joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4038f8
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov bl, 0x22
cmp byte [eax], bl
je 0x403908
add bl, 0xfe
mov cl, byte [eax + 1]
inc eax
xor edx, edx
cmp cl, dl
je 0x40391c
cmp cl, bl
je 0x40391c
mov cl, byte [eax + 1]
inc eax
jmp 0x40390e
cmp byte [eax], dl
je 0x403921
inc eax
push edx
push eax
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403a99
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x40b5ee]
test eax, eax
ja 0x403aac
and dword [0x40b5cc], 0
xor eax, eax
ret
push edi
push esi
mov esi, 0x800
cmp eax, esi
ja 0x403ab9
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll__lread]
push esi
push dword [0x40b5c8]
push dword [0x40afd0]
call edi
cmp dword [0x40afe0], 0
mov ecx, eax
mov dword [0x40b5cc], ecx
je 0x403b28
cmp ecx, 0xffffffff
je 0x403b28
cmp ecx, esi
je 0x403b39
test ecx, ecx
jl 0x403b28
mov ax, word [0x408918]
push dword [0x40afe4]
inc ax
push eax
call fcn.0040132a
mov ecx, dword [0x40b5cc]
test ecx, ecx
jne 0x403b21
push esi
push dword [0x40b5c8]
push dword [0x40afd0]
call edi
mov ecx, eax
mov dword [0x40b5cc], ecx
cmp ecx, 0xffffffff
je 0x403b28
mov esi, ecx
cmp ecx, esi
je 0x403b39
push 2
call fcn.00401c9a
mov ecx, dword [0x40b5cc]
sub dword [0x40b5ee], ecx
mov esi, dword [0x40b5c8]
cmp dword [0x40afd4], 0
mov dword [0x40b5fc], esi
je 0x403b7b
mov eax, ecx
mov edx, eax
dec eax
test edx, edx
je 0x403b7b
lea edi, [eax + 1]
call fcn.004052f0
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.00405306
inc esi
dec edi
pop ecx
jne 0x403b60
mov ecx, dword [0x40b5cc]
mov eax, ecx
dec ecx
pop esi
mov dword [0x40b5cc], ecx
pop edi
ret

Function at 0x405306
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x40b058]
xor eax, ecx
mov edx, 0xff
and eax, edx
push esi
shr ecx, 8
mov eax, dword [eax*4 + 0x40b0a0]
xor eax, ecx
mov ecx, dword [0x40b060]
mov dword [0x40b058], eax
and eax, edx
add eax, dword [0x40b05c]
mov esi, ecx
and esi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [0x40b05c], eax
shr eax, 0x18
xor esi, eax
shr ecx, 8
mov eax, dword [esi*4 + 0x40b0a0]
pop esi
xor eax, ecx
mov dword [0x40b060], eax
ret

Function at 0x4053ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [0x40afdc]
call fcn.00405361
pop ecx
lea eax, [ebp - 0xc]
push 0xc
push dword [ebp + 8]
push eax
call fcn.00401000
add esp, 0xc
xor edi, edi
lea esi, [ebp + edi - 0xc]
call fcn.004052f0
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.00405306
inc edi
pop ecx
cmp edi, 0xc
jl 0x405414
cmp dword [0x40afd8], 0
movzx ax, byte [ebp - 1]
je 0x405447
xor ecx, ecx
mov cl, byte [0x40b5e7]
jmp 0x405450
mov ecx, dword [0x40b5ea]
shr ecx, 0x18
cmp ax, cx
je 0x40545a
or eax, 0xffffffff
jmp 0x40545c
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4025c4
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402601
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402621
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00403584
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x4027c8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403428
test esi, esi
jne 0x4027fe
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403518
jmp 0x40281c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040267c
mov edi, eax
test esi, esi
je 0x40281c
cmp dword [ebx], 0
je 0x40281c
dec esi
jmp 0x402805
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402a28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x406010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402ac0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402aa0
xor eax, eax
push ebp
push 0x402a99
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402adc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402aa0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x406010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x406010], ax
mov esp, ebp
pop ebp
ret

