joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21a4e9c
Capabilities:
Authenticate hmac

Disassembly:
push eax
push ebp
mov byte [esp], dl
lodsb al, byte [esi]
bt bp, cx
rol al, 6
mov byte [esp], ch
stc
stc
sub al, 0x10
call fcn.021a4cee
jmp 0x12461bf
pushfd
pushfd
lea esp, [esp + 0x10]
jb 0x1ee2c72
pushfd
push ebx
cmp byte [edi - 1], 0
pushfd
pushfd
lea esp, [esp + 0x10]
jne 0x1edf3a1
not di
bsf di, cx
mov edi, dword [edx + 0x24]
jmp 0x21a94a8
test ah, 0x5a
pushal
test dh, al
add edi, eax
mov byte [esp + 4], 0x26
movzx ecx, word [edi + ecx*2]
inc di
sal di, cl
mov edi, dword [edx + 0x1c]
clc
bt di, 1
pushal
call fcn.021a7a03

Function at 0x21a4fae
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0x10]
jne fcn.01ee3e1e
cmp bl, 0x32
rcl ch, 5
jmp 0x1ee09cf

Function at 0x21a5170
Capabilities:
Authenticate hmac

Disassembly:
pushfd
mov byte [esp], 0x16
lea esp, [esp + 8]
jne 0x1edf3a1
not di
pushfd
xor di, ax
mov edi, dword [edx + 0x24]
clc
clc
add edi, eax
test ecx, ebx
movzx ecx, word [edi + ecx*2]
sub esp, 0xfffffffc

Function at 0x21a5ae4
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0x28]
jne 0x21a9fa3
test dh, ah
pushal
mov ecx, dword [ebx]
bt ax, dx
pushal
mov byte [esp + 8], 0x1c
clc
or ecx, ecx
push dword [esp]
push 0x1b16ee7d
lea esp, [esp + 0x48]
je 0x21a9fa3
lea edi, [ecx + 0x7e0d1c71]
jmp 0x21a760e
mov dword [esp + 0xc], ebx
lahf
lea eax, sym.imp.KERNEL32.dll_LocalFree
pushfd
push 0x3e60c931
mov dword [esp + 0x10], 0x1edc467
pushfd
push 0xaa9fa0ec
call fcn.01ee6396
stc
cmc
pushal
stc
or eax, eax
pushfd
push 0xafe7704a
jmp 0x1ee6b14
lea edx, [ebp - 0x1e09bec2]
lea edx, [ebx + 4]
call fcn.0124632e

Function at 0x21a670b
Capabilities:
Authenticate hmac

Disassembly:
push dword [esp + 4]
push esi
adc ecx, ecx
call fcn.021b28cc

Function at 0x21a6717
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0x14]
jae 0x1ee3e2d
bt bx, 7
xor cx, sp
movzx bx, dl
mov ebx, eax
rol cl, 5
rcl edi, 0xe
bsr di, cx
mov edi, eax
ror cx, 4
ror ecx, cl
sal ecx, 0x1a
bt sp, 8
mov ecx, 0x104
jmp 0x21b2b41
bt esp, ebp
sub al, al
cmc
pushal
repne scasb al, byte es:[edi]
call fcn.01edfbc3

Function at 0x21a7268
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
push 0xda124677
lea esp, [esp + 0x14]
je fcn.01ee3e1e
sete dh
rol dh, cl
mov esi, dword [eax + 0x3c]
shl dl, 5
rcr dl, cl
add esi, eax
pushal
mov edx, dword [esi + 0x78]
clc
test edx, edx
pushfd
lea esp, [esp + 0x24]
je fcn.01ee3e1e
rol cl, cl
mov cx, dx
bts cx, 1
seta cl
add edx, eax
btc cx, dx
rol ch, cl
mov ch, ch
movzx ecx, al
mov ecx, dword [esi + 0x7c]
call fcn.021a6af3
pushal
call fcn.01ee22f9
clc
mov ebx, eax
pushfd
jmp 0x21b1758
pushal
clc
cmp byte [edi], 0x23
call fcn.01ee6911

Function at 0x21a7a03
Capabilities:
Authenticate hmac

Disassembly:
add edi, eax
stc
mov byte [esp + 4], bl
cmc
mov edi, dword [edi + ecx*4]
jmp 0x21a9f83
jmp 0x1ee2faa

