joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454760
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2820
call fcn.00457810
mov eax, dword [esp + 0x2824]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x20]
push str..PhysicalDrive_d
push ecx
call fcn.00458512
add esp, 0xc
lea edx, [esp + 0x1c]
push 0
push 0
push 3
push 0
push 3
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x45490d
xor eax, eax
mov ecx, 0x9c4
mov dword [esp + 0x10], eax
lea edi, [esp + 0x11c]
mov dword [esp + 0x14], eax
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x124]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0x2710
push edx
lea eax, [esp + 0x20]
push 0xc
push eax
push 0x2d1400
push esi
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x45490d
mov ecx, dword [esp + 0x283c]
mov edx, dword [esp + 0x128]
push ecx
push 0
lea eax, [esp + 0x124]
push edx
push eax
call fcn.00454920
mov ecx, dword [esp + 0x2848]
mov edx, dword [esp + 0x13c]
push ecx
push 0
lea eax, [esp + 0x134]
push edx
push eax
call fcn.00454920
mov ecx, dword [esp + 0x2860]
mov edx, dword [esp + 0x150]
push ecx
push 0
lea eax, [esp + 0x144]
push edx
push eax
call fcn.00454920
mov ecx, dword [esp + 0x2864]
mov edx, dword [esp + 0x164]
push ecx
push 1
lea eax, [esp + 0x154]
push edx
push eax
call fcn.00454920
mov ecx, dword [esp + 0x2884]
add esp, 0x40
xor eax, eax
lea edi, [esp + 0x11c]
mov dword [ecx], 1
mov ecx, 0x9c4
lea edx, [esp + 0xc]
push eax
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x124]
push 0x2710
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
test eax, eax
je 0x45490d
mov edi, dword [esp + 0x124]
mov edx, dword [esp + 0x2848]
mov eax, dword [esp + 0x284c]
xor ecx, ecx
cmp edi, 0xc
push esi
setne cl
inc ecx
mov dword [edx], ecx
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x13c]
mov dword [eax], ecx
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2820
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2820
ret

Function at 0x468cf2
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x468d2a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00466d7c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00466d54
jmp 0x468d36
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x46a3e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46a422
call fcn.0046fe94
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46a422
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46a419
xor eax, eax
jmp 0x46a42a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046a430
pop edi
pop esi
pop ebx
ret 4

Function at 0x4703c4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4703f2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x470410
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047032a
jmp 0x470410
mov eax, dword [esi + 0x14]
test eax, eax
je 0x470410
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047032a
test edi, edi
mov eax, edi
jne 0x4703fa
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40e4c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x473eab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x80c63c]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40e5f8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40e526
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00468765
xor eax, eax
jmp 0x40e66f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004688a2
push esi
lea ecx, [esp + 0xc]
call fcn.00468b31
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40e64d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push 0x80000000
call fcn.0040e450
test eax, eax
jne 0x40e64d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x80000000
mov ecx, edi
call fcn.0040e450
test eax, eax
jne 0x40e64d
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.00459db0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e62c
lea ecx, [esp + 0x14]
push 0x805d60
push ecx
call fcn.00459d30
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e62c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40e62f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00468852
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40e53e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00468765
xor eax, eax
jmp 0x40e66f
mov byte [esi], 0
push 0x805d5c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00468765
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x429cb0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x429e48
cmp ebp, ebx
jle 0x429e48
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x429d0e
dec eax
or eax, 0xfffffff8
inc eax
je 0x429d15
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, 0x80000001
jns 0x429d24
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x429d2b
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.004684a6
add esp, 4
cmp eax, ebx
je 0x429d4c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.004684a6
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x429e3e
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x429e25
mov al, byte [edx]
cmp al, 0xc0
jbe 0x429e11
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x429e06
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x429e14
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x429e14
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x429db0
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x429da1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x434cc0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x476138
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
call fcn.0042f5c0
test eax, eax
je 0x434dc8
lea ecx, [esp + 0xc]
call fcn.00402b70
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0042f5c0
mov ecx, eax
call fcn.0042cd80
test eax, eax
je 0x434daf
mov eax, dword [esp + 0x1c]
test eax, eax
mov ebp, eax
je 0x434daf
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x434daf
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
neg esi
push edi
push ebx
sbb esi, esi
and esi, edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebp
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00402d70
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop edi
jne 0x434d91
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x434daf
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [0x81d188]
push ebx
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x7f0c40
call fcn.00402d70
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
Function at 0x437b40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4763c8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x437b79
inc eax
mov dword [esi + 0x10], eax
jmp 0x437c8c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x437b8d
mov eax, 0xffffffc7
jmp 0x437c8e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x437b9e
cmp dword [esi + 8], eax
jne 0x437b8d
cmp dword [esi + 8], eax
jne 0x437bb7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x437bb7
mov eax, 0xffffffc7
jmp 0x437c8e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x437bcb
push eax
mov ecx, ebx
call fcn.00437370
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00402b70
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x437bfc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00402b90
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00436ae0
test eax, eax
mov dword [esp + 0x38], eax
je 0x437c2f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x7f0c40
call fcn.00402d70
mov eax, dword [esp + 0x38]
jmp 0x437c8e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.004379a0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x437c73
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.004379c0
mov esi, eax
test esi, esi
jne 0x437ca3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.004379a0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x437c45
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x7f0c40
call fcn.00402d70
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x7f0c40
call fcn.00402d70
mov eax, esi
jmp 0x437c8e

Function at 0x43adc0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x43ae20
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x43ae20
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x43ae20
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x43ae20
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x43ae60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x46ab0c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46ab44
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00468bc0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00468b98
jmp 0x46ab50
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46c1fa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46c23c
call fcn.00471cf1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46c23c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46c233
xor eax, eax
jmp 0x46c244
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046c24a
pop edi
pop esi
pop ebx
ret 4

Function at 0x472221
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47224f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47226d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00472187
jmp 0x47226d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47226d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00472187
test edi, edi
mov eax, edi
jne 0x472257
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x477a0c
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
jmp 0x477a3b
pushal
jmp 0x477a4d
call 0x477a59
scasd eax, dword es:[edi]
salc
or esi, 0x5e2cc0ea
