joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451d30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x451d44
add esp, 0xfffffff0
call fcn.00408b14
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44bdcc]
call fcn.0046fb58
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x450d6c]
call fcn.00472928

Function at 0x4b6e34
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4b6e77
cmp byte [ebx + 0x11], 0
jne 0x4b6e77
cmp byte [ebx + 0x24], 0
jne 0x4b6e77
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b6e8e
mov ecx, dword [0x4fed28]
mov dl, 1
mov eax, dword [0x489a6c]
call fcn.004295dc
call fcn.004099c8
pop ebx
ret
mov ecx, dword [0x4fed28]
mov dl, 1
mov eax, dword [0x489a6c]
call fcn.004295dc
call fcn.004099c8
pop ebx
ret

Function at 0x4b77fc
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b784a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b6ce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b7863
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b786c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b6ce0
dec esi
jne 0x4b788e
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x4d7da8
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
xor ebx, ebx
cmp dword [esp], 0
je 0x4d7e0d
mov eax, dword [esp]
call fcn.004d805c
test al, al
je 0x4d7e0d
mov eax, dword [esp]
call fcn.004d7e68
mov esi, eax
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
dec esi
mov eax, dword [esp]
movzx eax, word [eax + esi*2]
mov edx, eax
mov ecx, eax
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x4d7df0
mov edx, eax
and dx, 0xffdf
mov eax, edx
cmp ax, 0x41
jb 0x4d7e0d
cmp ax, 0x5a
ja 0x4d7e0d
sub al, 0x41
mov ecx, eax
shr edi, cl
and edi, 1
cmp edi, 1
sete bl
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4e183c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
and eax, 0xff
shr ecx, 8
inc edx
xor ecx, dword [eax*4 + 0x4fc134]
cmp edx, 4
mov eax, ecx
jl 0x4e1844
pop ebp
ret

Function at 0x4e1860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
inc edx
shr eax, 0x18
and eax, 0xff
shl ecx, 8
xor ecx, dword [eax*4 + 0x4fc534]
cmp edx, 4
mov eax, ecx
jl 0x4e1868
pop ebp
ret
Function at 0x4efe60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040adb4
push eax
call sub.kernel32.dll_GetEnvironmentVariableW
test eax, eax
jns 0x4efe87
call fcn.00408148
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4efecd
mov edx, dword [ebp - 0xc]
sub edx, 1
jno 0x4efe9d
call fcn.00408150
mov eax, dword [ebp - 8]
call fcn.0040af28
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x4efeb1
call fcn.00408148
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040adb4
push eax
mov eax, dword [ebp - 4]
call fcn.0040adb4
push eax
call sub.kernel32.dll_GetEnvironmentVariableW
jmp 0x4efed5
mov eax, dword [ebp - 8]
call fcn.0040a350
mov esp, ebp
pop ebp
ret

Function at 0x4efedc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4eff6f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040a788
lea eax, [ebp - 0x10]
call fcn.0040a8a8
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00407d7c
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0040adb4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eff76
lea eax, [ebp - 0x10]
call fcn.0040a350
pop eax
jmp eax
Function at 0x4eff80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4eff88
push ecx
xor eax, eax
push ebp
push 0x4f00f6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x2af8
call sub.kernel32.dll_Sleep
call fcn.004efd94
cmp al, 1
jne 0x4f00bf
lea edx, [ebp - 8]
mov eax, 0x4f0110
call fcn.004efe60
lea edx, [ebp - 0x14]
mov eax, 0x4f0134
call fcn.004efe60
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x4f015c
call fcn.0040b000
push dword [ebp - 8]
push 0x4f018c
push 0x4f019c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040b088
mov eax, dword [ebp - 0x18]
mov dl, 1
call fcn.00422c98
test al, al
je 0x4f0016
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x4f0025
mov dl, 1
mov eax, dword [0x4e2644]
call fcn.004e9600
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
mov ecx, 0x4f0204
mov edx, dword [ebp - 0xc]
call fcn.0040b000
mov eax, dword [ebp - 0x1c]
mov dl, 0x14
call fcn.004efc1c
lea eax, [ebp - 0x20]
mov ecx, 0x4f0204
mov edx, dword [ebp - 0xc]
call fcn.0040b000
mov eax, dword [ebp - 0x20]
call fcn.004e8e28
test al, al
je 0x4f00cc
lea eax, [ebp - 0x24]
mov ecx, 0x4f0204
mov edx, dword [ebp - 0xc]
call fcn.0040b000
mov edx, dword [ebp - 0x24]
mov cl, 1
mov eax, dword [ebp - 0x10]
call fcn.004e96b4
lea eax, [ebp - 0x28]
mov ecx, 0x4f018c
mov edx, dword [ebp - 8]
call fcn.0040b000
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.004eaa9c
mov eax, dword [ebp - 0x10]
call fcn.004e9828
push dword [ebp - 8]
push 0x4f018c
push 0x4f019c
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.0040b088
mov eax, dword [ebp - 0x2c]
call fcn.004efedc
jmp 0x4f00cc
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f00fd
lea eax, [ebp - 0x2c]
mov edx, 7
call fcn.0040a3b0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040a3b0
pop eax
jmp eax

