joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cef60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100cf030
push 0xffffffffffffffff
push 0x100e51d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10001840]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x100026c8]
cmp eax, 0xffffffff
jne 0x100cf069
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100cf076
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100cf0dd
jmp 0x100cf0ac
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100cf11a
test edi, edi
jne 0x100cf120
push 0x100cec30
push 0x100e79c0
call fcn.100ce8d0
mov eax, dword [0x100026c8]
add esp, 8
cmp eax, 0xffffffff
je 0x100cf0dd
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100cf106
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100cf106
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100cf158
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100cf149
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100cf120
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100cf0a0
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100cf1b7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100cf19c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100cf1b7
jmp 0x100cf190
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100cf190
jmp 0x100cf1b7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100cf1b5
cmp esi, dword [eax + 8]
jne 0x100cf1b5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100cf1a5
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100cf1cb
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100cf1cb
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100cec60
cmp esi, ebx
jne 0x100cf170
mov ebp, dword [esp + 0x14]
jmp 0x100cf0a0
Function at 0x100cf030
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100cf030
push 0xffffffffffffffff
push 0x100e51d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10001840]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x100026c8]
cmp eax, 0xffffffff
jne 0x100cf069
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100cf076
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100cf0dd
jmp 0x100cf0ac
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100cf11a
test edi, edi
jne 0x100cf120
push 0x100cec30
push 0x100e79c0
call fcn.100ce8d0
mov eax, dword [0x100026c8]
add esp, 8
cmp eax, 0xffffffff
je 0x100cf0dd
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100cf106
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100cf106
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100cf158
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100cf149
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100cf120
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100cf0a0
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100cf1b7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100cf19c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100cf1b7
jmp 0x100cf190
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100cf190
jmp 0x100cf1b7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100cf1b5
cmp esi, dword [eax + 8]
jne 0x100cf1b5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100cf1a5
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100cf1cb
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100cf1cb
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100cec60
cmp esi, ebx
jne 0x100cf170
mov ebp, dword [esp + 0x14]
jmp 0x100cf0a0
Function at 0x40710c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40715e
test eax, edx
je 0x407161
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x407121
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x407147
add ecx, 4
js 0x407137
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x407144
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x40716d
test edx, edx
jne 0x407114
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40a05c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a095
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004043d8
jmp 0x40a09e
mov eax, ebx
mov edx, esi
call fcn.0040433c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a0a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a0ca
movzx eax, byte [esp]
jmp 0x40a0cc
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a75c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a5d4
mov eax, dword [0x416c08]
cmp byte [eax], 0
je 0x40a7d8
mov eax, dword [0x416b1c]
call fcn.004030d4
call fcn.00402edc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407958
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a820
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a80e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x416af8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4197f0]
call fcn.004052f4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x4134a0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404558
add esp, 0x104
pop ebx
ret
Function at 0x40e7f0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a2ac
xor eax, eax
push ebp
push 0x40e8b0
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040b318
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040b4c8
mov eax, dword [ebx]
call fcn.0040e6a0
test al, al
jne 0x40e88d
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040b318
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040b4c8
mov eax, dword [ebx]
call fcn.0040e6a0
test al, al
jne 0x40e88d
mov eax, ebx
call fcn.0040a1c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e8b7
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040a228
lea eax, [ebp - 4]
call fcn.0040a1c8
ret

Function at 0x4103b4
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x415048
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00415034
add esp, 0x208
pop ebx
ret

Function at 0x41b6fc
Capabilities:
Hash data using murmur3

Disassembly:
arpl word [edx - 0x28a70e7f], si
jg 0x41b708
call fcn.0043af1d
rol esi, 1
xor ecx, ecx
add cl, al
mov byte [ecx], 0x33
leave
inc eax
test ecx, eax
jbe 0x41b714
dec esi
xor ebx, eax
xchg edx, esi
and eax, ecx
sub edx, ebp
add ecx, edx
xor esi, 0x9309f865
cmp dword [0x6c6cce], 0x88971574
js 0x41b732
test eax, ebx
jp 0x41b737
shl edx, 0x1f
shr edx, 0xd
cmp dword [0x6c5719], ecx
ja fcn.0041b744
mov esi, esp

Function at 0x41b744
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
inc edx
mov ecx, 0x5b867ab4
not edx
shr esi, 0x1c
not edi
or eax, eax
add dword [0x6ce7f0], edi
ror edi, 9
shr ebx, 4
ror eax, 0xa
call fcn.004b431c
sub edx, 0x5286034d
xchg ebx, eax
xor eax, esi
sub eax, ebx
sub edx, dword [0x6c720a]
dec ecx
jne 0x41b74a
rol ecx, 5
mov edx, esi
and edx, ecx
shr esi, 0x12
cmp dword [0x6c7677], esp
add byte [edx + 6], bh
sub esi, dword [0x6c5e22]
neg edx
mov edi, 0x657e8fae
cmp eax, esp
jno 0x41b7a3
ror esi, 0xd
test esp, ebp
jg 0x41b7ac
mov ebx, 0x82703931
mov ecx, 0x37cc6d57
invalid
invalid
invalid
Function at 0x41b78c
Capabilities:
Hash data using murmur3