jmp 0x477a8a
add esi, 0xffffff8e
jmp 0x477aa0
cmp dword [esi], 0
stc
jb 0x477ad2
retf 0xaa2d
je 0x477ca5
clc
jae 0x477ae9
wait
fbstp tbyte [ebx + eax*2 + 0x1c]
invalid
mov edi, esi
jmp 0x477af2
add esi, 4
jmp 0x477b21
push ecx
xchg dword [edi - 0x13], esp
fmul st(3)
dec eax
xor dword [esi - 0x74677f55], 0x832feb06
invalid
mov eax, dword [esi]
jmp 0x477b54
add eax, esi
clc
jae 0x477b7c
push ds
jo 0x477b15
iretd
mov edx, dword [esi + 4]
jmp 0x477b99
sub dword [eax], 0xedcd0ee1
jmp 0x477bbe
add eax, 4
jmp 0x477bef
sub edx, 1
jmp 0x477c07
jne 0x477b7f
jmp 0x477c14
add esi, 8
jmp 0x477c3f
sub dword [edi], 1
stc
jb 0x477c55
pushal
and esp, dword [ebp - 0x42fdf750]
add dword [ecx + 0x587f920a], 0x61
inc eax
movsb byte es:[edi], byte [esi]
jne 0x477af5
clc
jmp 0x477c81
mov ebx, esi
stc
jb 0x477ca0
xor al, 0xb6
popal
cmp eax, 0x3f6befbf
cdq
clc
shl dword [esi], 0x6b
pushal
leave
cmp eax, 0x2ea4bbc4
lodsb al, byte [esi]
or ebx, eax
imul ebp, eax, 0xf
call fcn.00477cb4
jmp 0x477caa
popal
jmp 0x477caf
jmp fcn.00457fed
Function at 0x477a59
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
jmp 0x477a3b
pushal
jmp 0x477a4d
call 0x477a59
scasd eax, dword es:[edi]
salc
or esi, 0x5e2cc0ea
jmp 0x477a8a
add esi, 0xffffff8e
jmp 0x477aa0
cmp dword [esi], 0
stc
jb 0x477ad2
retf 0xaa2d
je 0x477ca5
clc
jae 0x477ae9
wait
fbstp tbyte [ebx + eax*2 + 0x1c]
invalid
mov edi, esi
jmp 0x477af2
add esi, 4
jmp 0x477b21
push ecx
xchg dword [edi - 0x13], esp
fmul st(3)
dec eax
xor dword [esi - 0x74677f55], 0x832feb06
invalid
mov eax, dword [esi]
jmp 0x477b54
add eax, esi
clc
jae 0x477b7c
push ds
jo 0x477b15
iretd
mov edx, dword [esi + 4]
jmp 0x477b99
sub dword [eax], 0xedcd0ee1
jmp 0x477bbe
add eax, 4
jmp 0x477bef
sub edx, 1
jmp 0x477c07
jne 0x477b7f
jmp 0x477c14
add esi, 8
jmp 0x477c3f
sub dword [edi], 1
stc
jb 0x477c55
pushal
and esp, dword [ebp - 0x42fdf750]
add dword [ecx + 0x587f920a], 0x61
inc eax
movsb byte es:[edi], byte [esi]
jne 0x477af5
clc
jmp 0x477c81
mov ebx, esi
stc
jb 0x477ca0
xor al, 0xb6
popal
cmp eax, 0x3f6befbf
cdq
clc
shl dword [esi], 0x6b
pushal
leave
cmp eax, 0x2ea4bbc4
lodsb al, byte [esi]
or ebx, eax
imul ebp, eax, 0xf
call fcn.00477cb4
jmp 0x477caa
popal
jmp 0x477caf
jmp fcn.00457fed
Function at 0x411640
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x499f7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048c851
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4116c2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048a12e
mov eax, dword [eax]
push 0x4ba208
push eax
call fcn.0046a704
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0048cadc
test bl, bl
je 0x4116c2
push 0x4ba208
lea ecx, [esp + 0xc]
call fcn.0048ceb8
push 0x4bdd84
lea ecx, [esp + 0xc]
call fcn.0048ceb8
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4116fe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0048cadc
jmp 0x4117c9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x411782
lea edx, [esp + 0x7c]
push 0x4bdd80
push edx
call fcn.0046a704
add esp, 8
test eax, eax
je 0x411782
lea eax, [esp + 0x7c]
push 0x4bdd7c
push eax
call fcn.0046a704
add esp, 8
test eax, eax
je 0x411782
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x411712
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0048cadc
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x411fc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x412022
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x412030
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x499ffb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4c6ee0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x412168
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x412096
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048cadc
xor eax, eax
jmp 0x4121df
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0048cc65
push esi
lea ecx, [esp + 0xc]
call fcn.0048cef4
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4121bd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00411fc0
test eax, eax
jne 0x4121bd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00411fc0
test eax, eax
jne 0x4121bd
lea eax, [esp + 0x14]
push 0x4bdd98
push eax
call fcn.0046b8c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41219c
lea ecx, [esp + 0x14]
push 0x4bdd94
push ecx
call fcn.0046b840
mov esi, eax
add esp, 8
test esi, esi
jne 0x41219c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41219f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0048cc15
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4120ae
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048cadc
xor eax, eax
jmp 0x4121df
mov byte [esi], 0
push 0x4bdd90
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0048cadc
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4