joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435c40
Capabilities:
Check os version
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
mov eax, dword [0x44c654]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
push 0
lea eax, [ebp - 0x328]
push eax
call fcn.0041fb00
add esp, 0xc
mov dword [ebp - 0x328], 0x114
lea ecx, [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x435c8b
xor eax, eax
jmp 0x435dfc
cmp dword [ebp - 0x324], 6
jae 0x435c9e
mov eax, 1
jmp 0x435dfc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
lea ecx, [ebp - 0x52c]
call fcn.004023b0
push 0
lea edx, [ebp - 0x20c]
push edx
push 0
push 0x20106
push 0
push 0
push 0
lea ecx, [ebp - 0x52c]
call fcn.00402aa0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 0x20c], 0
jne 0x435d11
push 0
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [ebp - 0x52c]
call fcn.00402aa0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 0x20c], 0
jne 0x435d3a
mov dword [ebp - 0x530], 0
lea ecx, [ebp - 0x52c]
call fcn.004013c0
mov eax, dword [ebp - 0x530]
jmp 0x435dfc
mov ecx, dword [str.WINXPSP2]
mov dword [ebp - 0x208], ecx
mov edx, dword [0x441e5c]
mov dword [ebp - 0x204], edx
mov eax, dword [0x441e60]
mov dword [ebp - 0x200], eax
mov ecx, dword [0x441e64]
mov dword [ebp - 0x1fc], ecx
mov dx, word [0x441e68]
mov word [ebp - 0x1f8], dx
push 0x1ee
push 0
lea eax, [ebp - 0x1f6]
push eax
call fcn.0041fb00
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x528]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x208]
push edx
call fcn.0041fc48
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x208]
push ecx
push 1
push 0
lea edx, [ebp - 0x528]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x534], 1
lea ecx, [ebp - 0x52c]
call fcn.004013c0
mov eax, dword [ebp - 0x534]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041faea
mov esp, ebp
pop ebp
ret
Function at 0x435e10
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439390
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x44c654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
push str.Files
lea ecx, [ebp - 0x10]
call fcn.004023b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.00402aa0
push eax
lea ecx, [ebp + 0xc]
call fcn.00402aa0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x435ea6
mov dword [ebp - 0x2c], 0xffffffff
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004013c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004013c0
mov eax, dword [ebp - 0x2c]
jmp 0x435fab
mov eax, dword [ebp - 0x28]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x28]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.00401180
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00402aa0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x441d94
lea ecx, [ebp - 0x18]
call fcn.00402aa0
push eax
call fcn.0041ff84
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x435f37
mov eax, dword [ebp - 0x14]
push eax
push 1
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.004200fd
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
call fcn.004201f6
add esp, 4
jmp 0x435f72
mov dword [ebp - 0x30], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004013c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004013c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004013c0
mov eax, dword [ebp - 0x30]
jmp 0x435fab
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x18]
call fcn.004013c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004013c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004013c0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0xf5f4ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [esi + 0x48a934dc]
mov byte [esp + 8], cl
call fcn.00f6b619
jmp 0xf80810

Function at 0xf6cbfc
Capabilities:
Execute anti-debugging instructions

Disassembly:
jno 0xf7007e
push ebp
btc ebp, 3
mov ebp, esp
cmc
cmp bl, cl
sub esp, 8
bt cx, si
bt bx, ax
cmp dword [ebp + 0xc], 0
push 0xe2ea6edb
mov word [esp], bp
lea esp, [esp + 4]
jne 0xf6cc52
pushfd
pushal
mov dword [esp + 0x20], 0
push esp
pushfd
pushfd
lea esp, [esp + 0x2c]
call fcn.00f9bbc2
push 0x57845f99
add cl, ch
cmc
mov dword [ebp + 0xc], eax
sub esp, 0xfffffffc
pushal
call 0xf944af
xchg bx, di
pushfd
push 0x62141536
xchg esi, edi
mov edi, dword [esp + 8]
xchg si, bx
mov esi, dword [esp + 0xc]
push 0x5b0b19ec
push edx
lea ebp, [esi - 0x52a6eaa6]
xchg bp, bx
mov ebx, dword [esp + 0x18]
pop ebp
push 0xe38cc5f6
movzx bp, bl
mov ebp, dword [esp + 0x1c]
pushfd
mov dword [esp], 0xf66656be
pushfd
pushfd
push dword [esp + 0x2c]
ret 0x40

Function at 0xf75b47
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt dx, 0xc
mov byte [esp], 0xcb
pushfd
cmp edi, eax
pushal
lea esp, [esp + 0x28]
jae 0xf67866
push ebp
pushfd
dec eax
bsf dx, cx
or dh, 0x34
dec dx
ror dh, cl
mov edx, edi
cmc
cmp edi, eax
mov byte [esp], bh
lea esp, [esp + 8]
jae 0xf6785b
cwde
lea ecx, [edi + edi*2]
shld ax, ax, cl
mov di, dx
add ecx, ecx
shld ax, cx, 1
aad 0xe3
das
xor ah, 0x22
add ecx, ecx
Function at 0xf8a29b
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
movzx si, cl
rdtsc
mov esi, dword [esp + 4]
movsx eax, cl
rdtsc
seto cl
mov ebx, dword [esp + 8]
lea esp, [esp + 0xc]

Function at 0xf95adc
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00fa658d
jmp 0xfa750c
push dword [esp + 8]
cmp edx, eax
mov byte [esp + 0xc], 0xd0
pushfd
mov byte [esp], ch
lea esp, [esp + 0x4c]
jb 0xf75b99
not dh
movsx cx, bl
inc bl
dec dword [esi + 0x28]
not bx
lea ebx, [ebx - 0x5072963c]
mov byte [ebp - 1], 1
rdtsc
cwde
pushal
pushal
mov ebx, dword [esp + 0x40]
lea esp, [esp + 0x44]
xor edi, 0x1940b2c8
and al, 0x3e
jmp 0xf9033d
ror ax, cl
mov eax, dword [esi + 0x20]
rcr di, 0xc
jmp 0xf39a6c
push ebp
mov dword [eax], edi
mov word [esp + 0xc], di
movsx di, dl
dec di
mov edi, dword [eax + 0x10]
mov byte [esp + 8], 0xd3
mov word [esp], dx
pushfd
mov dword [esp], ecx
mov dword [eax + 4], edi
push 0x87d016b3
movsx di, dl
mov edi, dword [eax + 0x14]
pushal
jmp 0xfd02fd
mov byte [esp], 0xd5
mov byte [esp + 4], ah
lea edi, [edi + 0x2ef3229e]
call fcn.00f7ffd1
pushfd
dec eax
cmp cl, 0xbf
cmp dh, dl
add ecx, 0xc
cmp al, cl
jmp 0xf67842
mov dword [eax + 8], edi
lea eax, [ecx + 0x6ec53958]
dec ax
movzx ax, bl
mov eax, dword [esi + 0x28]
pushfd
inc edx
mov byte [esp + 4], bl
push dword [esp]
jmp 0xfaf000

Function at 0xf9aa3d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xfa4408
pushfd
lea eax, [eax - 0x6243f36]
call fcn.00f89879
Function at 0xfab490
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 0xc]
push ebx
mov esi, dword [esi + 0xb5d716]
push ss
xlatb
mov ch, 0
call fcn.00fa0e82
inc esp
xchg dword [eax], ebx
inc ebx
cld
xor ebp, dword [edi + edx + 0x5e]
sub edx, dword [edx + 0x2ee81ca3]
pop edi
aaa
inc esi
imul esp, dword [ebx], 0xfb126cc5
pop edx
cmp al, 0x61
aaa
rcl byte [ebp + 0x669f3a5c], 0x24
push cs
jns 0xf7bdfb
push edx
adc al, 0x3c
xchg dword [edx], esp
fnstcw word [ebx + 0x24]
sbb edx, dword [ebx + eax*4 + 0x6595d7ed]
imul edx, dword [edx], 0x33
push ebp
pop esp
lds eax, [edi + 0x223ba2ad]
mov bh, 0xea
pop esp
int3
mov dword [esp + 0x34], esi
pop esi
bswap si
mov esi, 0x4106e2
jmp 0xfc4dcc
jmp 0xf7bdf4

Function at 0xfc2fcf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
je 0xf75ef0
pushfd
inc edi
pushal
push dword [esp]
mov byte [esp], bh
add eax, 0xc
stc
pushfd
cmp edi, dword [esi + 0x28]
pushfd
lea esp, [esp + 0x30]
jb 0xf8c55e
pushal
mov byte [esp], bh
pushal
lea esp, [esp + 0x40]
jmp 0xf67873

Function at 0xfc72df
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt si, 8
cmp edi, dword [esi + 0x28]
jmp 0xf5f4fb

Function at 0xfc97f2
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 8], ecx
pushal
pushfd
mov byte [esp + 8], cl
mov dword [esp + 0x28], esi
pushfd
call fcn.00fd326e
dec esi
push cs
push eax
stosb byte es:[edi], al
cmp ch, ch
mov byte [ebp + 0x3622129e], 0x8e
pop edx
pushfd
jge 0xf69a94
add dword [ebp + ebp*8 - 0x70], 0x95720251
test byte [ebp + 0x2c], al
dec edx
mov ebp, 0x6b7f3d54
add dword [edx], ebx
in eax, dx
and dword [esi + 0x7d68f713], 0x54
push 0xffffffffffffffe7
adc esi, edi
push 0xe76a547d
leave
xor al, 0xc
cmpsd dword [esi], dword es:[edi]
push cs
dec esp
call 0x64a46b1f
invalid
pushfd
jmp 0xf69a59
Function at 0x408a92
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.004084a4
inc dword [ebx + 0x45ff0cc4]
or al, 0x66
mov eax, dword [ebp + 0xc]
inc dword [ebx + 0x45ff0cc4]
or al, 0x66
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x408a70
call fcn.00408533
mov esi, 0x8b28fc43
jle 0x408aeb
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x408d22
add eax, esi
mov dword [ebp - 0x44], eax
dec ebp
push ss
Function at 0x408b3a
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x408ad8
cmp dword [eax + 0xc], ebx
je 0x408b7b
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00408533
int 0x16
jge 0x408b2a
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x408b69
inc ebp
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x408b44
and eax, 0xffff
push eax
jmp 0x408b48
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004084f8
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x408d22
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x408b29
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x408aca
call fcn.00408533
cli
sbb edi, dword [ebx]
dec eax
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x408be7
add eax, esi
cmp dword [eax], ebx
je 0x408be7
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x408be2
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x408bcc
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x408bd4
cmp edx, ebx
jne 0x408d22
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x408ba3
add eax, dword [eax + 4]
jmp 0x408b90
mov dword [ebp + 0xc], ebx
jmp 0x408bf2
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x408c0a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x408c28
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x408c86
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x408c6d
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x408c76
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x408c80
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x408c62
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408c8f
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x408bec
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x408cd3
dec eax
je 0x408cca
sub eax, 3
mov dword [ebp - 4], 0x20
jmp 0x408cd6
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x408d22
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x408ca2
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00408533
fst dword [eax + 0x22]
lcall 0x5601, 0x6a1475ff
call edi
mov eax, esi
jmp 0x408d2e

Function at 0x40916d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.00408543
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004084f8
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.00408533
daa
add ch, dl
cmpsd dword [esi], dword es:[edi]
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x409227
cmp dword [ebp - 0x398], 0
je 0x4093f1
cmp dword [ebp + 0xc], 1
je 0x4093f1
cmp dword [ebp + 0xc], 8
jne 0x4093b9
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
invalid
test dword [ecx + edi*8 - 1], edx

Function at 0x40d5a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d5cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d5cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41615c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x43701c]
test eax, eax
je 0x41619b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41619b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41619b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41619b
cmp dword [ecx + 0x74], 0xe
jbe 0x41619b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x428e0a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00428c80

Function at 0x435320
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43534d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43534d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x408320
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46bcbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00460658
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4083a2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045e26d
mov eax, dword [eax]
push 0x4851d0
push eax
call fcn.00450714
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004608e3
test bl, bl
je 0x4083a2
push 0x4851d0
lea ecx, [esp + 0xc]
call fcn.00460c73
push 0x488d44
lea ecx, [esp + 0xc]
call fcn.00460c73
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4083de
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004608e3
jmp 0x4084a9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x408462
lea edx, [esp + 0x7c]
push 0x488d40
push edx
call fcn.00450714
add esp, 8
test eax, eax
je 0x408462
lea eax, [esp + 0x7c]
push 0x488d3c
push eax
call fcn.00450714
add esp, 8
test eax, eax
je 0x408462
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4083f2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004608e3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x408ca0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x408d02
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x408d10
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46bd3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x48f768]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x408e48
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x408d76
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004608e3
xor eax, eax
jmp 0x408ebf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00460a20
push esi
lea ecx, [esp + 0xc]
call fcn.00460caf
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x408e9d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00408ca0
test eax, eax
jne 0x408e9d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00408ca0
test eax, eax
jne 0x408e9d
lea eax, [esp + 0x14]
push 0x488d58
push eax
call fcn.00451750
mov esi, eax
add esp, 8
test esi, esi
jne 0x408e7c
lea ecx, [esp + 0x14]
push 0x488d54
push ecx
call fcn.004516d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x408e7c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x408e7f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004609d0
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x408d8e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004608e3
xor eax, eax
jmp 0x408ebf
mov byte [esi], 0
push 0x488d50
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004608e3
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41a750
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41a7be
cmp si, 0x69
ja 0x41a7be
add esi, 0xffd0
cmp si, 0x11
je 0x41a78e
push 0x11
call edi
test ax, ax
jge 0x41a78e
or esi, 0x2000
cmp si, 0x10
je 0x41a7a3
push 0x10
call edi
test ax, ax
jge 0x41a7a3
or esi, 0x4000
cmp si, 0x12
je 0x41a7b8
push 0x12
call edi
test ax, ax
jge 0x41a7b8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41a7cb
mov esi, 0xbd
jmp 0x41a77f
cmp si, 0x6e
jne 0x41a7d8
mov esi, 0xbe
jmp 0x41a77f
cmp si, 0x6f
jne 0x41a779
mov esi, 0xbf
jmp 0x41a77f

Function at 0x41be70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x49fe58]
xor edx, edx
cmp eax, edx
jne 0x41be96
xor eax, eax
mov byte [eax + 0x49fd58], al
inc eax
cmp eax, 0x100
jl 0x41be7e
mov dword [0x49fe58], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x49fd58
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41bf27
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41befa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41bec8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41bfa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41bff3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41bfda
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret