joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1055a2e2
Capabilities:
Encode data using base64

Disassembly:
neg al
ror al, 1
jmp 0x107160fa
sbb edi, 1
mov word [edi], ax
jmp 0x1075e13e
sub esi, edi
cmp bp, 0x9b8c
test dl, ah
cmc
mov dword [ebp - 0x48], esi
mov esi, dword [eax]
cmp edx, 0x74050f2e
mov dword [ecx], ebx
cmovns cx, sp
bt ecx, ecx
mov ecx, dword [ebp + 0x14]
test esi, ecx
jmp 0x106fc5c0
shl esi, cl
and ch, dh
mov ecx, dword [ebp + 0xc]
stc
cmp di, di
cmp ebp, 0xadbc0810
mov dword [ebp - 0x18], ebx
cmp di, bp
mov byte [ebp - 1], bl
jmp 0x105b5f06
mov dword [ecx], ebx
or ch, 0x1d
mov ecx, dword [eax + 4]
btr ax, di
movsx eax, dx
add ecx, esi
mov eax, 0x300
cmp esi, 0xd79e17b5
test edi, 0x66847421
shl eax, cl
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edi
cmc
add eax, 0x736
jmp 0x105924e6
dec al
not al
add al, 0x8d
push 0x7993daa
mov word [esp + 0xd], 0x7f2a
not dword [esp]
xor al, 0x2c
push 0x1caf052f
not byte [esp + 6]
add al, 0x8d
rol dword [esp + 0xd], 0xd0
xor bl, al
shl dword [esp + 4], 1
js 0x105b509a
push ebp
cmp ch, 0xb
test ebp, 0xbb27c699
sal cx, 0x9c
mov ebp, esp
bsf edx, eax
rcr edx, 0xb7
adc ch, 0x9b
lea esp, [esp - 0x48]
shrd edx, esi, 0xb6
rol cx, 0xb6
mov ecx, dword [eax + 8]
cmp ecx, 0x76274d86
mov edx, dword [eax + 0xc]
stc
cmc
push ebx
stc
cmp bl, 0xd
push esi
push edi
mov edi, 1
mov esi, 0x5b9033a7
inc esi
shld esi, esi, 0xa1
mov esi, edi
cmp ebx, esp
shl esi, cl
or ecx, 0x339dc100
mov ch, 0xb
mov ecx, dword [eax + 4]
test bp, sp
cmp esp, eax
cmc
xor ebx, ebx
mov dword [ebp - 0x20], edx
stc
cmc
cmp ax, 0x3a8f
sub esi, edi
stc
test si, 0x740e
cmp dx, 0xaaa3
mov dword [ebp - 0x44], esi
bts si, bx
bt esi, edx
mov esi, edi
jmp 0x105eb5c4
lea esp, [esp + 0x14]
jmp fcn.105ad882

Function at 0x1056493c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0xc], 0x5667c75a
lea esp, [esp + 0xc]
call fcn.105e20f7
movzx ecx, bx
movsx ecx, bx

Function at 0x1059deee
Capabilities:
Encode data using base64

Disassembly:
xor edi, 0xa79ca20e
rol edi, 3
lea edi, [edi + ebp - 0xaad5764]
xor bp, 0xf013
mov dword [esp], ebp
jae 0x106dc21f
rol edi, 2
xchg word [esp], bp
sal word [esp + 1], 0xe9
bswap edi
adc dword [esp], 0xdd167c18
adc edi, 0x5ab44fa0
dec ebp
sub ebp, dword [esp]
mov dword [esp + ebp*2 - 0x46ee65b8], edx
and word [esp + ebp - 0x237732e4], 0x8305
jae 0x10721776
mov dword [esp + ebp - 0x237732e6], eax
inc ebp
mov edx, ebp
movsx eax, dx
push ecx
sar eax, 0x98
cdq
sar ebp, 0xa5
push ebx
rol al, 0xa4
shl al, 0x47
mov ebp, 0
movsx ebx, al
adc dl, al
mov dword [esp + eax + 0xc], ebp
sub dl, 0x2a
add edi, ebp
call fcn.10564242