Disassembly:
inc edx
mov ecx, 0x5b867ab4
not edx
shr esi, 0x1c
not edi
or eax, eax
add dword [0x6ce7f0], edi
ror edi, 9
shr ebx, 4
ror eax, 0xa
call fcn.004b431c
sub edx, 0x5286034d
xchg ebx, eax
xor eax, esi
sub eax, ebx
sub edx, dword [0x6c720a]
dec ecx
jne 0x41b74a
rol ecx, 5
mov edx, esi
and edx, ecx
shr esi, 0x12
cmp dword [0x6c7677], esp
add byte [edx + 6], bh
sub esi, dword [0x6c5e22]
neg edx
mov edi, 0x657e8fae
cmp eax, esp
jno 0x41b7a3
ror esi, 0xd
test esp, ebp
jg 0x41b7ac
mov ebx, 0x82703931
mov ecx, 0x37cc6d57
invalid
invalid
invalid

Function at 0x422268
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4222c1
test eax, edx
je 0x4222c4
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x42227f
movzx eax, word [eax]
sub eax, ecx
jmp 0x4222a6
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4222a7
add ecx, 4
js 0x422297
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4222a4
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4222a6
xor eax, eax
ret
test eax, eax
je 0x4222d0
test edx, edx
jne 0x422270
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4237a8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x4237d5
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x4238a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0040b278
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x423912
test ah, 4
je 0x42390b
test bl, bl
jne 0x4238d0
mov al, 1
jmp 0x423939
test al, 0x10
je 0x4238d8
xor eax, eax
jmp 0x423939
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x4238fc
push eax
call sub.kernel32.dll_CloseHandle
mov al, 1
jmp 0x423939
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x423939
test al, 0x10
sete al
jmp 0x423939
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x423933
cmp ebx, 3
je 0x423933
cmp ebx, 0x7b
je 0x423933
mov eax, esi
call fcn.00423868
test al, al
jne 0x423937
xor eax, eax
jmp 0x423939
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x423a20
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.0040b278
mov ebp, eax
push ebp
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x423a75
call sub.kernel32.dll_GetLastError
mov edi, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x423a6f
test ah, 4
je 0x423a6f
test al, 0x10
je 0x423a6f
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x423a75
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c6478
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x4c6480
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4e62b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040b278
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.004e5d84
test al, al
jne 0x4e6311
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6ce1d4]
mov dl, 1
mov eax, dword [0x4e4ab8]
call fcn.00429100
call fcn.004098c4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004e5cec
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ed6cc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4ed6d2
Function at 0x60d530
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x60d538
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x60d629
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.005c75e4
mov edx, dword [ebp - 8]
mov ecx, 0x60d644
xor eax, eax
call fcn.0060d294
push 0
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x60d5f7
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x60d552
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov ax, 0x3d
call fcn.005cd508
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0042302c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.005c857c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov ax, 0x81
call fcn.005cd4d8
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x41ba8c]
call fcn.00429008
call fcn.004098c4
jmp 0x60d552
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040a5a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60d630
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040a228
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a228
Function at 0x419ee0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49169b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00485a6d
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x419f62
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048388d
mov eax, dword [eax]
push 0x5361f4
push eax
call fcn.00475b54
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00485cf8
test bl, bl
je 0x419f62
push 0x5361f4
lea ecx, [esp + 0xc]
call fcn.00486088
push 0x539d6c
lea ecx, [esp + 0xc]
call fcn.00486088
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x419f9e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00485cf8
jmp 0x41a069
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41a022
lea edx, [esp + 0x7c]
push 0x539d68
push edx
call fcn.00475b54
add esp, 8
test eax, eax
je 0x41a022
lea eax, [esp + 0x7c]
push 0x539d64
push eax
call fcn.00475b54
add esp, 8
test eax, eax
je 0x41a022
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419fb2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00485cf8
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41a860
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41a8c2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x41a8d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49171b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5434f4]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x41aa08
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x41a936
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00485cf8
xor eax, eax
jmp 0x41aa7f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00485e35
push esi
lea ecx, [esp + 0xc]
call fcn.004860c4
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41aa5d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.0041a860
test eax, eax
jne 0x41aa5d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.0041a860
test eax, eax
jne 0x41aa5d
lea eax, [esp + 0x14]
push 0x539d80
push eax
call fcn.00476ca0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41aa3c
lea ecx, [esp + 0x14]
push 0x539d7c
push ecx
call fcn.00476c20
mov esi, eax
add esp, 8
test esi, esi
jne 0x41aa3c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41aa3f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00485de5
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41a94e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00485cf8
xor eax, eax
jmp 0x41aa7f
mov byte [esi], 0
push 0x539d78
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00485cf8
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4