Function at 0x21a85d0
Capabilities:
Authenticate hmac

Disassembly:
pushf
pop word [esp + 2]
clc
jmp 0x1ee0fec

Function at 0x21a949e
Capabilities:
Authenticate hmac

Disassembly:
pushfd
shl al, cl
mov al, 0x2e
call fcn.021a8600
Function at 0x21a9f97
Capabilities:
Authenticate hmac

Disassembly:
cwde
mov eax, dword [ebp + 8]
stc
test eax, eax
call fcn.01edcc86

Function at 0x21ac781
Capabilities:
Authenticate hmac

Disassembly:
add ecx, 1
push 0xdc53c6ea
sub esp, 0xffffffc0
ja 0x1ee0255
clc
clc
test ah, ah
push 0x3694b500
jmp 0x21ac24d
bt edx, ebp
test ah, ah
push ebp
lea esp, [esp + 4]
jne 0x21ac8d6
jmp 0x1ee3270
and dword [edi + edx - 0x215cf202], edi
invalid
mov ah, 0x1b
sub ah, cl
add ch, byte [eax]
fidiv dword [ecx]
cli
and al, 0x2f
push 0x74886057
and al, 8
push edi
pushal
mov byte [esp + 8], dh
push 0x168fbc80
pushfd
mov dword [esp + 0x24], ebx
mov word [esp + 8], ax
lea esp, [esp + 0x24]
call fcn.01edc2cf
call fcn.021ad350
xchg esi, eax
lodsb al, byte [esi]
push 0x5a
jno 0x1ee3228
aam 0xe8
fadd qword [esi]
scasb al, byte es:[edi]
inc edi
mov dl, 0x60
push ebx
mov ch, 0xb7
add al, 0x13
clc
cmp eax, 0xf50e3984
pop esp
loop 0x1ee3301
push ss
pop ebp
mov al, byte [0x757627c7]
in al, dx
jno 0x1ee3264
pop ecx
add eax, 0xc33897a6
sub eax, 0xbf1992d0
ret 0x5cd3
or al, ah
pop esi
aad 0x7e
rcl byte [ebx]
stosd dword es:[edi], eax
push 0x3a
loope 0x1ee333b
inc ecx
js 0x1ee32f7
xchg ebx, eax
add dword [ebx + 0x71], ecx
pop ss
and eax, 0x7c5ee1f9
xchg byte [edx + 0x5e4e133a], al
push ss
scasb al, byte es:[edi]
add al, 0x20
insd dword es:[edi], dx
cmp byte [ebx + 0x5b], al
rol byte [edi + 0x69fc003d], 0xcc
inc edx
test byte [esi + 0x3b6907ff], 0xe0
cmp esp, eax
cmp dword [ebp + 0x37], eax
leave
inc esp
call dword [edx + 0x6d]
pop edx
stosb byte es:[edi], al
add ah, byte [ecx - 0x4358b5a4]
jo 0x1ee332b
cmpsd dword [esi], dword es:[edi]
mov esp, 0xbf06ec70
ret 0xb3c4
push es
mov edi, 0x66b3c4c2
ljmp 0xd5c4
lea esp, [esp + 4]
jne 0x21ac8d6
call fcn.01245282
bound ecx, qword [ebx + 0x62e188c4]
aam 0xfe
and al, 0xe4
test eax, 0x53528617
retf
cmp dh, ch
stc
pushfd
add al, 0x10
clc
clc
pushfd
ror al, 6
mov byte [esp + 0xc], 0xc4
cmc
mov byte [ecx], al
pushal
cmp bh, al
cmc
jmp 0x1ede6bf

Function at 0x21ac7af
Capabilities:
Authenticate hmac

Disassembly:
test al, al
push dword [esp + 8]
call fcn.01ee22fe

Function at 0x21ace67
Capabilities:
Authenticate hmac

Disassembly:
pushfd
pop eax
mov eax, dword [edx + 8]
push edi
push 0x3354fb7e
pushal
push 0xaa8ec944
lea esp, [esp + 0x2c]
jmp 0x21a601c
lea esp, [esp + 0x44]
jne 0x1ee0fe4
jmp 0x21aa482