Function at 0x105add0b
Capabilities:
Encode data using base64

Disassembly:
call fcn.1071628f
call fcn.10714357
ror dx, 1
jmp 0x105ef36f
sal dword [esp + 7], 0xce
js 0x1076af89
jo 0x105ef308
invalid
shr byte [esp + 9], 0x82
inc byte [esp + 6]
xor dx, 0xac96
jmp 0x10551a08
adc dx, 0x5538
jmp 0x106ea0be
Function at 0x105bccec
Capabilities:
Encode data using xor

Disassembly:
inc ecx
adc bl, 0x26
dec eax
inc dword [esp + 7]
jns 0x10722660
inc ecx
not bl
dec eax
mov dword [esp], 0xc4113797
jge 0x10598734
arpl ax, bp
in al, 0xfc
dec edi
and byte [ebx], ah
inc ebx
call 0x1c1989bc
imul ebp, dword [ebx + 0x55], 0xcea0a4e8
arpl word [eax], si
cwde
push ds
xchg ecx, eax
xchg ebx, eax
sub edi, ebp
pop es
outsd dx, dword [esi]
loopne 0x105bcd62
mov bh, byte [eax + 0x3f]
adc esi, dword [ebp + edi*2 + 0x1d]
test dword [edi + 0x15ba164d], edi
sbb al, 0x70
call 0x684f7400
bound esi, qword [ebx + 0x4e]
hlt
outsd dx, dword [esi]
mov ch, 0xc7
push 0x169a1344
push cs
in al, dx
sahf
adc ebx, dword [edx - 0x6113f1ea]
or eax, 0xf5787a21
js 0x105bcd57
jecxz 0x105bcd60
dec esp
sub al, 0x2d
wait
loopne 0x105bcd52
inc eax
cmp byte [eax], bh
movzx esi, word [edi - 0x74a70151]
out 0x42, eax
popfd
push ss
mov ch, 0xa4
mov esp, 0x4afcfc1
xor al, bl
mov ebp, 0x49aa42f5
mov eax, 0x7f0b01c1
rol byte [edi + edx*2], 1
push edi
mov dword [eax - 0x6a], ecx
sub esp, dword [ebx + 0x2b]
xor byte [edi + ebp - 0x3e3495ae], ah
mov dl, 0x15
mov edx, 0xb655bd19
mov esp, 0xb5935a49
in al, 0xa6
cmpsb byte [esi], byte es:[edi]
shr dword [ecx + 0x3a], 0x85
test eax, 0xad9bcfc6
jg 0x105bcd8f
push es
mov ch, byte [edi - 0x45]
add dl, byte [edi]
cdq
retf 0x7d7b
inc ecx
ror bl, 1
inc ebp
xor ah, bl
dec edx
arpl word [esi + ebx*4], cx
sal dword [esp + 2], 0x27
seta byte [esp + 7]
push 0x3509e415
dec eax
add ecx, esi
jmp 0x10741984
not word [esp + 0x13]
push 0xab80fb88
dec eax
lea esp, [esp + 0x20]
jmp ecx

Function at 0x105c8a31
Capabilities:
Encode data using base64

Disassembly:
push 0x449bfd92
adc dl, 0x2a
shr word [esp + 0xa], 0x61
xor bl, dl
sub dword [esp + 0x10], 0x5faa5b17
jo 0x107722df
lea edx, [esp + edx + 0x18]
call fcn.10753e18
sub dl, 0x11
inc dword [esp + 7]
neg dl
sar byte [esp + 0xb], 0x45
jp 0x10578816
and word [esp + 2], 0x6326
not cl
shr dword [esp + 4], 0x9c
neg word [esp + 5]
inc word [esp + 6]
xor bl, cl
lea ecx, [esp + ecx + 8]
jmp 0x1074eed9