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x432004]
jne 0x401010
repz ret
jmp fcn.0040176d

Function at 0x40655b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004032f4
and dword [ebp - 4], 0
cmp dword [0x4340dc], 0
mov ebx, eax
jne 0x40660c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4066bd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4066bd
push eax
call fcn.00403282
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4340dc], eax
call esi
push eax
call fcn.00403282
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4340e0], eax
call esi
push eax
call fcn.00403282
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4340e4], eax
call esi
push eax
call fcn.00403282
pop ecx
mov dword [0x4340ec], eax
test eax, eax
je 0x40660c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403282
pop ecx
mov dword [0x4340e8], eax
mov eax, dword [0x4340e8]
cmp eax, ebx
je 0x406664
cmp dword [0x4340ec], ebx
je 0x406664
push eax
call fcn.004032fd
push dword [0x4340ec]
mov esi, eax
call fcn.004032fd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406664
test edi, edi
je 0x406664
call esi
test eax, eax
je 0x40665b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40665b
test byte [ebp - 0xc], 1
jne 0x406664
or dword [ebp + 0x10], 0x200000
jmp 0x40669d
mov eax, dword [0x4340e0]
cmp eax, ebx
je 0x40669d
push eax
call fcn.004032fd
pop ecx
test eax, eax
je 0x40669d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40669d
mov eax, dword [0x4340e4]
cmp eax, ebx
je 0x40669d
push eax
call fcn.004032fd
pop ecx
test eax, eax
je 0x40669d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4340dc]
call fcn.004032fd
pop ecx
test eax, eax
je 0x4066bd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4066bf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42c6a4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x442044]
push dword [0x441d60]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x42c733
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x42c75d
push esi
and dword [ebp - 4], 0
lea esi, [ebp - 4]
call fcn.0042c728
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x42c740
pop esi
cmp dword [ebp + 0xc], 0x2d
pop edi
jne 0x42c775
or dword [0x442054], 0xffffffff
mov dword [0x442050], 0xa62e7790
leave
ret
Function at 0x10004a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10004a98
cmp byte [esi + ebx - 1], 0xa
je 0x10004a6c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100170a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x100050c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10005298
mov edi, dword [0x100170a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x100051a7
test byte [0x100060a8], 8
jne 0x10005240
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x100060b8], 8
jne 0x10005200
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10005149
cmp esi, 3
jbe 0x100051b8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1000515a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x100129a0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10005149
mov dword [esp], 0x100060b8
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10005120
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10005120
mov dword [esp], 0x100060a8
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000510b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10005113
mov eax, 0xffffffff
jmp 0x100051a7
Function at 0x10005360
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100170c0]
test eax, eax
je 0x10005418
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x100053a0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1000538c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000544d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100170c0], eax
sub esp, 8
test eax, eax
jne 0x1000537d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1000538e
Function at 0x10005460
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x100055f0
mov eax, dword [esi]
test eax, eax
je 0x100055d8
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x100055fc
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x100055c8
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x1000558c
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x100054c6
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x100055f2
Function at 0x1003d630
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x100ce14b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.100c2d93
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x1003d6b2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.100c0ca5
mov eax, dword [eax]
push 0x10107c74
push eax
call fcn.100b2c84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.100c301e
test bl, bl
je 0x1003d6b2
push 0x10107c74
lea ecx, [esp + 0xc]
call fcn.100c33ae
push 0x10107c80
lea ecx, [esp + 0xc]
call fcn.100c33ae
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x1003d6ee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.100c301e
jmp 0x1003d7b9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x1003d772
lea edx, [esp + 0x7c]
push 0x10107c7c
push edx
call fcn.100b2c84
add esp, 8
test eax, eax
je 0x1003d772
lea eax, [esp + 0x7c]
push 0x10107c78
push eax
call fcn.100b2c84
add esp, 8
test eax, eax
je 0x1003d772
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1003d702
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.100c301e
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x1003dfc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1003e022
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x1003e030
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x100ce1cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x1011c4e8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x1003e168
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x1003e096
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.100c301e
xor eax, eax
jmp 0x1003e1df
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.100c315b
push esi
lea ecx, [esp + 0xc]
call fcn.100c33ea
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x1003e1bd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.1003dfc0
test eax, eax
jne 0x1003e1bd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.1003dfc0
test eax, eax
jne 0x1003e1bd
lea eax, [esp + 0x14]
push 0x10107c90
push eax
call fcn.100b3dd0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1003e19c
lea ecx, [esp + 0x14]
push 0x10107c8c
push ecx
call fcn.100b3d50
mov esi, eax
add esp, 8
test esi, esi
jne 0x1003e19c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x1003e19f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.100c310b
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1003e0ae
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.100c301e
xor eax, eax
jmp 0x1003e1df
mov byte [esi], 0
push 0x10107c88
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.100c301e
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4