Function at 0x21ad942
Capabilities:
Authenticate hmac

Disassembly:
nop
mov ecx, 0xef54512
lcall 0x6029, 0x8c6397f0
rcl dword [edx + ebp*8 - 0x2f], cl
mov byte [ebx - 0x6b], bh
pop eax
fbstp tbyte [edi + ecx*8 - 0x74]
stosd dword es:[edi], eax
pushal
lea esp, [esp + 0x44]
je 0x21ac8c1
call fcn.01ee0b17
dec esi
add al, 0x9c
fild dword [ebx]
jnp 0x21ad93d
mov dl, dh
cmpsd dword [esi], dword es:[edi]
add al, 0xa6
jbe 0x21ad928
xor dword [ebp + 0x30], ecx
push ebx
std
add al, 0x21
sti
invalid
Function at 0x21b1fc8
Capabilities:
Authenticate hmac

Disassembly:
pushfd
push dword [esp]
mov word [esp + 4], sp
dec dl
test cx, sp
test edx, esp
bt dx, ax
push word [esp + 0x12]
popf
mov byte [esp + 4], dl
call fcn.021a4ec9
push 0x28b7821b
shl eax, 1
mov dword [esp + 4], edx
jmp 0x21ac5ef
xor dl, 0xc9
jmp 0x12478c8
lea esp, [esp + 8]
je 0x21a9fa3
call fcn.012478fc
push dword [edi]
pop dword [esp + 0xc]
pushfd
cmp edi, ebx
push 0x83cf6beb
pushal
mov byte [esp + 4], 0x72
push ebp
lea esp, [esp + 0x38]
ja 0x21a9f73
shr al, 2
sub ebx, edi
movzx di, dl
sub al, 0xa0
bsf edi, ecx
add ebx, esp
xor al, 0x95
sbb di, 0x41a8
shl al, cl
or di, 0xed77
mov edi, ebx
adc al, 0xef
stc
shl al, cl
ror al, 3
mov al, 0x2e
cmc
pushal
pushal
repne scasb al, byte es:[edi]
jmp 0x21b3c2e
pushfd
push esp
push dword [esp + 4]
lea esp, [esp + 0x4c]
jne 0x1ee4247
lahf
mov byte [edi - 1], 0
mov ah, 0xed
push edi
mov dword [esp], ebx
setge ah
bswap ax
pushal
pop eax
lea eax, [0x21a9cb5]
pushfd
call fcn.01245a2a
inc dl
cmc
ror dl, 5
bt di, 5
clc
add dl, 0xbf
pushfd
mov word [esp + 4], 0xcd6f
jmp 0x1ee424e

Function at 0x21b20cf
Capabilities:
Authenticate hmac

Disassembly:
clc
add ecx, 0xffffffff
push 0xfe02f337
pushfd
lea esp, [esp + 0xc]
je 0x21a9fa3
test dh, dh
push 0xed0b216a
bt cx, si
add edx, 0x11c
pushfd
pushfd
pushal
lea esp, [esp + 0x2c]
jmp 0x1ee6f42

Function at 0x21b2369
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 8]
je 0x21ac8c1

Function at 0x21b27d2
Capabilities:
Authenticate hmac

Disassembly:
pushfd
lea esp, [esp + 8]
je 0x1ee4134
jmp 0x21b3409
cmc
bt di, sp
mov al, 0x2e
call fcn.01ee3091
sub dh, dh
aam 0xe9
push cs
push edx
invalid
push 0xf6dfd19f
mov esi, eax
pushfd
call fcn.01ee6b56
xchg word [ebx], ax
pushal
pushal
call fcn.01ee1104
pop ecx
lcall 0x5ed4, 0x627c62b3
xchg dword [esi], esp
add al, 0xaf
adc eax, 0xa29530c8
push ecx
mov bh, 0xe6
out dx, eax
inc ebx
test eax, 0x6399b924
mov ah, byte [esi + 0x57]
jmp 0x21b27d1
mov si, 0xcb24
movsx esi, al
jae 0x21b27e2
mov esi, eax
movzx ax, al
lahf
call fcn.01edf089
add byte [eax], al
inc edi
je 0x21b347b
jns 0x21b349d
je 0x21b3491
insd dword es:[edi], dx
push esp
imul ebp, dword [ebp + 0x65], 0x69467341
insb byte es:[edi], dx
push esp
imul ebp, dword [ebp + 0x65], 0x80df3900
aas
and ebp, ecx
xor byte [eax - 1], ch
push esi
invalid
invalid
les ecx, [eax]
or byte [ecx], al
jecxz 0x21b345e
add ebx, esp
bswap edi
clc
ror al, cl
mov edi, ebx
jmp 0x1ee7849
iretd
hlt
ret 0xfddb
jo 0x21b344a
sbb dword ss:[eax - 0x66], esp
dec edi
enter 0xffffffffffffa53e, 0x42
jne 0x21b3516
js 0x21b344b
lodsb al, byte [esi]
invalid
dec esi
sbb eax, 0xc1443b3e
dec edi
sub byte [ebx - 0x47], 8
fcmovu st(0), st(2)
adc edx, edi
adc byte [edx + 5], 9
or eax, dword [eax]
and bl, ch
sub al, 0xf7
and al, 0x27
adc byte [ebx], ah
pop es
push esp
mov bh, byte [ebp + 0x1786b14a]
outsd dx, dword [esi]
inc edx
push edx
xor cl, 0x8b
invalid