Function at 0x1076157a
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x1c]
jmp fcn.105ad882
call fcn.105add0b
xor dx, 0x935
xor bx, dx
neg dword [esp + 0xc]
jp 0x105ba298
sal word [esp + 0xe], 0x86
sbb edi, 3
push 0xa001c7a9
mov dword [edi], edx
push 0x7a1797a1
push 0x8b872a2f
jmp 0x105a3cb2
Function at 0xbbd058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bbd1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbbd07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbbd06a
add dl, dl
jne 0xbbd089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbbd0dc
xor eax, eax
add dl, dl
jne 0xbbd096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbbd17d
add dl, dl
jne 0xbbd0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbbd0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbbd0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbbd0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbbd0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbbd075
mov eax, 1
add dl, dl
jne 0xbbd0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbbd0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbbd0e1
sub eax, ebx
mov ebx, 1
jne 0xbbd128
mov ecx, 1
add dl, dl
jne 0xbbd10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbbd119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbbd105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbbd075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbbd13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbbd14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbbd136
cmp eax, 0x7d00
jae 0xbbd16d
cmp eax, 0x500
jb 0xbbd168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbbd075
cmp eax, 0x7f
ja 0xbbd170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbbd075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbbd19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbbd075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40629b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x108
call fcn.0042c7bf
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x50a86c
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
push 0x108
call fcn.0042c7bf
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x50a86c
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp - 4]
call fcn.00401bef
mov eax, 0
cmp eax, ecx
jl 0x40631b
push 0
push 0x4012b2e
push 1
call fcn.0042c7cb
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov ebx, dword [ebp - 8]
call fcn.00401bef
mov eax, 0
cmp eax, ecx
jl 0x40634e
push 0x29
push 0x4012b2e
push 1
call fcn.0042c7cb
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov eax, dword [ebp - 4]
add eax, 8
mov ecx, 0x100
xor ebx, ebx
sub bl, cl
mov byte [ebx + eax], bl
loop 0x406364
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov edi, dword [edx + 4]
add edx, 8
mov esi, dword [ebp - 8]
add esi, 8
mov ecx, 0x100
xor ebx, ebx
cmp ebx, edi
jb 0x40638c
xor ebx, ebx
mov ah, byte [ebx + edx]
mov byte [esi], ah
inc esi
inc ebx
loop 0x406386
pop edi
xor ebx, ebx
sub esi, 0x100
xor eax, eax
mov ecx, 0x100
mov dl, byte [eax + esi]
add bl, dl
mov dl, byte [eax + edi]
add bl, dl
mov dl, byte [eax + edi]
mov dh, byte [ebx + edi]
mov byte [eax + edi], dh
mov byte [ebx + edi], dl
inc eax
loop 0x4063a5
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
add esi, 8
push 0x80000301
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x42e2c0
call fcn.0042c7dd
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x406401
push ebx
call fcn.0042c7c5
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, 8
xor eax, eax
xor ebx, ebx
push ecx
movzx ecx, al
inc cl
push edx
mov dh, byte [ecx + edi]
add bl, dh
mov dl, byte [ebx + edi]
mov byte [ecx + edi], dl
mov byte [ebx + edi], dh
add dl, dh
movzx edx, dl
mov dl, byte [edx + edi]
mov cl, byte [eax + esi]
xor cl, dl
pop edx
mov byte [eax + edx], cl
inc eax
pop ecx
loop 0x406416
mov ebx, dword [ebp - 4]
push ebx
call fcn.0042c7c5
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.0042c7c5
add esp, 4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41a518
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov eax, dword [ebx + 4]
test eax, eax
je 0x41a52b
pop ebx
leave
ret
push esi
xor ecx, ecx
mov esi, dword fs:[ecx + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
mov eax, dword [esi + 8]
add esp, 0xfffffffc
mov dword [ebp - 0xc], eax
push 0x706165
push 0x48657461
push 0x636f6c6c
push 0x416c7452
lea ecx, [esp]
push ecx
push eax
call fcn.0041a564
jmp 0x41a654
mov dword [ebx + 4], eax
add esp, 0x10
push 0
push 0x706165
push 0x48656572
push 0x466c7452
lea eax, [esp]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0041a564
mov dword [ebx + 8], eax
add esp, 0x14
pop esi
pop ebx
leave
ret

