joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb18210
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax + 4], edx
xor esi, esi
mov ebx, 0xb6da48
mov al, byte [ebx]
dec eax
xor edx, edx
mov dl, al
mov ecx, edx
and ecx, 0x1f
push ecx
mov ecx, 0x1f
pop edi
sub ecx, edi
mov edi, 1
shl edi, cl
shr edx, 5
mov eax, dword [esp]
and edi, dword [eax + edx*4]
je 0xb1828b
mov eax, esi
and eax, 0x8000001f
jns 0xb1826a
dec eax
or eax, 0xffffffe0
inc eax
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, esi
test edx, edx
jns 0xb18281
add edx, 0x1f
sar edx, 5
mov ecx, dword [esp + 4]
or dword [ecx + edx*4], eax
inc esi
inc ebx
cmp esi, 0x30
jne 0xb18235
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xb189d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], eax
lea esi, [esp + 8]
mov edi, 0xb6de48
mov byte [esp + 4], 4
mov ebp, dword [esp]
add ebp, 2
mov cl, 4
mov edx, ebp
mov eax, edx
mov dword [esi], eax
mov eax, dword [esi]
movzx eax, byte [eax]
mov al, byte [edi + eax]
mov ebx, dword [esi]
mov byte [ebx], al
inc edx
dec cl
jne 0xb189f2
add ebp, 4
dec byte [esp + 4]
jne 0xb189ee
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb18a18
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], eax
lea esi, [esp + 8]
mov edi, 0xb6df48
mov byte [esp + 4], 4
mov ebp, dword [esp]
add ebp, 2
mov cl, 4
mov edx, ebp
mov eax, edx
mov dword [esi], eax
mov eax, dword [esi]
movzx eax, byte [eax]
mov al, byte [edi + eax]
mov ebx, dword [esi]
mov byte [ebx], al
inc edx
dec cl
jne 0xb18a3a
add ebp, 4
dec byte [esp + 4]
jne 0xb18a36
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb18b68
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], eax
mov byte [esp + 8], 4
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0xc], eax
mov bl, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0xb18b8b
xor ebx, ebx
lea esi, [esp + 4]
mov eax, dword [esp + 0xc]
mov edi, eax
mov dl, byte [esi]
mov al, 2
call fcn.00b18b2c
push eax
mov ebp, ebx
and ebp, 0xff
mov eax, ebp
inc eax
and eax, 3
mov dl, byte [esp + eax + 8]
mov al, 3
call fcn.00b18b2c
pop edx
xor dl, al
mov eax, ebp
add eax, 2
and eax, 3
xor dl, byte [esp + eax + 4]
add ebp, 3
and ebp, 3
xor dl, byte [esp + ebp + 4]
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0xb18ba3
inc dword [esp + 0xc]
dec byte [esp + 8]
jne 0xb18b81
lea eax, [esp + 4]
mov edx, 4
call fcn.00b17730
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xb288d4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
setg al
cbw
push edx
rdtsc
movzx eax, ax
push ebx
cwde
pushfd
jmp loc.017e6f20
Function at 0xb3a45c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0xb3a465
mov eax, dword [ebp - 4]
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa03c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb3a92c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
lea eax, [ebp - 0x18]
call fcn.00a14db0
xor ecx, ecx
mov dl, 1
mov eax, dword [0xb09074]
call fcn.00b0afec
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0xb3a8ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0b0d8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0xb3a458
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0xb3a43c
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x8c], edx
mov dword [eax + 0x88], 0xb3a440
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x90]
mov dl, byte [0xb3a940]
call fcn.00b0a4ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00aecc40
test al, al
je 0xb3a53c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0a944
jmp 0xb3a54a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0a9c4
mov eax, dword [ebp - 4]
movzx edx, word [eax + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00b0aa44
xor eax, eax
push ebp
push 0xb3a5b1
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0a904
jmp 0xb3a599
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0xb74238]
mov eax, dword [eax]
call fcn.00a779d0
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x30], 0
jne 0xb3a5a7
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xfa0
jbe 0xb3a57a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xb3a5bb
jmp 0x1794e02
Function at 0xb4dae4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [esi], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0x40
call fcn.00b4d320
test al, al
jne 0xb4db20
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4dee4
mov dword [esi], 1
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x5a4d
je 0xb4db42
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dee4
mov dword [esi], 2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
add eax, 0xf8
cdq
push edx
push eax
call fcn.00b4d320
test al, al
jne 0xb4db71
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4dee4
mov dword [esi], 3
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x4550
je 0xb4dbab
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dee4
mov dword [esi], 4
mov eax, dword [ebp - 0x10]
cmp word [eax + 4], 0x14c
je 0xb4dbcb
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dee4
mov dword [esi], 5
mov eax, dword [ebp - 0x10]
test byte [eax + 0x38], 1
je 0xb4dbe9
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dee4
mov dword [esi], 6
xor eax, eax
push ebp
push 0xb4decf
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x17c2ffd
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0xb51848
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov esi, dword [0xb74054]
xor eax, eax
push ebp
push 0xb519c5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [0xb74238]
mov eax, dword [eax]
call fcn.00a7824c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00a1a6a4
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
lea edx, [esi + 0xdf8]
call fcn.00a15024
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 4]
pop edx
call fcn.00a150cc
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0xa792a0]
call fcn.00a79350
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xb5199b
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [esi + 0x3d]
push eax
mov ecx, 0xb519dc
mov edx, 0xb519f0
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x14]
xor eax, eax
mov al, byte [esi + 0x3c]
push eax
mov ecx, 0xb51a04
mov edx, 0xb519f0
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov al, byte [esi + 0x3f]
push eax
mov ecx, 0xb51a18
mov edx, 0xb519f0
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x14]
mov al, byte [esi + 0x3e]
push eax
mov ecx, 0xb51a28
mov edx, 0xb519f0
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x14]
mov al, byte [esi + 0x30]
push eax
mov ecx, 0xb51a3c
mov edx, 0xb519f0
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, dword [0xb744a8]
mov eax, dword [eax]
push eax
mov ecx, 0xb51a50
mov edx, 0xb519f0
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx + 0x38c]
push eax
mov ecx, 0xb51a64
mov edx, 0xb519f0
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebx + 0x390]
push eax
mov ecx, 0xb51a74
mov edx, 0xb519f0
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb519a2
cmp dword [ebp - 8], 0
je 0xb5199a
mov eax, dword [ebp - 8]
call fcn.00a13f44
ret
Function at 0xb5e954
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0xb5e95c
push ecx
push ebx
push esi
mov eax, 0xb5e2fc
call fcn.00a17380
mov esi, dword [0xb74238]
xor eax, eax
push ebp
push 0xb5eb2e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00a13098
cmp eax, 2
jne 0xb5e9ed
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00a13100
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.00a19d98
call fcn.00aef550
mov ebx, 0x64
lea edx, [ebp - 0x18]
mov eax, 2
call fcn.00a13100
mov eax, dword [ebp - 0x18]
call fcn.00a15280
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.00a13100
mov eax, dword [ebp - 0x1c]
call fcn.00a1a250
test al, al
je 0xb5e9ed
push 0xa
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0xb5e9af
mov al, byte [0xb5eb3c]
push eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00a13100
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 0xb5eb48
call fcn.00a1f378
mov eax, dword [ebp - 0x20]
call fcn.00a15280
push eax
push 0
push 0
call fcn.00a176e8
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0xb5ea64
push 0x40
push 0xb5eb4c
lea edx, [ebp - 0x2c]
mov eax, dword [0xb7431c]
call fcn.00a170b0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00ad11c0
mov eax, dword [ebp - 0x28]
call fcn.00a15280
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0xb5eb13
mov dl, 1
mov eax, dword [0xa29c6c]
call fcn.00a13f14
mov edx, dword [0xb74230]
mov dword [edx], eax
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00aec108
test al, al
jne 0xb5ea96
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00a13f44
jmp 0xb5eb13
mov eax, dword [esi]
call fcn.00a77af4
lea edx, [ebp - 0x34]
mov eax, dword [esi]
call fcn.00a7824c
