joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10036138]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], str.SoftwareBaiduBaiduSd
mov dword [ebp - 0xc], str.InstallDir
mov word [ebp - 0x218], 0
push 0x1fe
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.1000f020
add esp, 0xc
mov dword [ebp - 0x21c], 0x100
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
mov edx, dword [ebp - 4]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10028c49
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10028c39
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 8]
call fcn.10004d50
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10028c47
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10028c52
jmp 0x10028c4d
xor eax, eax
jmp 0x10028c52
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000e688
mov esp, ebp
pop ebp
ret

Function at 0x10028c60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10036138]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0x10031270
mov dword [ebp - 0xc], str.Version
mov word [ebp - 0x218], 0
push 0x1fe
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.1000f020
add esp, 0xc
mov dword [ebp - 0x21c], 0x100
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
mov edx, dword [ebp - 4]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10028d05
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10028cff
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 8]
call fcn.10004d50
jmp 0x10028d03
xor eax, eax
jmp 0x10028d0e
jmp 0x10028d09
xor eax, eax
jmp 0x10028d0e
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000e688
mov esp, ebp
pop ebp
ret
Function at 0x10028fa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10036138]
xor eax, ebp
mov dword [ebp - 0x14], eax
call fcn.100281d0
mov dword [ebp - 4], 0x100310d0
mov dword [ebp - 0xc], str.SupplyID
mov dword [ebp - 0x21c], 0x100
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10029048
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10029038
lea ecx, [ebp - 0x218]
push ecx
push 0x10031114
mov edx, dword [ebp + 8]
push edx
call fcn.10006320
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10029046
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10029056
jmp 0x1002904c
xor eax, eax
jmp 0x10029056
call fcn.10028000
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000e688
mov esp, ebp
pop ebp
ret
Function at 0x100292f0
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002ad92
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x10036138]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.10027640
mov word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.1000f020
add esp, 0xc
mov dword [ebp - 0x228], 0
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push str._TEMP_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x228], eax
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x260]
call fcn.10004c90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.10004c60
mov byte [ebp - 4], 1
lea eax, [ebp - 0x244]
push eax
call fcn.10028ab0
add esp, 4
push 0x1003108c
lea ecx, [ebp - 0x260]
call fcn.10004d90
lea ecx, [ebp - 0x244]
push ecx
lea ecx, [ebp - 0x260]
call fcn.10004d70
lea edx, [ebp - 0x260]
push edx
mov ecx, dword [ebp + 8]
call fcn.10004d30
push 0
lea ecx, [ebp - 0x260]
call fcn.10004e70
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.10004d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.10004d10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000e688
mov esp, ebp
pop ebp
ret
Function at 0x10029b20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10029b51
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x10029b5e
push str.Open_Key_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x10029b80
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10033fb0
push 0x10015090
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x10036138]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x19]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x10029c00
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10029c20
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10036138]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x8c], 0x7f
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10029cd5
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x88]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x88]
push ecx
call fcn.1000eb6d
add esp, 4
push eax
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.USER32.dll_CharLowerBuffW]
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x88]
push edx
call fcn.10003f80
add esp, 8
test eax, eax
je 0x10029cc9
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x10029ce2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10029ce0
push 0x100314ac
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000e688
mov esp, ebp
pop ebp
ret

Function at 0x10029cf0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10033fd0
push 0x10015090
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x10036138]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0
push ebx
mov ebx, 0
mov eax, 1
invalid
Function at 0x10029f70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x10036138]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 0
jne 0x10029f91
xor al, al
jmp 0x1002a001
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10029fa7
xor al, al
jmp 0x1002a001
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10029ff4
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10029fe0
mov byte [ebp - 1], 1
jmp 0x10029ff4
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10029fc5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000e688
mov esp, ebp
pop ebp
ret
Function at 0x4a76c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esp
push dword [esp + 0x38]
pop dword [ebp]
mov byte [esp + 8], ch
pushfd
push dword [esp + 4]
lea esp, [esp + 0x44]
jmp fcn.004a7730

Function at 0x4a76e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esp], 0xa4cf
mov byte [esp + 0xc], 0x63
dec esi
jmp 0x4a87cd
push 0xe267bb7d
mov byte [esp], 0x4b
mov word [ebp], ax
mov byte [esp], dl
mov byte [esp + 8], 4
lea esp, [esp + 0x44]
jmp fcn.004a7730

Function at 0x4a7d4f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp ah, 0x44
push dword [esp + 0x44]
popfd
push 0xe9074691
push ebp
lea esp, [esp + 0x50]
jmp 0x4a8ae5

Function at 0x4a7e8b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [ebp], ax
push 0x40fabc9a
mov word [esp + 4], 0x68b2
mov dword [esp + 4], 0xfc814936
mov word [esp + 4], di
lea esp, [esp + 0x3c]
jmp fcn.004a7730

Function at 0x4a80bf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
push dword [esp + 0x48]
pop dword [ebp]
mov byte [esp], cl
pushfd
lea esp, [esp + 0x50]
jmp 0x4a8ae5

Function at 0x4a868c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x1762e7e5
jmp 0x4a9804
mov word [ebp], ax
mov byte [esp], al
lea esp, [esp + 0x20]
jmp fcn.004a7730

Function at 0x4a8715
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
pushal
mov word [ebp], ax
pushfd
lea esp, [esp + 0x44]
jmp 0x4a8ae5
mov al, byte ss:[edx]
lea esp, [esp + 0x28]
jbe 0x4a7a34
mov word [ebp], ax
push 0xdaf944d0
pushal
push edx
lea esp, [esp + 0x28]
jmp 0x4a8ae5

Function at 0x4a88ca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
mov dword [esp], 0x3625baeb
push dword [esp + 8]
pop dword [ebp]
mov byte [esp + 8], 0x72
pushfd
mov byte [esp + 4], ah
lea esp, [esp + 0x10]
jmp 0x4a8ae5
pushfd
pop dword [esp]
pushfd
jmp 0x4a7e13

Function at 0x4a897e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ebp, dword [ebp]
push 0x8b556cfa
push dword [esp]
push edi
lea esp, [esp + 0x14]
jmp fcn.004a7730

Function at 0x4a8aca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
rcr ch, 2
stc
mov ebx, esi
bt cx, 3
rol cl, cl
mov byte [esp], cl
bts cx, 7
add esi, dword [ebp]
sub esp, 0xfffffffc

Function at 0x4a8c44
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec esi
neg al
cmp bp, 0xac43
neg esi
pop ebp
lea ebp, [esp + 4]
test ebx, 0xf2a3d733
movsx edi, cl
cmc
sub esp, 0xbc
ror di, 4
neg bx
push 0xa2d7bae2
rol di, 0xd
lea edi, [esp + 4]
sbb al, 0x12
stc
call fcn.004a8235

Function at 0x4a99cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
push dword [esp + 0x2c]
pop dword [ebp]
mov byte [esp], 0xc3
lea esp, [esp + 0x30]
jmp fcn.004a7730
pushfd
pushfd
pop dword [esp + 0x28]
jmp 0x4a8746
Function at 0x6f82de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x6f82fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6f82ec
add dl, dl
jne 0x6f8306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6f8352
xor eax, eax
add dl, dl
jne 0x6f8313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6f83ef
add dl, dl
jne 0x6f8322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6f832d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6f8338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6f8343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x6f834d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x6f82f2
mov eax, 1
add dl, dl
jne 0x6f8360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6f836b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6f8357
sub eax, 2
jne 0x6f839a
mov ecx, 1
add dl, dl
jne 0x6f8380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6f838b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6f8377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6f82f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x6f83b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6f83bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6f83a8
cmp eax, 0x7d00
jae 0x6f83df
cmp eax, 0x500
jb 0x6f83da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6f82f2
cmp eax, 0x7f
ja 0x6f83e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6f82f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x6f840b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6f82f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0xbec058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bec1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbec07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbec06a
add dl, dl
jne 0xbec089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbec0dc
xor eax, eax
add dl, dl
jne 0xbec096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbec17d
add dl, dl
jne 0xbec0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbec0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbec0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbec0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbec0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbec075
mov eax, 1
add dl, dl
jne 0xbec0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbec0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbec0e1
sub eax, ebx
mov ebx, 1
jne 0xbec128
mov ecx, 1
add dl, dl
jne 0xbec10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbec119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbec105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbec075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbec13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbec14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbec136
cmp eax, 0x7d00
jae 0xbec16d
cmp eax, 0x500
jb 0xbec168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbec075
cmp eax, 0x7f
ja 0xbec170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbec075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbec19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbec075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x22038bc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x22038c6
pushal
call 0x22038cc
pop ebp
sub ebp, 0x10
sub ebp, 0x1e038bc
jmp 0x22038e2
mov eax, 0x1e038bc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e5
mov edx, 0x73363cc
xor byte [eax], dl
inc eax
dec ecx
jne 0x22038f9
jmp 0x220390c
inc edi
add dword [edi + 0x45], eax
invalid
Function at 0x40f340
Capabilities:
Log keystrokes

Disassembly:
push ebx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [esi], 5
mov dword [esi + 4], 5
mov word [esi + 8], 1
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov word [esi + 0x18], bx
push ebx
mov dword [esi + 0x1a], ebx
mov word [esi + 0x1e], bx
push 0x5b
mov dword [esi + 0xc], 4
call edi
push ebx
push 0x10
mov byte [esi + 0x29], al
call edi
push ebx
push 0xa0
mov byte [esi + 0x26], al
call edi
push ebx
push 0xa1
mov byte [esi + 0x27], al
call edi
push ebx
push 0x11
mov byte [esi + 0x28], al
call edi
push ebx
push 0x12
mov byte [esi + 0x24], al
call edi
pop edi
mov byte [esi + 0x25], al
pop ebx
ret

Function at 0x40f4e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10020
call fcn.00426630
xor eax, eax
nop
mov cl, byte [eax + 0x4a3248]
mov dl, byte [eax + str._MB_eM_s_:gII3]
mov byte [ebp + eax - 0x20], cl
mov byte [ebp + eax - 0x18], dl
inc eax
cmp eax, 8
jl 0x40f4f0
lea eax, [ebp - 8]
push str.OeLV
push eax
call fcn.00413870
push 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004125e0
add esp, 0x14
push ebx
push esi
mov dword [ebp - 0xc], 0
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [ebp - 0x10020]
push 1
push edx
call fcn.0041527b
add esp, 0x10
cmp eax, 0x18
jl 0x40f5b1
mov edi, eax
lea esi, [edi - 0x14]
test esi, esi
jle 0x40f580
xor edx, edx
xor ecx, ecx
mov bl, byte [ebp + ecx - 0x20]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x10020]
je 0x40f59e
cmp ecx, 0x14
je 0x42a0f9
inc edx
cmp edx, esi
jl 0x40f560
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
lea edx, [ecx + edi - 0x14]
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [ebp - 0xc], edx
call fcn.00415641
add esp, 0xc
jmp 0x40f534
mov bl, byte [ebp + ecx - 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001f]
je 0x40f5bf
inc ecx
jmp 0x40f572
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov bl, byte [ebp + ecx - 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001e]
je 0x40f5d4
add ecx, 2
jmp 0x40f572
mov bl, byte [ebp + ecx - 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001d]
jne 0x42a0f1
mov bl, byte [ebp + ecx - 0x1c]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001c]
je 0x42a0e0
add ecx, 4
jmp 0x40f572
add ecx, 5
cmp ecx, 0x14
jl 0x40f562
jmp 0x40f572
add ecx, 3
jmp 0x40f572
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
lea ecx, [eax + edx + 0x14]
mov edx, dword [esi]
push 0
push ecx
push edx
call fcn.00415641
mov eax, dword [esi]
push eax
push 4
lea ecx, [ebp - 8]
push 1
push ecx
call fcn.0041527b
lea edx, [ebp - 8]
push str.AUCN
push edx
mov byte [ebp - 4], 0
call fcn.004152a0
add esp, 0x24
neg eax
sbb eax, eax
and eax, 4
jmp 0x40f5b6
Function at 0x4047e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
jle 0x40481e
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push ebx
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + edi]
and ebx, 0xff
xor edx, ebx
sar eax, 8
mov edx, dword [edx*4 + 0x42d288]
and eax, 0xffffff
xor eax, edx
inc ecx
cmp ecx, esi
jl 0x4047f5
pop ebx
pop edi
pop esi
ret
mov eax, dword [esp + 8]
pop esi
ret
Function at 0x423ad0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
lea ecx, [esp]
push esi
push edi
push 0xf
push eax
push ecx
xor esi, esi
call sub.ssapi.dll_public:_static_int___cdecl_MSSTR::CopyN_char___char_const___int_
add esp, 0xc
lea edx, [esp + 8]
mov edi, eax
push edx
call sub.ssapi.dll_public:_static_void___cdecl_MSSTR::Upr_char__
mov eax, 0xf
add esp, 4
sub eax, edi
lea ecx, [esp + edi + 8]
push eax
push str.BrianDavidHarry
push ecx
call sub.ssapi.dll_public:_static_int___cdecl_MSSTR::CopyN_char___char_const___int_
add esp, 0xc
xor eax, eax
movsx dx, byte [esp + eax + 8]
xor edx, 0x96
lea ecx, [eax + 1]
imul edx, ecx
add esi, edx
inc eax
cmp eax, 0xf
jl 0x423b16
mov ax, si
pop edi
pop esi
add esp, 0x10
ret

Function at 0x424a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a450
push 0x424cd2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x42ecec], 0xffffffff
mov dword [0x42ecf0], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x42ece0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x42ecdc]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x42ece8], ecx
call fcn.00424cb0
mov eax, dword [0x42e388]
test eax, eax
jne 0x424b21
push 0x424ca0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00424c70
push 0x42d02c
push 0x42d028
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x42ecd8]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x42ecd4]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x42d024
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x424c2f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x424b95
cmp al, 0x22
jne 0x424b87
cmp byte [esi], 0x22
jne 0x424b9e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x424bae
cmp al, 0x20
ja 0x424bae
inc esi
mov dword [ebp - 0x74], esi
jmp 0x424b9e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x424bcf
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x424bd4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x424c14
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x424b9e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x424c2f