joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546b81
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esp
lea esp, [esp + 4]
lea esp, [esp + 4]
jmp 0x5770f5
push edx
jmp 0x5770d9

Function at 0x616c8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 7
jmp 0x616c93
mov dx, word [esp]
mov byte [esp], ch

Function at 0x617292
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6172bf
inc dh
xchg ebp, eax
not dh
xchg ah, dh
xchg edx, ebp
rdtsc
jmp 0x617395
add esp, 4
lea ebp, [ecx - 0x13]
lea ebp, [ebx*4]
xchg dx, ax
jmp 0x617294
btc ebp, edi
mov ebp, dword [esp]
xchg byte [esp], dh
lea esp, [esp]
mov eax, ecx
mov bp, sp
jmp 0x617355
xchg ebp, eax
mov dh, 2
rdtsc
bswap edx
rcr ebp, 1
mov bp, ax
jmp 0x617301
xchg dword [esp + 8], edx
mov bp, bx
mov bp, 0x4a27
xchg word [esp + 7], bp
mov bp, 0x866d
rdtsc
jmp 0x617439
bsf ax, si
neg bp
mov byte [esp], ch
pushal
mov ax, dx
pop ebp
jmp 0x617329
xchg dh, dl
mov bp, sp
mov bp, 0x6fa7
mov edx, 0x3eca48b8
add esp, 4
mov al, ah
jmp 0x61731b
mov ebp, 0x749bc0ba
push word [esp]
mov ebp, dword [esp + 3]
lea ebp, [ebx + edi]
xor ax, 0x53dc
mov dx, cx
jmp 0x61736d
mov ah, byte [esp + 0x1a]
push dword [esp + 4]
call 0x617404
cmp esi, dword [ecx + 0x65b34021]
xor byte [ebx], dh
sub al, byte [ebp + 0x66]
bsf ebp, esi

Function at 0x617615
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0xc], dh
xchg dword [esp + 0xb], edx
jmp 0x61762e
bswap ebp
xchg dword [esp + 0xb], edx
mov bp, cx
btr edx, esp
neg bp
rol bp, cl
jmp 0x618a2d
and ebp, ecx
xchg word [esp + 0x11], bp
mov dh, bh
xchg edx, eax
lea edx, [esi + edi]
jmp 0x6176f3
inc ebp
mov edx, esi
neg dh
pop ebp
xchg byte [esp + 0x21], al
xchg ebp, eax
jmp 0x61766d
btr ebp, esp
mov dh, ch
lea edx, [ebp + 0xd7]
not bp
pop word [esp + 0x1f]
mov al, ah
jmp 0x617684
mov dx, 0x83b9
xchg word [esp + 0xd], bp
pop ebp
xchg byte [esp + 7], dl
btr eax, edx
pop word [esp + 0x11]
jmp 0x617874
mov word [esp], di
xchg byte [esp + 0x13], dh
mov bp, 0x2a53
push word [esp + 0x13]
jmp 0x6176b2
pop dword [esp + 6]
push word [esp + 0x13]
mov ebp, ecx
mov ax, word [esp + 0x14]
xchg byte [esp + 0x1b], al
rdtsc
jmp 0x6176d9
bsf bp, si
add esp, 0xb
bsf dx, ax
sub esp, 0xc
sub esp, 6
mov dx, word [esp + 8]
jmp 0x61769b
mov ah, byte [esp + 1]
push dword [esp + 2]
xchg byte [esp + 2], dh
pop bp
xchg ah, dh
jmp 0x61778d
push word [esp + 1]
sub esp, 0x1a
mov al, ah
pushal
lea esp, [esp + 0x4f]
push esp
jmp 0x617734
lea esp, [esp + 1]
lea ebp, [esi + 0x9d]
inc al
rdtsc
call fcn.00617774
and byte [ebp + 0x4daf5c35], ah
push edx
salc
inc esp
and ebx, esi
xor al, al
dec ebx
fstp xword [esi + 0xf6ea24d]
int 0x8d
and al, 1
bswap ebp
lea esp, [esp + 1]
inc bp
mov ax, sp
push word [esp + 0x1b]
lea esp, [esp + 0x10]
jmp 0x61774a
add bp, 0xe7de
push esp
xchg dh, dl
pop word [esp + 0x19]
cld
neg dh
jmp 0x6177b3
pop word [esp + 5]
xor ebp, esi
rdtsc
push word [esp + 3]
mov eax, dword [esp + 1]
mov dword [esp + 1], ecx
jmp 0x6177f9
pop ebp
bsr bp, bp
xchg word [esp + 0x12], bp
mov ebp, dword [esp + 0xa]
mov bp, di
bsr bp, bp
jmp 0x617719
pushal
xchg word [esp + 4], ax
rcr ah, 1
xchg dx, ax
rdtsc
add esp, 0x12
jmp 0x617899
Function at 0x617c9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x617cce
sub ebp, eax
lea eax, [edx + edi]
stc
xchg ebp, edx