Function at 0x4032ac
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x407034], 0
je 0x40330d
cmp word [0x407208], 0xd7b2
jne 0x4032d5
cmp dword [0x407210], 0
jbe 0x4032d5
mov eax, 0x407204
call dword [0x407220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x406058
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403334
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40601c], 0
jne 0x403329
push 0
push 0x406050
push 0x406058
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x403b60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403bc6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403584
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004028f8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403bb0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403bcd
lea eax, [ebp - 0x10]
call fcn.00403428
ret

Function at 0x40411c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.004028d8
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
cmp byte [0x407670], 0
je 0x40417b
cmp dword [0x4060a4], 2
jne 0x40417b
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x4042e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x404449
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004034c0
mov eax, dword [ebp - 0x10]
call fcn.00403fe4
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x404332
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00403808
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040456c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x404407
xor eax, eax
push ebp
push 0x404400
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004041b8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0040411c
test al, al
je 0x4043de
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403518
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4043de
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004037b0
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4043d8
mov eax, dword [ebp - 0x14]
call fcn.004037b0
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403548
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004042e0
dec ebx
cmp ebx, 0xffffffff
jne 0x404391
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404407
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004041b8
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.004037b0
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.004041a4
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404450
lea eax, [ebp - 0x3c]
call fcn.00403428
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040344c
ret
Function at 0x404407
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x404449
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004034c0
mov eax, dword [ebp - 0x10]
call fcn.00403fe4
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x404332
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00403808
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040456c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x404407
xor eax, eax
push ebp
push 0x404400
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004041b8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0040411c
test al, al
je 0x4043de
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403518
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4043de
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004037b0
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4043d8
mov eax, dword [ebp - 0x14]
call fcn.004037b0
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403548
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004042e0
dec ebx
cmp ebx, 0xffffffff
jne 0x404391
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404407
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004041b8
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.004037b0
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.004041a4
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404450
lea eax, [ebp - 0x3c]
call fcn.00403428
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040344c
ret