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00a1a6a4
mov eax, dword [ebp - 0x30]
call fcn.00a1a9f8
mov ecx, dword [0xb74070]
mov eax, dword [esi]
mov edx, dword [0xb501d0]
call fcn.00a77b0c
mov ecx, dword [0xb743f4]
mov eax, dword [esi]
mov edx, dword [0xb5d1f8]
call fcn.00a77b0c
mov ecx, dword [0xb74108]
mov eax, dword [esi]
mov edx, dword [0xb5c3fc]
call fcn.00a77b0c
mov ecx, dword [0xb742d4]
mov eax, dword [esi]
mov edx, dword [0xb5b45c]
call fcn.00a77b0c
mov eax, dword [esi]
call fcn.00a77b8c
push ebx
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb5eb35
lea eax, [ebp - 0x34]
mov edx, 9
call fcn.00a14dd4
ret
Function at 0x1001347b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1001348a
pop dword [ebp - 0x28]
mov eax, 0x366715c9
add eax, 0xd99a1ec1
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xe8ce3336
sub dword [ebp - 0x38], 0x9a7bedeb
mov dword [ebp - 0x34], 0x696eee5b
add dword [ebp - 0x34], 0xc8c45dea
mov dword [ebp - 0x30], 0x4bed02e
sub dword [ebp - 0x30], 0xb8728c00
mov dword [ebp - 0x2c], 0x6d667cdb
sub dword [ebp - 0x2c], 0x6d667cdb
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xfd9b3fcd
sub dword [ebp - 0x38], 0x8928d677
mov dword [ebp - 0x34], 0x59d4872f
sub dword [ebp - 0x34], 0x186825ba
mov dword [ebp - 0x30], 0x8e9a0316
add dword [ebp - 0x30], 0xd4d56956
mov dword [ebp - 0x2c], 0x13c89a6d
sub dword [ebp - 0x2c], 0x13c89a6d
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x5549043f
sub eax, 0x4547043f
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3fb13
push 0
call eax
mov ecx, 0xcbcdfd5d
add ecx, 0x3432563e
xor ebx, ebx
add ebx, eax
mov esi, 0xabdf64e0
add esi, 0x64235720
add esi, dword [ebp - 0x28]
mov edx, 0x50cd1ac1
sub edx, 0xe1b5924a
mov dword [ebp - 4], 0xa1aa673b
mov edi, dword [esi]
sub dword [ebp - 0x1c], 0x394c3572
add edi, edx
xor dword [ebp - 8], 0xd00ca19f
mov dword [ebx], edi
add dword [ebp - 0x10], esi
add ebx, 0x83118baa
sub ebx, 0x83118ba6
add esi, 4
loop 0x100135a9
add eax, 0x60959aec
sub eax, 0x609459ad
mov ebx, eax
add eax, 0x343491be
add eax, 0xcbcb6e47
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x403e59
pop dword [ebp - 0x10]
mov eax, 0xf5bad7cd
add eax, 0xa85668c
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x8a63bdd9
add dword [ebp - 0x20], 0xc3ee8772
mov dword [ebp - 0x1c], 0x9fefe785
add dword [ebp - 0x1c], 0x924364c0
mov dword [ebp - 0x18], 0x2a84d7f
add dword [ebp - 0x18], 0x49a3f6af
mov dword [ebp - 0x14], 0xd9494679
add dword [ebp - 0x14], 0x26b6b987
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x714a05c
sub dword [ebp - 0x20], 0x92a23706
mov dword [ebp - 0x1c], 0x6be84965
sub dword [ebp - 0x1c], 0x2a7be7f0
mov dword [ebp - 0x18], 0xc3bfb5ea
sub dword [ebp - 0x18], 0x6050497e
mov dword [ebp - 0x14], 0x9fad6f39
add dword [ebp - 0x14], 0x605290c7
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x8e38dea8
add eax, 0x72079200
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3d401
push 0
call eax
mov ecx, 0x1d0ec4d5
add ecx, 0xe2f19d2e
xor edx, edx
add edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x10]
mov edi, 0x9d57a177
xor dword [ebp - 8], 0x1e77b8a
mov esi, dword [ebx]
sub dword [ebp - 4], eax
sub esi, edi
mov dword [ebp - 0xc], 0xebc052ab
mov dword [edx], esi
xor dword [ebp - 0xc], 0xb2097aaa
add edx, 0x250a3b6b
add edx, 0xdaf5c499
add ebx, 0x6dda1532
sub ebx, 0x6dda152e
loop 0x403f6c
add eax, 0x9e566726
add eax, 0x61ab13b9
mov ebx, eax
add eax, 5
mov ecx, 0x23c56f57
sub ecx, 0x23856f57
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10025c73
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10025c82
pop dword [ebp - 0x20]
mov eax, 0xd54a894c
add eax, 0x3ab7d336
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xda4bfbea
sub dword [ebp - 0x30], 0x8bf9b69f
mov dword [ebp - 0x2c], 0x34788e4
add dword [ebp - 0x2c], 0x2eebc361
mov dword [ebp - 0x28], 0xcc2d2cc
add dword [ebp - 0x28], 0x3f897162
mov dword [ebp - 0x24], 0xca82dca1
add dword [ebp - 0x24], 0x357d235f
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x4086e269
sub dword [ebp - 0x30], 0xcc147913
mov dword [ebp - 0x2c], 0xfdb579ef
add dword [ebp - 0x2c], 0x43b6e786
mov dword [ebp - 0x28], 0xe4047911
sub dword [ebp - 0x28], 0x80950ca5
mov dword [ebp - 0x24], 0xf2493f3c
sub dword [ebp - 0x24], 0xf2493f3c
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x3dd2d421
add eax, 0xd2307d43
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3ffa2
push 0
call eax
mov ecx, 0xce28265f
sub ecx, 0xce27cae8
mov edi, eax
mov ebx, 0x8525d8b4
sub ebx, 0x751d54b4
add ebx, dword [ebp - 0x20]
mov esi, 0x5533ab6
add dword [ebp - 0x1c], eax
mov edx, dword [ebx]
add dword [ebp - 4], ecx
sub edx, esi
xor dword [ebp - 0x18], 0xe2e6389f
mov dword [edi], edx
add dword [ebp - 0x10], 0xa4beaae2
add edi, 4
add ebx, 0xa786a9d4
add ebx, 0x58795630
loop 0x10025d99
add eax, 0x2c2ace32
sub eax, 0x2c296d83
xor ebx, ebx
add ebx, eax
add eax, 0x6c991f73
add eax, 0x9366e092
mov ecx, 0x1ad3ba5a
add ecx, 0xf52c45a6
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x409d30
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47b98b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046e2cc
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x409db2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046bab0
mov eax, dword [eax]
push 0x4dc210
push eax
call fcn.0045dc44
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046e557
test bl, bl
je 0x409db2
push 0x4dc210
lea ecx, [esp + 0xc]
call fcn.0046e933
push 0x4dfd74
lea ecx, [esp + 0xc]
call fcn.0046e933
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x409dee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046e557
jmp 0x409eb9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x409e72
lea edx, [esp + 0x7c]
push 0x4dfd70
push edx
call fcn.0045dc44
add esp, 8
test eax, eax
je 0x409e72
lea eax, [esp + 0x7c]
push 0x4dfd6c
push eax
call fcn.0045dc44
add esp, 8
test eax, eax
je 0x409e72
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409e02
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046e557
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a6b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a712
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40a720
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47ba0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4e7268]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40a858
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40a786
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046e557
xor eax, eax
jmp 0x40a8cf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046e6e0
push esi
lea ecx, [esp + 0xc]
call fcn.0046e96f
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x4dfdac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40a8ad
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040a6b0
test eax, eax
jne 0x40a8ad
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040a6b0
test eax, eax
jne 0x40a8ad
lea eax, [esp + 0x14]
push 0x4dfd88
push eax
call fcn.0045ed20
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a88c
lea ecx, [esp + 0x14]
push 0x4dfd84
push ecx
call fcn.0045eca0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a88c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40a88f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046e690
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40a79e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046e557
xor eax, eax
jmp 0x40a8cf
mov byte [esi], 0
push 0x4dfd80
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046e557
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41e940
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41e9ae
cmp si, 0x69
ja 0x41e9ae
add esi, 0xffd0
cmp si, 0x11
je 0x41e97e
push 0x11
call edi
test ax, ax
jge 0x41e97e
or esi, 0x2000
cmp si, 0x10
je 0x41e993
push 0x10
call edi
test ax, ax
jge 0x41e993
or esi, 0x4000
cmp si, 0x12
je 0x41e9a8
push 0x12
call edi
test ax, ax
jge 0x41e9a8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41e9bb
mov esi, 0xbd
jmp 0x41e96f
cmp si, 0x6e
jne 0x41e9c8
mov esi, 0xbe
jmp 0x41e96f
cmp si, 0x6f
jne 0x41e969
mov esi, 0xbf
jmp 0x41e96f

Function at 0x420020
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4f80a0]
xor edx, edx
cmp eax, edx
jne 0x420046
xor eax, eax
mov byte [eax + 0x4f7fa0], al
inc eax
cmp eax, 0x100
jl 0x42002e
mov dword [0x4f80a0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4f7fa0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4200d7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4200aa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x420078
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x420150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4201a3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x42018a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret