joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dd10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00402290
add esp, 8
mov esi, eax
push 0x1010
push str.Pageant_Fatal_Error
push esi
push dword [0x476470]
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.004028b0
add esp, 4
push 1
call fcn.0043e20f
int3

Function at 0x41dec0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x41df12
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_run___.100s___Error:__d
call fcn.00402220
add esp, 0xc
mov esi, eax
push 0x30
push str.Pageant
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.004028b0
add esp, 4
pop esi
pop ebp
ret
Function at 0x41dfa0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4745fc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x47514c], 0
je 0x41e186
lea eax, [ebp - 0x218]
push eax
push str.SoftwareSimonTathamPuTTYSessions
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41e186
push esi
push edi
push dword [0x475144]
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov esi, eax
cmp esi, dword [0x475154]
jle 0x41e018
mov edi, dword [sym.imp.USER32.dll_RemoveMenu]
nop dword [eax]
push 0x400
push 0
push dword [0x475144]
call edi
dec esi
cmp esi, dword [0x475154]
jg 0x41e000
push 0x104
lea eax, [ebp - 0x10c]
xor edi, edi
push eax
push edi
push dword [ebp - 0x218]
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x41e12b
push ebx
mov ebx, 0x1000
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.0041df20
add esp, 0xc
lea ecx, [ebp - 0x10c]
mov eax, str.Default_20Settings
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41e090
test dl, dl
je 0x41e08c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41e090
add ecx, 2
add eax, 2
test dl, dl
jne 0x41e070
xor eax, eax
jmp 0x41e095
sbb eax, eax
or eax, 1
test eax, eax
je 0x41e108
lea eax, [ebp - 0x214]
mov dword [ebp - 0x248], 0x30
mov dword [ebp - 0x224], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x248]
movlpd qword [ebp - 0x234], xmm0
push eax
push 1
push edi
push dword [0x475144]
movlpd qword [ebp - 0x22c], xmm0
movlpd qword [ebp - 0x220], xmm0
mov dword [ebp - 0x244], 0x13
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], ebx
call dword [sym.imp.USER32.dll_InsertMenuItemA]
inc edi
add ebx, 0x10
push 0x104
lea eax, [ebp - 0x10c]
inc esi
push eax
push esi
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x41e043
pop ebx
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
pop esi
jne 0x41e186
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 0x30
push eax
push 1
push 0
push dword [0x475144]
mov dword [ebp - 0x244], 0x11
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 3
mov dword [ebp - 0x224], str._No_sessions_
call dword [sym.imp.USER32.dll_InsertMenuItemA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f285
mov esp, ebp
pop ebp
ret
Function at 0x41e750
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0x475178], 0
jne 0x41e87d
push esi
push str.advapi32.dll
mov dword [0x475178], 1
call fcn.0041c1f0
add esp, 4
mov dword [0x475180], eax
test eax, eax
je 0x41e874
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetSecurityInfo
push eax
call esi
mov dword [0x476428], eax
test eax, eax
je 0x41e874
mov eax, dword [0x475180]
test eax, eax
je 0x41e7b7
push str.SetSecurityInfo
push eax
call esi
mov ecx, eax
mov eax, dword [0x475180]
jmp 0x41e7b9
xor ecx, ecx
mov dword [0x476424], ecx
test ecx, ecx
je 0x41e874
test eax, eax
je 0x41e7dc
push str.OpenProcessToken
push eax
call esi
mov ecx, eax
mov eax, dword [0x475180]
jmp 0x41e7de
xor ecx, ecx
mov dword [0x476438], ecx
test ecx, ecx
je 0x41e874
test eax, eax
je 0x41e801
push str.GetTokenInformation
push eax
call esi
mov ecx, eax
mov eax, dword [0x475180]
jmp 0x41e803
xor ecx, ecx
mov dword [0x476434], ecx
test ecx, ecx
je 0x41e874
test eax, eax
je 0x41e822
push 0x46a254
push eax
call esi
mov ecx, eax
mov eax, dword [0x475180]
jmp 0x41e824
xor ecx, ecx
mov dword [0x476430], ecx
test ecx, ecx
je 0x41e874
test eax, eax
je 0x41e843
push 0x46a274
push eax
call esi
mov ecx, eax
mov eax, dword [0x475180]
jmp 0x41e845
xor ecx, ecx
mov dword [0x47642c], ecx
test ecx, ecx
je 0x41e874
test eax, eax
je 0x41e85d
push str.SetEntriesInAclA
push eax
call esi
jmp 0x41e85f
xor eax, eax
mov dword [0x476420], eax
test eax, eax
je 0x41e874
mov eax, 1
mov dword [0x47517c], eax
pop esi
ret
xor eax, eax
mov dword [0x47517c], eax
pop esi
ret
mov eax, dword [0x47517c]
ret