Function at 0x21b316a
Capabilities:
Authenticate hmac

Disassembly:
push 0x4359f7d2
lea esp, [esp + 4]
jne 0x1ee0fe4
mov ax, cx
mov eax, dword [edx + 8]
push ebx
pushfd
lea esp, [esp + 8]
jmp 0x21a601c
pushfd
lea esp, [esp + 0x28]
call fcn.0124566d
jmp 0x1edeaf4
Function at 0x21b3404
Capabilities:
Authenticate hmac

Disassembly:
test al, al
pushal
pushal
lea esp, [esp + 0x44]
je 0x21ac8c1
cmp cx, sp
bt sp, ax
sub al, 0x30
call fcn.01edebac
jmp 0x1edc92d

Function at 0x21b3446
Capabilities:
Authenticate hmac

Disassembly:
pushfd
lea esp, [esp + 8]
je 0x1ee4134
jmp 0x21b3409
cmc
bt di, sp
mov al, 0x2e
call fcn.01ee3091
sub dh, dh
aam 0xe9
push cs
push edx
invalid
push 0xf6dfd19f
mov esi, eax
pushfd
call fcn.01ee6b56
xchg word [ebx], ax
pushal
pushal
call fcn.01ee1104
pop ecx
lcall 0x5ed4, 0x627c62b3
xchg dword [esi], esp
add al, 0xaf
adc eax, 0xa29530c8
push ecx
mov bh, 0xe6
out dx, eax
inc ebx
test eax, 0x6399b924
mov ah, byte [esi + 0x57]
jmp 0x21b27d1
mov si, 0xcb24
movsx esi, al
jae 0x21b27e2
mov esi, eax
movzx ax, al
lahf
call fcn.01edf089
add byte [eax], al
inc edi
je 0x21b347b
jns 0x21b349d
je 0x21b3491
insd dword es:[edi], dx
push esp
imul ebp, dword [ebp + 0x65], 0x69467341
insb byte es:[edi], dx
push esp
imul ebp, dword [ebp + 0x65], 0x80df3900
aas
and ebp, ecx
xor byte [eax - 1], ch
push esi
invalid
invalid
les ecx, [eax]
or byte [ecx], al
jecxz 0x21b345e
add ebx, esp
bswap edi
clc
ror al, cl
mov edi, ebx
jmp 0x1ee7849
iretd
hlt
ret 0xfddb
jo 0x21b344a
sbb dword ss:[eax - 0x66], esp
dec edi
enter 0xffffffffffffa53e, 0x42
jne 0x21b3516
js 0x21b344b
lodsb al, byte [esi]
invalid
dec esi
sbb eax, 0xc1443b3e
dec edi
sub byte [ebx - 0x47], 8
fcmovu st(0), st(2)
adc edx, edi
adc byte [edx + 5], 9
or eax, dword [eax]
and bl, ch
sub al, 0xf7
and al, 0x27
adc byte [ebx], ah
pop es
push esp
mov bh, byte [ebp + 0x1786b14a]
outsd dx, dword [esi]
inc edx
push edx
xor cl, 0x8b
invalid
Function at 0x401edc
Capabilities:
Encode data using xor