Function at 0x41a564
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x41a587
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x41a587
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x41a591
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x41a5d3
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x41a635
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x41a630
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41a61b
test dl, dl
je 0x41a617
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41a61b
add ecx, 2
add eax, 2
test dl, dl
jne 0x41a5fb
xor eax, eax
jmp 0x41a620
sbb eax, eax
or eax, 1
test eax, eax
je 0x41a641
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x41a5e8
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x437970
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4fd3cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004ef7c7
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4379f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004ecebe
mov eax, dword [eax]
push 0x755d94
push eax
call fcn.004cbea4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004efa52
test bl, bl
je 0x4379f2
push 0x755d94
lea ecx, [esp + 0xc]
call fcn.004efe2e
push 0x755da0
lea ecx, [esp + 0xc]
call fcn.004efe2e
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x437a2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004efa52
jmp 0x437af9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x437ab2
lea edx, [esp + 0x7c]
push 0x755d9c
push edx
call fcn.004cbea4
add esp, 8
test eax, eax
je 0x437ab2
lea eax, [esp + 0x7c]
push 0x755d98
push eax
call fcn.004cbea4
add esp, 8
test eax, eax
je 0x437ab2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x437a42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004efa52
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x438300
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x438362
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x438370
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4fd44b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x7683a8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4384a8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4383d6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004efa52
xor eax, eax
jmp 0x43851f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004efbdb
push esi
lea ecx, [esp + 0xc]
call fcn.004efe6a
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4384fd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00438300
test eax, eax
jne 0x4384fd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00438300
test eax, eax
jne 0x4384fd
lea eax, [esp + 0x14]
push 0x755db0
push eax
call fcn.004cd0e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4384dc
lea ecx, [esp + 0x14]
push 0x755dac
push ecx
call fcn.004cd060
mov esi, eax
add esp, 8
test esi, esi
jne 0x4384dc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4384df
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004efb8b
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4383ee
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004efa52
xor eax, eax
jmp 0x43851f
mov byte [esi], 0
push 0x755da8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004efa52
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x44cee0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x44cf4e
cmp si, 0x69
ja 0x44cf4e
add esi, 0xffd0
cmp si, 0x11
je 0x44cf1e
push 0x11
call edi
test ax, ax
jge 0x44cf1e
or esi, 0x2000
cmp si, 0x10
je 0x44cf33
push 0x10
call edi
test ax, ax
jge 0x44cf33
or esi, 0x4000
cmp si, 0x12
je 0x44cf48
push 0x12
call edi
test ax, ax
jge 0x44cf48
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x44cf5b
mov esi, 0xbd
jmp 0x44cf0f
cmp si, 0x6e
jne 0x44cf68
mov esi, 0xbe
jmp 0x44cf0f
cmp si, 0x6f
jne 0x44cf09
mov esi, 0xbf
jmp 0x44cf0f

Function at 0x44e8b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x77a2c0]
xor edx, edx
cmp eax, edx
jne 0x44e8d6
xor eax, eax
mov byte [eax + 0x77a1c0], al
inc eax
cmp eax, 0x100
jl 0x44e8be
mov dword [0x77a2c0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x77a1c0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x44e967
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x44e93a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x44e908
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x44e970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x44e9c3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x44e9aa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455e30
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x455fc8
cmp ebp, ebx
jle 0x455fc8
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, reloc.OLEAUT32.dll_VariantInit
mov dword [esp + 0x10], edi
jns 0x455e8e
dec eax
or eax, 0xfffffff8
inc eax
je 0x455e95
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, reloc.WS2_32.dll_accept
jns 0x455ea4
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x455eab
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.004ef793
add esp, 4
cmp eax, ebx
je 0x455ecc
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.004ef793
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x455fbe
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x455fa5
mov al, byte [edx]
cmp al, 0xc0
jbe 0x455f91
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x455f86
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x455f94
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x455f94
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x455f30
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x455f21
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret

Function at 0x4582e0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
call fcn.004f10ec
lea eax, [esp + 4]
mov dword [esi], method.CWnd.virtual_0
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
neg eax
sbb eax, eax
mov dword [esi + 0x44], 0x4d12
inc eax
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], eax
mov eax, esi
pop esi
add esp, 0x190
ret