xchg dword [esp + 1], ebp
rdtsc
jmp 0x617e3f
mov word [esp + 1], sp
mov edx, dword [esp + 7]
mov dx, 0x355
xchg word [esp + 2], ax
mov word [esp + 3], dx
mov dword [esp + 1], esi
jmp 0x617c9d
mov dh, bh
xchg bp, dx
mov dh, 0x5a
bsr bp, bp
rol dx, cl
mov byte [esp + 1], dh
jmp 0x617d40
inc dl
rdtsc
mov ebp, 0x251e161e
mov word [esp], dx
mov word [esp], di
mov byte [esp + 1], dh
jmp 0x617d0a
xchg byte [esp], dh
setns ah
lea ebp, [ecx + 0xc3]
mov dh, byte [esp]
mov bp, dx
add esp, 1
jmp 0x617d84
lea eax, [edx + edi]
xchg byte [esp], dh
mov dh, ch
xchg edx, eax
bswap edx
xchg byte [esp], dh
jmp 0x617d29
lea edx, [eax + 0x6b68c4b1]
rdtsc
lea ebp, [esp + edi]
pop dword [esp]
jmp 0x617d96
not ebp
mov ah, byte [esp + 1]
sub esp, 0x1a
xchg ebp, eax
pop ebp
mov ax, word [esp + 2]
jmp 0x617d6d
mov ebp, 0xe87ebbba
and bp, 0x38c2
inc edx
mov ebp, 0xe62819d2
pop word [esp + 0xf]
mov bp, 0x3221
jmp 0x617e24
lea ebp, [ebp*4]
lea eax, [edi + edi]
mov dword [esp + 6], esi
lea esp, [esp + 8]
ror dh, 5
mov ah, byte [esp]
jmp 0x617d5d
lea ebp, [esi + 0x405cf7d]
mov word [esp + 6], sp
not dh
sub esp, 0
xchg ebp, eax
mov al, 0xbe
jmp 0x617dbd
mov word [esp + 0x16], sp
xchg dh, dl
mov dh, byte [esp + 0x2d]
ror ah, 1
mov dh, ch
pushal
jmp 0x617ed1
pop word [esp + 3]
rcl dh, 3
lea esp, [esp + 0x17]
mov dh, ch
jmp 0x617e8a
xchg dword [esp + 6], edx
rdtsc
pushal
mov byte [esp + 5], ch
mov word [esp + 0x18], bx
mov dword [esp + 0x19], ecx
jmp 0x617df9
xchg dword [esp + 3], eax
xchg dh, dl
mov ax, sp
not ebp
mov dh, 0xba
add ax, 0x859e
jmp 0x617de4
rcr dh, 7
mov dword [esp], ebp
mov bp, bx
call fcn.00617e52
push ecx
fmul dword [esi + 0x29]
fdiv dword [edi]
mov ecx, 0x3fcca535
shl dword [edi + edx*8 - 0x7899f6c2], cl
push esp
and al, 2
xchg word [esp + 2], dx
mov al, 0x1e
push dword [esp + 3]
push dword [esp + 2]
pop bp
cmc
jmp 0x617e6c
lea esp, [esp + 0x52]
mov dh, 0x12
not dh
pushal
pop bp
mov byte [esp + 0x11], bh
jmp 0x617e0e
Function at 0x619a35
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, 0x74
setae dh
xchg dword [esp + 6], ebp
lea eax, [edx + ebp]
mov dl, 0x4c
or ebp, eax
jmp 0x619803
lea esp, [esp + 1]
mov ebp, esp
lea edx, [esp + esi]
mov byte [esp + 0xb], ah
jmp 0x61982f
pop word [esp + 5]
lea edx, [ebx + edi]
xchg dword [esp + 5], edx
bsf bp, si
rdtsc
mov dh, bh
jmp 0x6197ed
bsf bp, si
pop word [esp + 8]
xchg dword [esp + 3], eax
dec dx
xor ebp, esi
push dword [esp + 6]
jmp 0x619a09
mov dx, 0xa073
cmc
ror eax, 3
bsr bp, bp
inc al
lea eax, [esi - 0x21d103db]
jmp 0x619819
mov bp, 0x19d
pushal
mov eax, 0xfe6cb572
mov ax, 0xf941
stc
rcr dh, 7
jmp 0x6198bd
mov ebp, dword [esp + 0x1e]
mov ax, word [esp + 0x19]
mov dword [esp + 0x32], ebp
pop ebp
mov byte [esp + 9], dh
add esp, 0x35
jmp 0x61986c
setle ah
pop ebp
lea edx, [ecx*4]
pop bp
xchg edx, ebp
xchg byte [esp + 3], dh
jmp 0x6198d6
xchg dword [esp + 2], ebp
mov ebp, dword [esp + 0x23]
lea edx, [esi*4]
xchg dword [esp + 0x16], eax
btr ebp, edx
pop ebp
jmp 0x61989c
mov al, 0x9e
mov word [esp + 0xe], sp
mov byte [esp + 1], ch
add esp, 5
mov dh, bh
mov al, ah
jmp 0x61993a
push esp
lea ebp, [ecx*4]
pop bp
push dword [esp + 0xc]
rdtsc
pop word [esp + 7]
jmp 0x619885
push word [esp + 0xd]
not dh
lea ebp, [esp + esi]
mov dh, 0x10
mov ebp, dword [esp + 9]
mov edx, eax
jmp 0x619979
mov dh, 0xda
mov byte [esp + 0x11], bh
mov bp, word [esp + 0xd]
mov ax, 0x64a7
lea edx, [ecx + 0x9b]
pop word [esp + 5]
jmp 0x619918
mov ah, byte [esp]
lea edx, [edx + ebx]
push edx
mov edx, esi
rol ax, cl
bsr dx, bp
jmp 0x6199e8
pop bp
mov bp, 0xe0e3
btr ebp, edx
lea ebp, [eax + 0x31]
add esp, 0xf
lea esp, [esp + 3]
jmp 0x619956
not ax
xchg dword [esp + 2], ebp
sub esp, 0x10
lea eax, [eax + edi]
mov ebp, eax
pushal
jmp 0x6198fe
mov dh, byte [esp + 4]
mov bp, sp
xchg dword [esp + 1], ebp
mov dword [esp + 4], ebp
pop word [esp + 2]
jmp 0x619a1b
mov dword [esp + 5], ebp
pop dword [esp + 5]
pop word [esp + 7]
bsr dx, bp
jmp 0x6199b7
lea eax, [edx*4]
rdtsc
not ebp
xchg dh, al
mov ebp, dword [esp + 2]
sub esp, 0xc
jmp 0x6199d1
mov dh, 2
mov ah, byte [esp + 9]
add esp, 2
pop ebp
mov dx, 0x858d
xchg dh, al
jmp 0x6199a2
pop word [esp + 4]
setne dh
rdtsc
not dh
lea ebp, [ecx + ebx]
push dword [esp + 1]
jmp 0x619a6b
lea edx, [esi - 0x3b85884b]
pop ax
push word [esp + 0xd]
jmp 0x619856
bswap eax
mov al, 0x36
xchg byte [esp + 6], al
inc dh
pop dword [esp]
shl dx, cl
jmp 0x619a9b
inc ebp
mov dh, byte [esp + 6]
lea edx, [ebx + ebp]
xchg word [esp + 6], bp
mov al, ah
shl dx, cl
jmp 0x619a47
lea eax, [esi - 0x3e17835b]
mov edx, esi
push word [esp + 4]
add esp, 4
jmp 0x619aeb
mov dx, word [esp + 4]
mov dword [esp], ebp
pop word [esp]
mov dx, 0xc6f7
lea edx, [edx*4]
mov dword [esp], eax
jmp 0x619a7f
mov dx, 0xe50f
mov dl, dh
lea edx, [esi*4]
lea esp, [esp + 2]
cld
xchg byte [esp], dh
jmp 0x619ace
Function at 0x401560
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x41ee68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x48]
test eax, eax
jne 0x40160a
mov eax, dword [0x427af0]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.0041a132
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.0041a181
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.0041a10b
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4015f1
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x4015f1
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x48], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.00419e09
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4016e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov esi, ecx
push edi
xor ebx, ebx
or eax, 0xffffffff
push str.PSAPI
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi], 0x42071c
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [esi + 8], eax
je 0x401751
push str.EnumProcesses
push eax
mov dword [esi + 0xc], 0x100
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 8]
push str.EnumProcessModules
push eax
call edi
mov ecx, dword [esi + 8]
push str.GetModuleFileNameExA
push ecx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
push str.Kernel32
call ebp
cmp eax, ebx
mov dword [esi + 0x3c], eax
je 0x4017c2
push str.CreateToolhelp32Snapshot
push eax
mov dword [esi + 0x40], 0x128
mov dword [esi + 0x168], 0x224
call edi
mov edx, dword [esi + 0x3c]
push str.Process32First
push edx
mov dword [esi + 0x38c], eax
call edi
mov dword [esi + 0x390], eax
mov eax, dword [esi + 0x3c]
push str.Process32Next
push eax
call edi
mov ecx, dword [esi + 0x3c]
push str.Module32First
push ecx
mov dword [esi + 0x394], eax
call edi
mov edx, dword [esi + 0x3c]
push str.Module32Next
push edx
mov dword [esi + 0x398], eax
call edi
mov dword [esi + 0x39c], eax
push str.VDMDBG
call ebp
cmp eax, ebx
mov dword [esi + 0x3a0], eax
je 0x4017e1
push str.VDMEnumTaskWOWEx
push eax
call edi
mov dword [esi + 0x3a4], eax
mov ecx, esi
mov dword [esi + 4], ebx
call fcn.004018f0
mov ecx, eax
or ecx, 1
cmp eax, ecx
jne 0x4017fb
mov dword [esi + 4], 1
mov edx, eax
or edx, 2
cmp eax, edx
jne 0x40180b
mov dword [esi + 4], 2
mov ecx, eax
or ecx, 4
cmp eax, ecx
jne 0x401818
add dword [esi + 4], 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401ee0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
call fcn.0041d735
call fcn.0041d735
mov eax, dword [eax + 0xc]
push 0x81
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov dword [0x42b188], 0
call esi
test ah, 0x80
je 0x401f31
mov dword [0x42b18c], 2
pop esi
ret
push 0x10
call esi
test ah, 0x80
je 0x401f46
mov dword [0x42b18c], 1
pop esi
ret
push 0x12
call esi
and eax, 0x8000
pop esi
neg eax
sbb eax, eax
add eax, 4
mov dword [0x42b18c], eax
ret

Function at 0x402cf0
Capabilities:
Parse url

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x940
lea ecx, [esp + 0x140]
push ebx
push esi
push edi
push eax
push ecx
call fcn.00402b60
add esp, 8
lea edx, [esp + 0x14c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x958]
cmp eax, ecx
jle 0x402d5f
mov al, byte [esp + ecx + 0x14c]
lea edi, [esp + ecx + 0x14c]
cmp al, 0x2f
je 0x402d3d
cmp al, 0x5c
jne 0x402d3e
inc edi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ebx, dword [esp + 0x950]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x402d91
lea ecx, [esp + 0x14c]
push ecx
call fcn.00403370
mov edi, eax
add esp, 4
inc edi
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x950]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea eax, [esp + 0x14c]
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.http:__www.no.com_
push eax
call esi
lea ecx, [esp + 0x14c]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0x48]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x14c]
push eax
push 0x10000000
push 0
push ecx
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], 0x104
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
lea edx, [esp + 0x49]
push edx
push ebx
call esi
mov cl, byte [ebx]
pop edi
mov eax, ebx
pop esi
test cl, cl
pop ebx
je 0x402e1c
cmp byte [eax], 0x2f
jne 0x402e14
mov byte [eax], 0x5c
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x402e0c
add esp, 0x940
ret
Function at 0x403170
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x370
push ebx
push esi
push edi
mov edi, dword [esp + 0x388]
test edi, edi
je 0x403187
mov byte [edi], 0
mov ebx, dword [esp + 0x390]
test ebx, ebx
je 0x403195
mov byte [ebx], 0
mov esi, dword [esp + 0x384]
push 0x800
lea eax, [esp + 0x18]
push 0x160
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x4032c0
test dword [esp + 0x1c], 0x10000
je 0x4032c0
lea ecx, [esp + 0xc]
push ecx
push 0x422b48
push 1
push 0
push 0x422b38
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4032c0
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 0x422c08
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jl 0x4032b6
lea edx, [esp + 0x174]
push 0x104
push edx
push 0xffffffffffffffff
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x174]
push 0
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x4032ac
mov eax, dword [esp + 0x380]
test eax, eax
je 0x403246
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0xc]
push 2
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x4c]
test eax, eax
jl 0x4032ac
test edi, edi
je 0x403272
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x38c]
push 0
push 0
mov ecx, dword [eax]
push edx
push edi
push eax
call dword [ecx + 0xc]
test ebx, ebx
je 0x403289
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x394]
push edx
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x370
ret
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x370
ret

Function at 0x4032d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x104
call fcn.0041ab23
test eax, eax
je 0x4032e8
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x4032ea
xor eax, eax
push esi
mov esi, dword [esp + 0x10c]
lea ecx, [esp + 4]
push 0x104
push ecx
push 0
push 0
push esi
push eax
call fcn.00403170
add esp, 0x18
test eax, eax
jne 0x40332c
lea edx, [esp + 4]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 4]
push 0x5c
push eax
call fcn.00407ea0
add esp, 8
mov byte [eax], 0
call fcn.0041ab23
test eax, eax
je 0x40333e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x403340
xor eax, eax
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 4]
push 1
push ecx
push 0
push esi
push 0
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x20
pop esi
cmp ecx, eax
sbb eax, eax
neg eax
add esp, 0x104
ret
Function at 0x4047e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x41f148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x64]
test eax, eax
jne 0x40488a
mov eax, dword [0x427af0]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.0041a132
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.0041a181
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.0041a10b
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x404871
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x404871
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x64], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.00419e09
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4048a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x404902
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc

Function at 0x404b10
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push str.open
mov edi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x404c02
lea ecx, [esp + 0x10]
push ecx
push str..htm
push SysReAllocStringLen
mov ecx, edi
call fcn.004048a0
test eax, eax
jne 0x404c02
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push SysReAllocStringLen
mov ecx, edi
call fcn.004048a0
test eax, eax
jne 0x404c02
lea edx, [esp + 0x10]
push str.__1_
push edx
call fcn.00408420
mov esi, eax
add esp, 8
test esi, esi
jne 0x404bd3
lea eax, [esp + 0x10]
push 0x427874
push eax
call fcn.004083a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x404bd3
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x404bd6
mov byte [esi], 0
push 0x427870
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x405cf0
Capabilities:
Parse url

Disassembly:
push 0xffffffffffffffff
push 0x41f477
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 1
call fcn.00418a6d
mov eax, dword [esp + 0x168]