Disassembly:
push 0x4192e8
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sti
out dx, al
mov fs, word [edx - 5]
in al, 0x28
dec esp
test ecx, ebx
mov bl, 0x28
xchg ebx, eax
pop esi
lodsd eax, dword [esi]
popal
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sub eax, 0x30303043
sub eax, 0x30006569
xor byte [eax], dh
xor byte [eax], dh
add byte [eax], al
add byte [eax], al
dec esp
xor dword [eax], eax
sbb bl, byte [edi - 0x13fa700e]
jns 0x401efd
inc ebp
test edx, ebp
sar byte [ecx - 0x53], cl
dec ebx
aas
int3
Function at 0x40c0a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48241b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00476e7c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40c122
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00474c97
mov eax, dword [eax]
push 0x49fc60
push eax
call fcn.00466fe4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00477107
test bl, bl
je 0x40c122
push 0x49fc60
lea ecx, [esp + 0xc]
call fcn.00477497
push 0x49fc6c
lea ecx, [esp + 0xc]
call fcn.00477497
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40c15e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00477107
jmp 0x40c229
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40c1e2
lea edx, [esp + 0x7c]
push 0x49fc68
push edx
call fcn.00466fe4
add esp, 8
test eax, eax
je 0x40c1e2
lea eax, [esp + 0x7c]
push 0x49fc64
push eax
call fcn.00466fe4
add esp, 8
test eax, eax
je 0x40c1e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c172
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00477107
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40ca30
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40ca92
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40caa0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48249b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4a9838]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40cbd8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40cb06
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00477107
xor eax, eax
jmp 0x40cc4f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00477244
push esi
lea ecx, [esp + 0xc]
call fcn.004774d3
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40cc2d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.0040ca30
test eax, eax
jne 0x40cc2d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.0040ca30
test eax, eax
jne 0x40cc2d
lea eax, [esp + 0x14]
push 0x49fc7c
push eax
call fcn.00468060
mov esi, eax
add esp, 8
test esi, esi
jne 0x40cc0c
lea ecx, [esp + 0x14]
push 0x49fc78
push ecx
call fcn.00467fe0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40cc0c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40cc0f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004771f4
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40cb1e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00477107
xor eax, eax
jmp 0x40cc4f
mov byte [esi], 0
push 0x49fc74
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00477107
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41d520
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41d58e
cmp si, 0x69
ja 0x41d58e
add esi, 0xffd0
cmp si, 0x11
je 0x41d55e
push 0x11
call edi
test ax, ax
jge 0x41d55e
or esi, 0x2000
cmp si, 0x10
je 0x41d573
push 0x10
call edi
test ax, ax
jge 0x41d573
or esi, 0x4000
cmp si, 0x12
je 0x41d588
push 0x12
call edi
test ax, ax
jge 0x41d588
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41d59b
mov esi, 0xbd
jmp 0x41d54f
cmp si, 0x6e
jne 0x41d5a8
mov esi, 0xbe
jmp 0x41d54f
cmp si, 0x6f
jne 0x41d549
mov esi, 0xbf
jmp 0x41d54f

Function at 0x41ed90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4ba0f8]
xor edx, edx
cmp eax, edx
jne 0x41edb6
xor eax, eax
mov byte [eax + 0x4b9ff8], al
inc eax
cmp eax, 0x100
jl 0x41ed9e
mov dword [0x4ba0f8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4b9ff8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41ee47
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41ee1a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41ede8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41eec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41ef13
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41eefa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425f50
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x4260e8
cmp ebp, ebx
jle 0x4260e8
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x425fae
dec eax
or eax, 0xfffffff8
inc eax
je 0x425fb5
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, reloc.WS2_32.dll_accept
jns 0x425fc4
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x425fcb
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.00476e48
add esp, 4
cmp eax, ebx
je 0x425fec
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.00476e48
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x4260de
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x4260c5
mov al, byte [edx]
cmp al, 0xc0
jbe 0x4260b1
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x4260a6
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x4260b4
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x4260b4
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x426050
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x426041
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x429670
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x483b08
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
test edi, edi
jne 0x4296a9
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
push 0x400
lea ecx, [esp + 0xc]
call fcn.0047e7fb
mov eax, dword [esp + 0x40]
push 0
push edi
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call fcn.0047e847
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.00429730
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.0047e884
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24