joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409bb0
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
push edi
xor bl, bl
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x409bd7
cmp eax, 2
mov dword [esi + 0x1c], eax
jne 0x409bf1
cmp byte [esp + 0x18], bl
je 0x409bdb
mov bl, 1
jmp 0x409c1e
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x10]
add eax, 8
push edi
push eax
push 0x74
pop edx
call fcn.0040a0ea
jmp 0x409c06
push eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x14]
add eax, 8
push edi
push eax
push 0x75
pop edx
call fcn.0040a104
mov dword [esi + 0x14], 3
add esi, 0x20
push edi
push esi
xor edx, edx
mov ecx, str.Class_Key.DeleteValue.QSName
call fcn.00409a49
pop edi
mov al, bl
pop esi
pop ebx
ret 0xc

Function at 0x409c80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0xc]
and dword [edi], 0
push eax
lea eax, [ebp - 8]
and byte [ebp - 1], 0
push eax
push 0
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp + 0x10], 4
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x409ced
cmp eax, 2
mov dword [esi + 0x1c], eax
jne 0x409cd5
cmp byte [ebp + 0x14], 0
jne 0x409cfe
mov eax, dword [esi + 0x10]
push dword [ebp + 0xc]
add eax, 8
push eax
push 0x72
jmp 0x409d10
push eax
mov eax, dword [esi + 0x10]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
add eax, 8
push eax
push 0x6f
pop edx
call fcn.0040a104
jmp 0x409d19
cmp dword [ebp - 8], 4
jne 0x409d04
cmp dword [ebp + 0x10], 4
jne 0x409d04
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
jmp 0x409d3a
mov eax, dword [esi + 0x10]
push dword [ebp + 0xc]
add eax, 8
push eax
push 0x70
mov ecx, dword [ebp + 8]
pop edx
call fcn.0040a0ea
push dword [ebp + 0xc]
lea eax, [esi + 0x20]
xor edx, edx
mov ecx, str.Class_Key.QueryIntValue.QSName
push eax
mov dword [esi + 0x14], 5
call fcn.00409a49
mov dword [esi + 0x24], 1
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret 0x10
Function at 0x409d43
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f0
push esi
lea eax, [ebp - 8]
push edi
mov edi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x3f0]
push eax
and byte [ebp - 1], 0
lea eax, [ebp + 0x10]
mov esi, ecx
push eax
push 0
push edi
mov dword [ebp - 8], 0x3e8
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x409dc0
cmp eax, 2
mov dword [esi + 0x1c], eax
jne 0x409daa
cmp byte [ebp + 0x18], 0
je 0x409d95
mov ecx, dword [ebp + 0x14]
call fcn.00409a8b
jmp 0x409dfd
mov eax, dword [esi + 0x10]
push edi
add eax, 8
push eax
push 0x72
mov ecx, dword [ebp + 0xc]
pop edx
call fcn.0040a0ea
jmp 0x409e17
push eax
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 0xc]
add eax, 8
push edi
push eax
push 0x6f
pop edx
call fcn.0040a104
jmp 0x409e17
cmp dword [ebp + 0x10], 1
je 0x409dd2
mov eax, dword [esi + 0x10]
push edi
add eax, 8
push eax
push 0x71
jmp 0x409d9f
mov eax, dword [ebp - 8]
test eax, eax
je 0x409e03
cmp byte [ebp + eax - 0x3f1], 0
jne 0x409e03
dec eax
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x3f0]
push eax
xor edx, edx
push dword [ebp + 0x14]
call fcn.004099a5
test al, al
je 0x409e17
mov byte [ebp - 1], 1
jmp 0x409e36
push eax
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 0xc]
add eax, 8
push edi
push eax
push 0x79
pop edx
call fcn.0040a0f7
lea eax, [esi + 0x20]
push edi
push eax
xor edx, edx
mov ecx, str.Class_Key.QueryTextValueT.QSName
mov dword [esi + 0x14], 5
call fcn.00409a49
mov dword [esi + 0x24], 2
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret 0x14

Function at 0x409f02
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
lea eax, [ebp + 0x10]
mov edi, dword [ebp + 0x10]
push 4
xor ebx, ebx
push eax
push 4
push ebx
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp + 0x10], edi
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x409f73
push dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 8]
push dword [ebp + 0xc]
add eax, 8
push eax
push 0x76
pop edx
call fcn.0040a0f7
push dword [ebp + 0xc]
lea eax, [esi + 0x20]
xor edx, edx
mov ecx, str.Class_Key.SetIntValue.QSName
push eax
mov dword [esi + 0x14], 6
call fcn.00409a49
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], edi
pop edi
mov al, bl
pop esi
pop ebx
pop ebp
ret 0xc
mov bl, 1
jmp 0x409f6a
Function at 0x409f77
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and byte [ebp - 1], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push ebx
push 1
push eax
push dword [ebp + 0xc]
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x409ffc
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x10]
push ebx
mov ecx, dword [ebp + 8]
push dword [ebp + 0xc]
add eax, 8
push eax
push 0x78
pop edx
call fcn.0040a0f7
push dword [ebp + 0xc]
lea eax, [esi + 0x20]
xor edx, edx
mov ecx, str.Class_Key.SetStringValueT.QSName
push eax
mov dword [esi + 0x14], 6
call fcn.00409a49
mov dword [esi + 0x24], 2
add esi, 0x2c
push ebx
push esi
xor edx, edx
mov ecx, str.Key.KeySetStringValueT.value
call fcn.00409a49
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov byte [ebp - 1], 1
jmp 0x409ff2

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40701c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x407028
push 0x407024
push 0x407020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x407028]
push dword [0x407024]
push dword [0x407020]
mov dword [0x407014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x84], 0
call fcn.004019f0
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
or al, 0x40
push eax
lea eax, [0x404731]
lea edx, [fcn.00401a74]
sub eax, edx
push eax
push fcn.00401a74
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x40132d
push edi
call fcn.004018e0
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.0040192f
mov eax, edi
add eax, 0x1e200
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov esi, dword [ebp - 0x88]
mov ecx, edi
sar esi, cl
push esi
lea esi, [0x4070e4]
mov ebx, edi
dec ebx
and esi, ebx
push esi
call fcn.00401a74
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4019f0
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push edi
and dword [ebp - 0x120], 0
xor edi, edi
push 0
push 0
call sub.USER32.DLL_GetWindowLongA
push 0
push 0
call sub.USER32.DLL_GetDlgItem
push 0
push 0
push 0
push 0
call sub.USER32.DLL_GetDlgItemInt
mov dword [ebp - 0x11c], 0x14
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringW
movzx eax, word [ebp - 0x118]
mov edi, eax
sub edi, 0x41
mov eax, edi
pop edi
leave
ret
Function at 0x407a10
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x51c
push ebx
mov ebx, dword [esp + 0x528]
push esi
mov esi, dword [esp + 0x528]
push edi
push ebx
push esi
mov dword [esp + 0x14], 0
call fcn.004079d0
mov eax, dword [esi + 0x250c]
mov ecx, dword [esi + 0x2508]
push eax
push ecx
push 0x10000000
push 0xffffffffffffffff
lea edi, [esi + 0x2589]
push str.SYSTEM
push 0xffffffffffffffff
push edi
call sub.oranls9.dll_lxsCmpStr
add esp, 0x24
test eax, eax
je 0x407b90
mov edx, dword [esi + 0x250c]
mov eax, dword [esi + 0x2508]
push edx
push eax
push 0x10000000
push 0xffffffffffffffff
push 0x467304
push 0xffffffffffffffff
push edi
call sub.oranls9.dll_lxsCmpStr
add esp, 0x1c
test eax, eax
je 0x407b90
mov ecx, dword [esi + 0x4814]
test byte [ecx + 0x1c], 6
jne 0x407b90
mov edx, dword [esi + 0x2508]
mov ecx, 0x146
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], ebx
mov eax, dword [edx + 0x1c]
test eax, 0x4000000
je 0x407ad6
push str.SELECT_ATTRIBUTE_SCOPE_NUMERIC_VALUE_CHAR_VALUE_DATE_VALUE_FROM_SYSTEM.PRODUCT_PRIVS_WHERE__UPPER_SQLPlus__LIKE_UPPER_PRODUCT___AND__UPPER_USER__LIKE_USERID_
call sub.oranls9.dll_lxsulen
add esp, 4
jmp 0x407ae7
mov edi, str.SELECT_ATTRIBUTE_SCOPE_NUMERIC_VALUE_CHAR_VALUE_DATE_VALUE_FROM_SYSTEM.PRODUCT_PRIVS_WHERE__UPPER_SQLPlus__LIKE_UPPER_PRODUCT___AND__UPPER_USER__LIKE_USERID_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ecx
lea ecx, [esp + 0xc]
push 1
push ecx
lea edx, [esp + 0x18]
push 1
push edx
lea ecx, [esp + 0x20]
push 0x408330
push ecx
push 0x408020
push 0
push 0
inc eax
push 3
push eax
push str.SELECT_ATTRIBUTE_SCOPE_NUMERIC_VALUE_CHAR_VALUE_DATE_VALUE_FROM_SYSTEM.PRODUCT_PRIVS_WHERE__UPPER_SQLPlus__LIKE_UPPER_PRODUCT___AND__UPPER_USER__LIKE_USERID_
push esi
call fcn.00415200
mov edi, eax
add esp, 0x34
test edi, edi
jne 0x407b84
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x407b45
push edi
push 1
push 0x903
push esi
call fcn.004157b0
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x51c
ret
cmp dword [esi + 0x1890], 1
je 0x407b84
push 0
push 0x26f
push 2
push 2
push esi
call fcn.00409560
push 0
push 0x21f
push 4
push 2
push esi
call fcn.00409560
push 0
push 0x270
push 4
push 2
push esi
call fcn.00409560
add esp, 0x3c
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x51c
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x51c
ret
Function at 0x434a00
Capabilities:
Reference sql statements

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x434a28
mov eax, dword [esp + 0x14]
push edi
push 1
push 0x42e
push eax
call fcn.004157b0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, dword [edi + 8]
mov ebx, dword [esp + 0x14]
test esi, esi
jne 0x434a47
push ebx
call fcn.00435190
mov esi, eax
add esp, 4
test esi, esi
jne 0x434a47
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [edi + 8], esi
mov ecx, dword [ebx + 0x4814]
test byte [ecx + 0x20], 1
jne 0x434b5e
mov al, byte [esi + 0xc]
test al, al
jne 0x434ae0
push 0x3c
push str.SELECT_SID_FROM_V_SESSION_WHERE_USERENV_SESSIONID_AUDSID
push ebx
call fcn.00412bc0
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x434b42
mov edx, dword [ebx + 0x2508]
test dword [edx + 0x1c], 0x4000000
je 0x434a95
push ebp
call sub.oranls9.dll_lxsulen
add esp, 4
jmp 0x434aa7
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x18]
not ecx
dec ecx
mov eax, ecx
lea edx, [esi + 0xc]
push 0x16
push edx
push eax
push ebp
push ebx
call fcn.00414680
push ebp
push ebx
mov word [esi + 0x22], ax
call fcn.0040f330
add esp, 0x1c
cmp word [esi + 0x22], 0
jne 0x434ae0
push 0
push 0x26a
push 1
push 2
push ebx
call fcn.00409560
add esp, 0x14
jmp 0x434b42
cmp dword [esi], 0
jne 0x434b11
mov eax, dword [ebx + 0x4814]
push esi
push eax
push ebx
call fcn.004355a0
add esp, 0xc
mov dword [esi], eax
test eax, eax
jne 0x434b11
push eax
push 0x26b
push 1
push 2
push ebx
call fcn.00409560
add esp, 0x14
jmp 0x434b42
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x434b29
push esi
push ebx
call fcn.00435330
add esp, 8
mov dword [esi + 0x2c], eax
test eax, eax
je 0x434b42
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x434b5e
mov ecx, dword [esi + 0x2c]
push ecx
push esi
push ebx
call fcn.004354c0
add esp, 0xc
test eax, eax
jne 0x434b5e
test esi, esi
je 0x434b50
push esi
push ebx
call fcn.00434bc0
add esp, 8
mov dword [edi + 8], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x435330
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x80
mov eax, dword [esp + 0x88]
push ebx
push ebp
xor ebx, ebx