lea edi, [ebp + 0x9c]
push eax
mov ecx, edi
call fcn.00419f92
push 0x2e
mov ecx, edi
call fcn.00415076
test eax, eax
mov dword [esp + 0x14], eax
jl 0x405eef
lea ecx, [esp + 0x10]
lea esi, [ebp + 0x98]
push 3
push ecx
mov ecx, esi
call fcn.00414ffe
mov eax, dword [eax]
push 0x42795c
push eax
call fcn.00408060
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
sete bl
call fcn.00419e09
test bl, bl
je 0x405eb3
mov edx, dword [esi]
mov ecx, esi
mov eax, dword [edx - 8]
add eax, 0xfffffff2
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00414f82
lea esi, [ebp + 0xa0]
push eax
mov ecx, esi
mov dword [esp + 0x164], 0
call fcn.00419f42
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x160], ebx
call fcn.00419e09
push 0x427958
mov ecx, esi
call fcn.00415098
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.00414ffe
push eax
mov ecx, esi
mov dword [esp + 0x164], 1
call fcn.00419f42
lea ecx, [esp + 0x10]
mov dword [esp + 0x160], ebx
call fcn.00419e09
push 0x2e
mov ecx, esi
call fcn.00415076
lea edx, [esp + 0x10]
push eax
push edx
mov ecx, esi
call fcn.00414ffe
push eax
mov ecx, esi
mov dword [esp + 0x164], 2
call fcn.00419f42
lea ecx, [esp + 0x10]
mov dword [esp + 0x160], ebx
call fcn.00419e09
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x54]
lea ecx, [esp + 0x18]
mov dword [esp + 0x44], eax
mov eax, dword [esi]
push ecx
push SysReAllocStringLen
push 0
push eax
mov dword [esp + 0x28], 0x3c
mov dword [esp + 0x58], 0x104
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
push 0x5c
mov ecx, esi
call fcn.0041a1c9
lea edx, [esp + 0x10]
push eax
push edx
mov ecx, esi
call fcn.00414ffe
push eax
mov ecx, esi
mov dword [esp + 0x164], 3
call fcn.00419f42
lea ecx, [esp + 0x10]
mov dword [esp + 0x160], ebx
call fcn.00419e09
lea eax, [esp + 0x54]
mov ecx, esi
push eax
call fcn.0041a10b
jmp 0x405eef
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, edi
call fcn.00414ffe
push eax
lea ecx, [ebp + 0xa0]
mov dword [esp + 0x164], 4
call fcn.00419f42
lea ecx, [esp + 0x14]
mov dword [esp + 0x160], 0xffffffff
call fcn.00419e09
push 0
mov ecx, ebp
call fcn.00418a6d
mov ecx, dword [esp + 0x158]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x154
ret 4
Function at 0x406680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41f50e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 0x144]
mov ecx, edi
call fcn.004169fc
mov dword [edi], method.CWnd.virtual_0
mov eax, dword [esp + 0x2c]
xor ebx, ebx
push ebx
push eax
mov dword [esp + 0x20], ebx
mov dword [esi], fcn.00406970
mov dword [esi + 0x130], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x180], esi
mov dword [esi + 0x138], ebx
call fcn.00418325
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x134], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 8], edx
mov dword [0x42b258], eax
lea edx, [esi + 0x110]
mov dword [esi + 0x140], ecx
mov ecx, 8
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x134]
cmp eax, ebx
jne 0x406724
xor eax, eax
jmp 0x406727
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x10]
mov dword [edx], eax
mov edx, dword [esp + 0x24]
mov dword [esi + 0x118], ebx
mov dword [esi + 0x120], 5
mov dword [esi + 0x124], 0x4067c0
mov dword [esi + 0x11c], edx
mov dword [esi + 0x114], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18