Function at 0x40481c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
call fcn.004037b0
push eax
push 0x800
lea eax, [ebp - 0x800]
push eax
mov eax, edi
call fcn.004037b0
push eax
mov eax, esi
call fcn.004037b0
push eax
mov eax, ebx
call fcn.004037b0
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x800]
mov eax, dword [ebp + 8]
call fcn.00403518
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402907
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x402916
pop dword [ebp - 0x18]
mov eax, 0xc9adcade
sub eax, 0xc96da1c8
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xbdc3ee57
add dword [ebp - 0x28], 0x908e56f4
mov dword [ebp - 0x24], 0x9890ee21
sub dword [ebp - 0x24], 0x665da1dc
mov dword [ebp - 0x20], 0x947a408e
add dword [ebp - 0x20], 0xb7d203a0
mov dword [ebp - 0x1c], 0xf4b735c
sub dword [ebp - 0x1c], 0xf4b735c
lea eax, [ebp - 0x28]
push eax
mov eax, 0x6a77592c
add eax, 0x95c916f0
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xaca31bf3
add dword [ebp - 0x28], 0xc7cf4d63
mov dword [ebp - 0x24], 0xd4a35d87
add dword [ebp - 0x24], 0x6cc903ee
mov dword [ebp - 0x20], 0xb6cde5e3
sub dword [ebp - 0x20], 0x535e7977
mov dword [ebp - 0x1c], 0xa46e5db1
sub dword [ebp - 0x1c], 0xa46e5db1
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x38580
push 0
call eax
mov ecx, 0x4a6a
xor esi, esi
add esi, eax
mov edx, 0x4e382563
add edx, 0xb208a29d
add edx, dword [ebp - 0x18]
mov ebx, 0x5bb48b8e
sub dword [ebp - 0x14], eax
mov edi, dword [edx]
add dword [ebp - 8], esi
sub edi, ebx
sub dword [ebp - 0x14], 0x758b80fa
mov dword [esi], edi
xor dword [ebp - 0x14], eax
add esi, 0xa63614e4
add esi, 0x59c9eb20
add edx, 0xf93ca8b9
add edx, 0x6c3574b
loop 0x402a29
add eax, 0x11c7b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x404635
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4069e0
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404654
mov al, 1
jmp 0x40471d
test esi, esi
je 0x40471b
xor ebx, ebx
cmp word [esi], bx
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x40471b
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00402907
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x40470f
lea eax, [ebp - 0x28]
push eax
call fcn.00402907
pop ecx
test al, al
jne 0x40470f
cmp dword [ebp - 0x18], esi
jbe 0x40470f
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40470f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x40470f
push 0x407620
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401788
mov al, bl
jmp 0x40471d
xor al, al
call fcn.004054b6
ret
Function at 0x4105b0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46ec2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004635be
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x410632
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046143c
mov eax, dword [eax]
push 0x4871d0
push eax
call fcn.004543b4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00463849
test bl, bl
je 0x410632
push 0x4871d0
lea ecx, [esp + 0xc]
call fcn.00463bd9
push 0x48ad4c
lea ecx, [esp + 0xc]
call fcn.00463bd9
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41066e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00463849
jmp 0x410739
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4106f2
lea edx, [esp + 0x7c]
push 0x48ad48
push edx
call fcn.004543b4
add esp, 8
test eax, eax
je 0x4106f2
lea eax, [esp + 0x7c]
push 0x48ad44
push eax
call fcn.004543b4
add esp, 8
test eax, eax
je 0x4106f2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410682
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00463849
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x410f50
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x410fb2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x410fc0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46ecab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x491260]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4110f8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x411026
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00463849
xor eax, eax
jmp 0x41116f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00463986
push esi
lea ecx, [esp + 0xc]
call fcn.00463c15
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41114d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00410f50
test eax, eax
jne 0x41114d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00410f50
test eax, eax
jne 0x41114d
lea eax, [esp + 0x14]
push 0x48ad60
push eax
call fcn.004553f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41112c
lea ecx, [esp + 0x14]
push 0x48ad5c
push ecx
call fcn.00455370
mov esi, eax
add esp, 8
test esi, esi
jne 0x41112c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41112f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00463936
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41103e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00463849
xor eax, eax
jmp 0x41116f
mov byte [esi], 0
push 0x48ad58
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00463849
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x424650
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x4246be
cmp si, 0x69
ja 0x4246be
add esi, 0xffd0
cmp si, 0x11
je 0x42468e
push 0x11
call edi
test ax, ax
jge 0x42468e
or esi, 0x2000
cmp si, 0x10
je 0x4246a3
push 0x10
call edi
test ax, ax
jge 0x4246a3
or esi, 0x4000
cmp si, 0x12
je 0x4246b8
push 0x12
call edi
test ax, ax
jge 0x4246b8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x4246cb
mov esi, 0xbd
jmp 0x42467f
cmp si, 0x6e
jne 0x4246d8
mov esi, 0xbe
jmp 0x42467f
cmp si, 0x6f
jne 0x424679
mov esi, 0xbf
jmp 0x42467f

Function at 0x425d70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4a18f8]
xor edx, edx
cmp eax, edx
jne 0x425d96
xor eax, eax
mov byte [eax + 0x4a17f8], al
inc eax
cmp eax, 0x100
jl 0x425d7e
mov dword [0x4a18f8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4a17f8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x425e27
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x425dfa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x425dc8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x425ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x425ef3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x425eda
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x470258
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x20]
call fcn.0046a29c
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub eax, esi
sub ecx, edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
call fcn.00429300
add esp, 0x14
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.0046a30e
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret