jne 0x4418f0
mov edi, dword [edi + 4]
test edi, edi
jne 0x4418e0
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x14], ebp
mov edi, dword [ecx]
test edi, edi
mov eax, edi
jne 0x441928
xor ebx, ebx
jmp 0x441941
cmp byte [edi], 0
je 0x441938
lea ecx, [ecx]
add eax, 1
cmp byte [eax], 0
jne 0x441930
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov ecx, dword [ecx + 0x44]
add ecx, 0x38
cmp dword [ecx + 0xc], 0
mov dword [esp + 0x18], ecx
je 0x44198d
xor eax, eax
test ebx, ebx
mov esi, ebx
mov edx, edi
jle 0x441987
jmp 0x441960
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x46e7f8]
lea ebp, [eax*8]
xor ecx, ebp
sub esi, 1
xor eax, ecx
add edx, 1
test esi, esi
jg 0x441960
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
xor edx, edx
div dword [ecx]
jmp 0x44198f
xor edx, edx
push edi
call fcn.0040a0a0
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x4419fa
mov edi, dword [eax + 8]
cmp edi, ebx
je 0x4419fa
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push ebx
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
mov dword [esp + 0x28], ebx
call fcn.00440110
mov eax, dword [esp + 0x28]
add esp, 0x14
cmp eax, ebx
je 0x4419f3
mov ecx, dword [eax + 0x24]
cmp ecx, ebx
jle 0x4419f3
mov edx, dword [eax + 4]
mov esi, ecx
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x4419e2
or eax, 0xffffffff
jmp 0x4419e9
mov eax, 1
shl eax, cl
or ebp, eax
add edx, 4
sub esi, 1
jne 0x4419d6
mov edi, dword [edi + 0xc]
cmp edi, ebx
jne 0x4419a5
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x441a10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x20]
test ebx, ebx
push esi
jne 0x441a42
mov esi, dword [esp + 0x20]
mov ecx, esi
call fcn.00441080
test eax, eax
jne 0x441a37
cmp dword [esi + 0x24], eax
jne 0x441a37
pop esi
pop ebx
add esp, 0x14
ret
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, dword [ebp + 0x24]
test edi, edi
je 0x441a8d
nop
mov esi, dword [edi + 0x14]
xor edx, edx
test esi, esi
jle 0x441a86
lea ecx, [edi + 0x24]
lea esp, [esp]
mov eax, dword [ecx]
cmp dword [ebx + eax*4], 0
jge 0x441c21
cmp eax, dword [ebp + 4]
jne 0x441a7c
cmp dword [esp + 0x30], 0
jne 0x441c21
add edx, 1
add ecx, 8
cmp edx, esi
jl 0x441a60
mov edi, dword [edi + 4]
test edi, edi
jne 0x441a50
mov edi, dword [ebp]
test edi, edi
mov eax, edi
jne 0x441a9a
xor ebx, ebx
jmp 0x441ab1
cmp byte [edi], 0
je 0x441aa8
nop
add eax, 1
cmp byte [eax], 0
jne 0x441aa0
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov ecx, dword [ebp + 0x44]
add ecx, 0x38
cmp dword [ecx + 0xc], 0
mov dword [esp + 0x18], ecx
je 0x441afd
xor eax, eax
test ebx, ebx
mov esi, ebx
mov edx, edi
jle 0x441af7
jmp 0x441ad0
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x46e7f8]
lea ebp, [eax*8]
xor ecx, ebp
sub esi, 1
xor eax, ecx
add edx, 1
test esi, esi
jg 0x441ad0
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x28]
xor edx, edx
div dword [ecx]
jmp 0x441aff
xor edx, edx
push edi
call fcn.0040a0a0
add esp, 4
test eax, eax
je 0x441c17
mov edx, dword [eax + 8]
test edx, edx
mov dword [esp + 0x18], edx
je 0x441c17
nop
mov eax, dword [edx + 0x14]
test eax, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], eax
jle 0x441c08
mov ecx, dword [ebp + 8]
lea esi, [edx + 0x28]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x10]
mov ebp, dword [esi]
xor esi, esi
test ecx, ecx
jle 0x441bec
mov eax, dword [esp + 0x28]
mov edi, dword [eax + 0xc]
lea esp, [esp]
test ebp, ebp
je 0x441bb8
mov ecx, dword [edi]
mov al, byte [ecx]
test al, al
mov edx, ebp
je 0x441b91
mov edi, edi
movzx ebx, byte [edx]
movzx eax, al
mov al, byte [eax + 0x46e7f8]
cmp al, byte [ebx + 0x46e7f8]
jne 0x441b91
mov al, byte [ecx + 1]
add ecx, 1
add edx, 1
test al, al
jne 0x441b70
movzx ecx, byte [ecx]
movzx edx, byte [edx]
movzx eax, byte [ecx + 0x46e7f8]
movzx ecx, byte [edx + 0x46e7f8]
mov edx, dword [esp + 0x18]
sub eax, ecx
mov ecx, dword [esp + 0x1c]
neg eax
sbb eax, eax
add eax, 1
jmp 0x441bbc
movzx eax, byte [edi + 0x15]
test eax, eax
je 0x441bda
mov eax, dword [esp + 0x2c]
cmp dword [eax + esi*4], 0
jge 0x441c21
mov eax, dword [esp + 0x28]
cmp esi, dword [eax + 4]
jne 0x441bda
cmp dword [esp + 0x30], 0
jne 0x441c21
add esi, 1
add edi, 0x18
cmp esi, ecx
jl 0x441b60
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
add dword [esp + 0x10], 8
add esi, 1
cmp esi, eax
mov dword [esp + 0x14], esi
jl 0x441b45
mov ebp, dword [esp + 0x28]
mov edx, dword [edx + 0xc]
test edx, edx
mov dword [esp + 0x18], edx
jne 0x441b20
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x466120
Capabilities:
Connect to http server
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x46c339
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x47c028]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x47c028]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push 0x4778f0
mov esi, ecx
mov ebx, edx
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esi], eax
je 0x466198
push 0
push 0
push 3
push 0
push 0
push 0x50
push str.msg.video.qiyi.com
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 4], eax
jne 0x466198
mov eax, dword [esi]
push eax
call edi
lea ecx, [esi + 0xc]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
push ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x4661c8
lea eax, [esp + 0x14]
call fcn.00465ff0
mov edx, dword [esi + 8]
push edx
mov ebx, eax
call edi
mov eax, dword [esi + 4]
push eax
call edi
mov ecx, dword [esi]
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0046ae55
add esp, 0x2c
ret
Function at 0x466490
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46ccfb
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x47c028]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
push edi
mov eax, dword [0x47c028]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
push esi
mov dword [esp + 0x14], esi
call fcn.004676e0
push 0x400
lea eax, [esp + 0x18]
push 0
mov dword [esp + 0x428], 0
push eax
mov dword [esi], vtable.CChromCookieRW.0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push 0x1c
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [esp + 0x14]
lea ebx, [esi + 0x20]
push edx
mov ecx, ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push str.cookies
lea ecx, [esi + 0x3c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
lea edi, [esi + 4]
push ebx
mov ecx, edi
call dword [0x46e274]
push str.GoogleChromeUser_DataDefaultCookies
mov ecx, edi
call dword [0x46e254]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esi + 0x5c]
call fcn.004036d0
test eax, eax
mov eax, esi
jne 0x466565
mov dword [esi + 0x58], 0
mov dword [esi + 0x58], 1
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.0046ae55
add esp, 0x418
ret
Function at 0x4692f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46bf3b
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x47c028]
xor eax, esp
mov dword [esp + 0x364], eax
push ebx
push edi
mov eax, dword [0x47c028]
xor eax, esp
push eax
lea eax, [esp + 0x374]
mov dword fs:[0], eax
push 0x477c24
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov ebx, 1
push 0x477cfc
lea ecx, [esp + 0x34]
mov dword [esp + 0x380], ebx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push 0x11c
lea eax, [esp + 0x50]
push 0
push eax
mov byte [esp + 0x388], 2
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 0x4c]
push ecx
mov dword [esp + 0x50], 0x11c
call edi
test eax, eax
jne 0x4693b6
lea edx, [esp + 0x4c]
push edx
mov dword [esp + 0x50], 0x114
call edi
test eax, eax
jne 0x4693b6
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
jmp 0x469421
push 0x206
lea ecx, [esp + 0x16e]
push 0
push ecx
mov word [esp + 0x174], 0
call sub.MSVCR80.dll_memset
movzx edx, word [esp + 0x16c]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
push edx
mov edx, dword [esp + 0x60]
push eax
push ecx
push edx
lea eax, [esp + 0x184]
push str.windows__d._d._d_sp_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
lea ecx, [esp + 0x168]
push ecx
lea ecx, [esp + 0x18]
call dword [0x46e260]
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x30]
mov dword [esp + 0xc], ebx
mov byte [esp + 0x37c], bl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x14]
mov byte [esp + 0x37c], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x374]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x364]
xor ecx, esp
call fcn.0046ae55
add esp, 0x374
ret
Function at 0x404a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40a4e0
cmp edx, dword [eax]
je 0x404ab2
add eax, 8
inc ecx
cmp eax, 0x40a570
jl 0x404aa3
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40a4e0]
jne 0x404be0
mov eax, dword [0x40aae8]
cmp eax, 1
je 0x404bba
test eax, eax
jne 0x404ae3
cmp dword [0x4080c0], 1
je 0x404bba
cmp edx, 0xfc
je 0x404be0
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404b1a
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004054b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004028c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404b5d
lea eax, [ebp - 0x1a4]
push eax
call fcn.004028c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40751c
push edi
call fcn.00405960
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004054b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004054c0
lea eax, [ebp - 0xa0]
push 0x4074fc
push eax
call fcn.004054c0
push dword [esi + 0x40a4e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004054c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004058d5
add esp, 0x2c
pop edi
jmp 0x404be0
lea eax, [ebp + 8]
lea esi, [esi + 0x40a4e4]
push 0
push eax
push dword [esi]
call fcn.004028c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x438df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
mov dword [esp], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x10]
test ebx, ebx
mov dword [esp + 8], edi
sete al
cmp esi, ecx
sete dl
or eax, edx
xor edi, edi
test al, 1
jne 0x438e50
test esi, esi
setne al
test ecx, ecx
setne dl
xor eax, edx
test al, 1
jne 0x438e61
test ebx, ebx
je 0x438e44
movzx eax, word [esi]
movzx edx, word [ecx]
cmp ax, dx
jne 0x438e7d
add esi, 2
add ecx, 2
dec ebx
jne 0x438e30
xor edi, edi
lea esi, [esi]
lea edi, [edi]
mov eax, edi
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0xc
ret
cmp ecx, 1
mov ebx, dword [esp]
sbb eax, eax
and eax, 2
mov esi, dword [esp + 4]
lea edi, [eax - 1]
mov eax, edi
mov edi, dword [esp + 8]
add esp, 0xc
ret
movzx edi, ax
movzx eax, dx
sub edi, eax
jmp 0x438e50
Function at 0x10598
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, dword [0x10bec]
jne 0x105bf
mov ecx, dword [ebp + 0xc]
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x105d4
mov edx, dword [ebp + 0xc]
inc byte [edx + 0x23]
add dword [edx + 0x60], 0x24
mov eax, dword [eax + 0x28]
mov ecx, dword [eax]
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
pop ebp
ret 8

Function at 0x105de
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [ebp - 0x1c], 0
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push 0xf003f
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x14], pe_nt_image_headers32
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov esi, eax
test esi, esi
jge 0x10641
push esi
push dword [ebp + 8]
push 0x10988
call sub.ntoskrnl.exe_DbgPrint
add esp, 0xc
mov eax, esi
jmp 0x10643
xor eax, eax
pop esi
leave
ret 8

Function at 0x10c3e
Capabilities:
Create device object
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.00010c05
pop ebp
jmp fcn.000107fc
Function at 0x40ef20
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46d56b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046207f
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40efa2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045fe2d
mov eax, dword [eax]
push 0x4a11c0
push eax
call fcn.00452c04
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046230a
test bl, bl
je 0x40efa2
push 0x4a11c0
lea ecx, [esp + 0xc]
call fcn.0046269a
push 0x4a4d58
lea ecx, [esp + 0xc]
call fcn.0046269a
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40efde
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046230a
jmp 0x40f0a9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40f062
lea edx, [esp + 0x7c]
push 0x4a4d54
push edx
call fcn.00452c04
add esp, 8
test eax, eax
je 0x40f062
lea eax, [esp + 0x7c]
push 0x4a4d50
push eax
call fcn.00452c04
add esp, 8
test eax, eax
je 0x40f062
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40eff2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046230a
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40f8a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40f902
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40f910
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46d5eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4ab228]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40fa48
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40f976
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046230a
xor eax, eax
jmp 0x40fabf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00462447
push esi
lea ecx, [esp + 0xc]
call fcn.004626d6
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40fa9d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push 0x80000000
call fcn.0040f8a0
test eax, eax
jne 0x40fa9d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x80000000
mov ecx, edi
call fcn.0040f8a0
test eax, eax
jne 0x40fa9d
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.00453d10
mov esi, eax
add esp, 8
test esi, esi
jne 0x40fa7c
lea ecx, [esp + 0x14]
push 0x4a4d68
push ecx
call fcn.00453c90
mov esi, eax
add esp, 8
test esi, esi
jne 0x40fa7c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40fa7f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004623f7
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40f98e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046230a
xor eax, eax
jmp 0x40fabf
mov byte [esi], 0
push 0x4a4d64
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046230a
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4