mov ebp, dword [eax + 8]
push esi
mov esi, dword [esp + 0x90]
push edi
test eax, eax
mov dword [esp + 0x10], 0
je 0x435482
push 0x12b
push str.SELECT_STATISTIC_S__NAME_FROM_SYS.V__STATNAME_WHERE_NAME_IN__recursive_calls_db_block_gets_consistent_gets_physical_reads_redo_size_bytes_sent_via_SQLNet_to_client_bytes_received_via_SQLNet_from_client_SQLNet_roundtrips_to_from_client_sorts__memory__sorts__disk___ORDER_BY_S
push esi
call fcn.00412bc0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x435482
mov eax, dword [esi + 0x2508]
test dword [eax + 0x1c], 0x4000000
je 0x435394
push ebx
call sub.oranls9.dll_lxsulen
add esp, 4
jmp 0x4353a2
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ecx
mov ecx, dword [esi + 0x2628]
push 0xa
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push eax
push ebx
push 0
lea edx, [esp + 0x68]
push 2
push edx
push esi
call fcn.0043da80
add esp, 0x38
test eax, eax
je 0x43545e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x3c]
push eax
push ecx
push esi
call fcn.00435850
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x435445
mov eax, dword [esp + 0x10]
test eax, eax
je 0x435494
push eax
lea edx, [esp + 0x18]
push 0x46ab40
push edx
call dword [0x461054]
lea eax, [esp + 0x20]
push eax
push 1
push 0x26d
push 8
push 2
push esi
call fcn.00409560
mov cl, byte [esi + 0x46b4]
lea eax, [esi + 0x46b4]
add esp, 0x24
test cl, cl
je 0x435494
mov ecx, dword [esp + 0x10]
push eax
push esi
mov dword [esi + 0x25d0], ecx
call fcn.00438610
jmp 0x435491
lea edx, [esp + 0x3c]
push 1
push edx
push esi
call fcn.0043dba0
push ebx
push esi
call fcn.0040f330
add esp, 0x14
jmp 0x435462
mov edi, dword [esp + 0x10]
mov eax, dword [ebp]
cmp eax, 1
jb 0x435486
cmp eax, 0xa
ja 0x435486
mov dword [edi + 0x1cc], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
mov edi, dword [esp + 0x10]
test edi, edi
je 0x435494
push edi
push esi
call fcn.0040f330
add esp, 8
lea eax, [esp + 0x3c]
push 1
push eax
push esi
call fcn.0043dba0
add esp, 0xc
test ebx, ebx
je 0x4354b2
push ebx
push esi
call fcn.0040f330
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x80
ret
Function at 0x4354c0
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x34
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x50]
xor esi, esi
mov ecx, dword [edi + 0x1cc]
test ecx, ecx
jbe 0x4354fc
mov ebx, ecx
mov cl, byte [edi]
mov edx, edi
test cl, cl
je 0x4354f1
mov byte [eax], cl
mov cl, byte [edx + 1]
inc eax
inc edx
inc esi
test cl, cl
jne 0x4354e5
mov byte [eax], 0x2c
inc eax
add edi, 6
inc esi
dec ebx
jne 0x4354dd
mov ebp, dword [esp + 0x48]
push 0x68
push str.SELECT_PT.VALUE_FROM_SYS.V__SESSTAT_PT_WHERE_PT.SID:1_AND_PT.STATISTIC_IN___s__ORDER_BY_PT.STATISTIC
push ebp
mov byte [eax - 1], 0
call fcn.00412bc0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x435522
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
mov eax, dword [ebp + 0x2508]
test dword [eax + 0x1c], 0x4000000
je 0x43553c
push ebx
call sub.oranls9.dll_lxsulen
add esp, 4
jmp 0x43554a
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ecx
lea edi, [esi + eax - 2]
push edi
push ebp
call fcn.00408a60
mov esi, eax
add esp, 8
test esi, esi
jne 0x435572
push ebx
push ebp
call fcn.0040f330
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea ecx, [esp + 0x10]
push ecx
push ebx
push esi
call dword [0x461054]
push ebx
push ebp
call fcn.0040f330
mov eax, dword [esp + 0x60]
add esp, 0x14
mov dword [eax + 0x28], edi
mov dword [eax + 0x24], esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x34
ret
Function at 0x436c00
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
push esi
push str.NLS_LENGTH_SEMANTICS
mov esi, dword [eax]
call dword [0x461088]
add esp, 4
test eax, eax
jne 0x436c27
mov word [esi + 0x485c], ax
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 0x250c]
mov edx, dword [esi + 0x2508]
push ecx
push edx
push 0x10000010
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.char
push eax
call sub.oranls9.dll_lxCmpStr
add esp, 0x1c
neg eax
sbb eax, eax
and al, 0xfe
add eax, 2
mov word [esi + 0x485c], ax
mov eax, 1
pop esi
ret
Function at 0x68741b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x68743028], 8
jne 0x68741ba0
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernelbase.dll_WaitForThreadpoolWorkCallbacks]
sub esp, 8
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__d__n
mov dword [esp + 8], str.__std_wait_for_threadpool_work_callbacks
mov dword [esp + 4], 0x68743028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x68741b81
Function at 0x687425b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6874260b
cmp byte [esi + ebx - 1], 0xa
je 0x687425df
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x68743118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x409fa0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46c62b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00460d50
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40a022
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045eafd
mov eax, dword [eax]
push 0x4861d0
push eax
call fcn.00450f84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00460fdb
test bl, bl
je 0x40a022
push 0x4861d0
lea ecx, [esp + 0xc]
call fcn.0046136b
push 0x489d4c
lea ecx, [esp + 0xc]
call fcn.0046136b
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40a05e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00460fdb
jmp 0x40a129
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40a0e2
lea edx, [esp + 0x7c]
push 0x489d48
push edx
call fcn.00450f84
add esp, 8
test eax, eax
je 0x40a0e2
lea eax, [esp + 0x7c]
push 0x489d44
push eax
call fcn.00450f84
add esp, 8
test eax, eax
je 0x40a0e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a072
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00460fdb
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a920
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a982
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40a990
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46c6ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4906d8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40aac8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40a9f6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00460fdb
xor eax, eax
jmp 0x40ab3f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00461118
push esi
lea ecx, [esp + 0xc]
call fcn.004613a7
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40ab1d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040a920
test eax, eax
jne 0x40ab1d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040a920
test eax, eax
jne 0x40ab1d
lea eax, [esp + 0x14]
push 0x489d60
push eax
call fcn.00451fc0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40aafc
lea ecx, [esp + 0x14]
push 0x489d5c
push ecx
call fcn.00451f40
mov esi, eax
add esp, 8
test esi, esi
jne 0x40aafc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40aaff
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004610c8
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40aa0e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00460fdb
xor eax, eax
jmp 0x40ab3f
mov byte [esi], 0
push 0x489d58
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00460fdb
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4