Function at 0x448d97
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044897e

Function at 0x448da2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00448b08

Function at 0x44ba93
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044b967

Function at 0x44e7a9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044e16b
Function at 0x4021f5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x40a6c4], 0
push esi
jne 0x40222c
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x402206
mov dword [ecx*4 + 0x40a6c0], eax
inc ecx
cmp ecx, 0x100
jl 0x402201
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40225d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x40a6c0]
xor eax, esi
inc ecx
dec edx
jne 0x40223f
pop edi
not eax
pop esi
ret 0xc
Function at 0x403c2f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 0xf003f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x403ca4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x403c7d
cmp dword [ebp + 0x10], ebx
jne 0x403cab
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00403c2f
test eax, eax
jne 0x403c8f
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x403c64
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x403ca4
Function at 0x403e31
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
test esi, esi
mov dword [ebp - 8], edi
jne 0x403e4e
mov dword [ebp - 8], CreateFontIndirectA
and dword [ebp - 4], 0
mov ebx, esi
test esi, esi
jne 0x403e5d
mov ebx, 0x41a030
mov eax, dword [ebp + 8]
test eax, eax
jl 0x403e74
mov ecx, dword [0x422030]
push 0
add ecx, eax
push ecx
call fcn.00403ffb
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.00403fc9
test eax, eax
je 0x403fb7
test byte [ebp + 0x17], 0x80
je 0x403f54
push 0x40c470
call fcn.00401000
and dword [ebp + 0x14], 0x7fffffff
jle 0x403fbf
mov edi, 0x416030
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x403eba
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403fc9
test eax, eax
je 0x403fb7
sub dword [ebp + 0x14], esi
mov dword [0x40c470], edi
mov dword [0x40c474], esi
mov eax, dword [ebp - 8]
push 0x40c470
mov dword [0x40c478], ebx
mov dword [0x40c47c], eax
call fcn.00401031
xor ecx, ecx
mov dword [ebp - 0xc], eax
cmp eax, ecx
jl 0x403f4c
mov eax, dword [0x40c478]
mov esi, eax
sub esi, ebx
je 0x403f41
cmp dword [ebp + 0x10], ecx
jne 0x403f27
lea eax, [ebp + 8]
push ecx
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403f50
cmp dword [ebp + 8], esi
jne 0x403f50
add dword [ebp - 4], esi
jmp 0x403f39
sub dword [ebp - 8], esi
add dword [ebp - 4], esi
cmp dword [ebp - 8], 1
mov ebx, eax
jl 0x403fbf
cmp dword [ebp - 0xc], 1
jne 0x403ed8
jmp 0x403fbf
cmp dword [ebp + 0x14], ecx
jg 0x403ead
jmp 0x403fbf
push 0xfffffffffffffffc
jmp 0x403fb9
push 0xfffffffffffffffe
jmp 0x403fb9
test esi, esi
jne 0x403fa0
cmp dword [ebp + 0x14], esi
jle 0x403fbf
mov edi, 0x416030
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403f6d
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403fc9
test eax, eax
je 0x403fb7
lea eax, [ebp + 0x10]
push 0
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403f50
cmp esi, dword [ebp + 0x10]
jne 0x403f50
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403f62
jmp 0x403fbf
cmp dword [ebp + 0x14], edi
mov esi, dword [ebp + 0x14]
jl 0x403faa
mov esi, edi
push esi
push dword [ebp + 0x10]
call fcn.00403fc9
test eax, eax
jne 0x403fbc
push 0xfffffffffffffffd
pop eax
jmp 0x403fc2
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x406582
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
xor esi, esi
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
stosd dword es:[edi], eax
pop ecx
xor eax, eax
push dword [ebp + 0xc]
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4065ba
test al, 0x10
jne 0x4065bd
mov dword [ebp + 0xc], esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4065ec
cmp dword [ebp - 0xc], esi
je 0x4065e9
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret 8

Function at 0x406623
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040673a
test eax, eax
je 0x406672
cmp dword [ebp + 0xc], 0
push esi
je 0x40666c
and dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 3
call sub.KERNEL32.dll_lstrlenA
and byte [eax + esi + 1], 0
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], esi
push eax
mov word [ebp - 0x10], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
jmp 0x406672
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
push 0xffffffffffffffef
call fcn.00405fd1
pop esi
leave
ret 8
Function at 0x40685c
Capabilities:
Get common file path
Get file size

Disassembly:
sub esp, 0xc
and dword [esp], 0
push ebx
push ebp
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov edi, dword [esp + 0x24]
test esi, esi
je 0x4068ac
push str.MoveFileExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40689a
push 5
push edi
push dword [esp + 0x28]
call eax
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esp + 0x10], 0
jne 0x406a47
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov esi, 0x400
test edi, edi
mov ebp, 0x424f60
je 0x4068d8
push 1
push 0
push edi
call fcn.00406840
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebp
push edi
call ebx
jmp 0x4068e2
mov dword [0x424f60], 0x4c554e
push esi
mov esi, 0x424b60
push esi
push dword [esp + 0x28]
call ebx
push esi
push ebp
push str._s_s_r_n
push 0x424760
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov dword [esp + 0x20], ebx
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
push eax
push 0x8000080
push 4
push eax
push eax
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x14], edi
je 0x406a47
xor esi, esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
push esi
lea eax, [ebx + ebp + 0xa]
push eax
push esi
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [esp + 0x18], eax
je 0x406a2f
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, esi
je 0x406a25
push str._Rename__r_n
push ebx
call fcn.004067c8
cmp eax, esi
jne 0x4069aa
lea eax, [ebx + ebp]
push str._Rename__r_n
push eax
call sub.KERNEL32.dll_lstrcpyA
add ebp, 0xa
jmp 0x4069ff
add eax, 0xa
push 0x409344
push eax
call fcn.004067c8
mov esi, eax
test esi, esi
je 0x4069fd
mov edi, ebx
sub edi, esi
add edi, ebp
push edi
call fcn.00406614
push edi
push esi
push eax
mov dword [esp + 0x30], eax
call fcn.0040681c
push edi
mov eax, dword [esp + 0x24]
push dword [esp + 0x28]
add eax, esi
push eax
call fcn.0040681c
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
sub esi, ebx
mov edi, dword [esp + 0x14]
mov eax, esi
xor esi, esi
jmp 0x406a01
xor esi, esi
mov eax, ebp
push dword [esp + 0x20]
add eax, ebx
push 0x424760
push eax
call fcn.0040681c
push ebx
add ebp, dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esp + 0x10], 1
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x406a55
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406ab3
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 8]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406aa2
cmp dword [ebp + 8], 1
je 0x406aa4
mov byte [esi], bl
push dword [ebp + 0x14]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x406b89
Capabilities:
Check if file exists
Get common file path
Get file attributes
Persist via run registry key

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, 0x42b780
mov esi, edi
jmp 0x406d13
mov ebx, esi
mov ecx, 0x400
sub ebx, edi
cmp ebx, ecx
jge 0x406d21
movzx ebx, al
inc edx
cmp ebx, 0xdb
mov dword [esp + 0x14], edx
jge 0x406bc2
mov byte [esi], bl
inc esi
jmp 0x406d17
cmp ebx, 0xff
jne 0x406bd5
mov al, byte [edx]
mov byte [esi], al
inc esi
inc edx
jmp 0x406d17
lea eax, [ebx - 0xdb]
cmp eax, 0x23
ja case.default.0x406beb
movzx eax, byte [eax + 0x406d4d]
jmp dword [eax*4 + 0x406d2d]
push dword [0x42cbc8]
push esi
call fcn.00406adb
jmp case.default.0x406beb
lea eax, [ebx - 0xdc]
shl eax, 0xa
add eax, 0x425380
push eax
jmp 0x406cf2
and byte [0x4092d1], 0
push esi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call fcn.00406a55
cmp byte [esi], 0
jne case.default.0x406beb
push str.C:Program_Files
jmp 0x406cf2
mov ebp, dword [ebx*4 + 0x408f14]
push ebp
push 0x409307
call sub.KERNEL32.dll_lstrcpyA
xor eax, eax
cmp ebx, 0xfa
setne al
and eax, dword [0x42cbe4]
mov edi, eax
test edi, edi
mov byte [0x4092d1], 0x5c
mov eax, str.Common
jne 0x406c7d
mov eax, ebp
push esi
push eax
xor eax, eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
test edi, edi
setne al
add eax, 0x80000001
push eax
call fcn.00406a55
cmp byte [esi], 0
jne 0x406cae
test edi, edi
je 0x406ca3
xor edi, edi
jmp 0x406c6b
push 0x42bf80
push esi
call sub.KERNEL32.dll_lstrcpyA
cmp ebx, 0xfa
jne case.default.0x406beb
push str.MicrosoftInternet_ExplorerQuick_Launch
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je case.0x406beb.251
test al, 0x10
jne 0x406d00
push 0x42bf80
jmp 0x406cf2
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp case.default.0x406beb
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp case.default.0x406beb
push 0x40c068
push esi
call sub.KERNEL32.dll_lstrcpyA
cmp ebx, 0xf0
jle 0x406d06
push esi
call fcn.00406d71
push esi
call sub.KERNEL32.dll_lstrlenA
add esi, eax
mov edi, 0x42b780
mov edx, dword [esp + 0x14]
mov al, byte [edx]
test al, al
jne 0x406b99
and byte [esi], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x40e0c0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4992db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048ddd1
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40e142
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048bcab
mov eax, dword [eax]
push 0x4b7c9c
push eax
call fcn.0047ddf4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0048e05c
test bl, bl
je 0x40e142
push 0x4b7c9c
lea ecx, [esp + 0xc]
call fcn.0048e3ec
push 0x4b7ca8
lea ecx, [esp + 0xc]
call fcn.0048e3ec
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40e17e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0048e05c
jmp 0x40e249
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40e202
lea edx, [esp + 0x7c]
push 0x4b7ca4
push edx
call fcn.0047ddf4
add esp, 8
test eax, eax
je 0x40e202
lea eax, [esp + 0x7c]
push 0x4b7ca0
push eax
call fcn.0047ddf4
add esp, 8
test eax, eax
je 0x40e202
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e192
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0048e05c
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40ea40
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40eaa2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40eab0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49935b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4c8d64]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40ebe8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40eb16
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048e05c
xor eax, eax
jmp 0x40ec5f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0048e199
push esi
lea ecx, [esp + 0xc]
call fcn.0048e428
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40ec3d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040ea40
test eax, eax
jne 0x40ec3d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040ea40
test eax, eax
jne 0x40ec3d
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.0047ed80
mov esi, eax
add esp, 8
test esi, esi
jne 0x40ec1c
lea ecx, [esp + 0x14]
push 0x4b7cb4
push ecx
call fcn.0047ed00
mov esi, eax
add esp, 8
test esi, esi
jne 0x40ec1c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40ec1f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0048e149
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40eb2e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048e05c
xor eax, eax
jmp 0x40ec5f
mov byte [esi], 0
push 0x4b7cb0
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0048e05c
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4