joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494e92
Capabilities:
Encode data using xor

Disassembly:
popfd
jnp 0x494e42
push edx
mov al, 0xfb
or dword [0x3c392ab6], ecx
invalid
imul ebp, dword [eax - 0x5e], 0xdc319ba8
daa
add bh, ah
or al, 0x45
xchg ch, bl
or byte [ecx - 0x33], bh
bound edi, qword fs:[ebp - 0x32b5bc7e]
mov edx, 0x47ebfeea
cmp byte [edi - 0x73], al
das
int 0xba
ljmp 0x8d47
inc edi
lea ebp, [edi]
inc ecx
fmul qword gs:[edx - 0x58]
sti
fisubr dword [0x6ab93dc2]
stosd dword es:[edi], eax
mov ebp, 0x9b2afdcd
jle 0x494ded
sub bl, byte [ebx - 0x53505882]
scasd eax, dword es:[edi]
lodsb al, byte [esi]
in eax, 0xad
js 0x494e0f
sbb dword [edi], ecx
add edx, dword [ebx - 0x128868d8]
pop eax
lahf
mov al, byte [0x1e323853]
jae 0x494def
xor al, 0xbe
mov gs, word [ebp - 0x1fdb65e5]
arpl word [ecx - 0x27014b56], bx
lds ebx, [eax]
mov dh, 0x97
jmp 0x728211f2
stosd dword es:[edi], eax
mov edx, 0x742b26d1
and eax, dword [ecx]
jns 0x494e27
ja 0x494ef5
test byte [edi + edx*4 + 0x1f], bl
jbe 0x494e2e
aad 0xcf
out dx, al
cmp ecx, dword [ebx + 0x2d8a2c05]
in al, dx
xor dh, byte [eax + edx - 0x33]
call 0xfedb556e
adc ebp, dword [ebx - 0x7cf2a9b3]
or dword [ebp - 0x4c1a5c7b], edi
mov eax, dword [0x8b58c936]
inc edx
in eax, dx
mov eax, 0xf9119b13
pop ss
stosd dword es:[edi], eax
inc esi
dec esi
dec edx
push ds
sub byte [edi + 0x5b], bl
sbb al, 0x56
mul byte [eax - 0x5d]
push 0xdd229a87
jns 0x494f2b
push 0x3c
dec ebx
fcom qword [ecx - 0x12903918]
fdivr qword [esi + 8]
sbb dword [eax + 0x4f031374], 0xffffffe5
add ecx, dword [edi - 0x1b]
xor al, 0x9f
mov eax, 0xd9939bde
jge 0x494f0d
adc esp, ebp
mov esp, 0xb5ba9359
inc esp
arpl ax, si
sub al, 0xfc
jns 0x494e98
add ebp, eax
int3
ficom word [eax - 6]
enter 0x9cb, 0x5c
enter 0xffffffffffffbadb, 0x70
xchg byte [edx], cl
and byte [0xc1f72e64], bl
or dl, byte ds:[ecx + eax*8]
enter 0x17cb, 0x4c
mov eax, 0x10cebdbe
adc ch, dl
fisttp dword [esi - 0x39]
and eax, 0xd51a361b
adc ch, byte [ebx]
sub byte [ebx + 5], al
jns 0x494fc1
xor al, 0x16
test dword [eax - 0x22], ecx
mov al, byte [0xd8a5]
lodsd eax, dword [esi]
mov ch, byte [eax - 0x6c]
add ebp, edx
nop
invalid
dec esi
imul edi, dword [ebx - 0x1e], 0x2791f815
cmp byte [eax], dh
mov esi, 0x2e5d605e
fistp dword [edx]
xchg edx, eax
loop 0x49502b
clc
xor cl, byte [0xf92ee6a8]
push eax
or byte [edx - 0x17], dh
in eax, dx
mov eax, 0x24aaf311
xchg edi, eax
sub al, 0x90
mov ebx, 0x5d084358
sbb ecx, dword [eax + edx*2]
jns 0x494faf
hlt
aaa
cwde
fstp qword [esi - 0x49d8c04d]
and dl, al
ret 0x3610
Function at 0x60f452
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [edi + eax]
movzx edx, al
mov ebx, edx
mov dword [esp + 0x24], edx
sub ebx, ecx
cmp edi, dword [esp + 0x20]
jl 0x60f3db
or ebx, 0xffffffff
jmp 0x60f3f1
mov edx, dword [esp + 0x1c]
cmp al, byte [edi + edx + 1]
jne 0x60f4cc
test ebx, ebx
je 0x60f4cc
mov eax, ebx
mov ecx, edi
cdq
sub ecx, esi
xor eax, edx
dec ecx
sub eax, edx
mov dword [esp + 0x10], ecx
cmp eax, 1
jne 0x60f4b2
mov eax, dword [esp + 0x18]
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jg 0x60f4b2
test ecx, ecx
jle 0x60f4b2
lea eax, [ebx + ebp]
mov edx, ebx
mov dword [esp + 0x18], edx
test eax, eax
jne 0x60f47a
cmp esi, edi
jge 0x60f4c0
xor ebp, ebp
nop dword [eax]
mov eax, ebp
cdq
idiv ecx
add eax, 0xff
cdq
xor eax, edx
sub eax, edx
test ebx, ebx
fstp xword [ecx + 0xd]
fstp xword [ecx + 0xd]
mov ecx, 0xff
sub ecx, eax
mov eax, ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub ebp, 0x1fe
mov byte [esi + edx], al
inc esi
cmp esi, edi
jl 0x60f442
mov edx, dword [esp + 0x18]
jmp 0x60f4c0
cmp ebp, ebx
jne 0x60f4c0
cmp esi, edi
jge 0x60f4c0
xor ebp, ebp
mov eax, ebp
cdq
idiv ecx
test ebx, ebx
jns 0x60f49a
mov ecx, 0xff
sub ecx, eax
mov eax, ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add ebp, 0xff
mov byte [esi + edx], al
inc esi
cmp esi, edi
jl 0x60f484
mov edx, dword [esp + 0x18]
jmp 0x60f4c0
xor edx, edx
test ebx, ebx
setg dl
lea edx, [edx*2 - 1]
mov ecx, dword [esp + 0x24]
mov ebp, edx
mov dword [esp + 0x18], ebx
mov esi, edi
mov eax, dword [esp + 0x1c]
inc edi
cmp edi, dword [esp + 0x2c]
jl 0x60f3c2
pop ebx
pop edi
pop esi
invalid
add dword [eax], eax
invalid
Function at 0x401677
Capabilities:
Create directory
Query environment variable
Set current directory

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
cmp ebx, 0x14
jl 0x401685
xor eax, eax
pop ebx
ret
cmp ebx, 6
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov byte [ebp], 0
jge 0x4016c4
mov eax, dword [0x403014]
xor ecx, ecx
cmp eax, ecx
mov edi, 0x401518
je 0x4016b3
push ebp
push ecx
push ecx
push 0x26
push ecx
call eax
cmp byte [ebp], 0
jne 0x4016c0
push 0x800
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0xf
jmp 0x4016f6
cmp ebx, 0xd
jge 0x40170c
mov eax, dword [0x403014]
xor ecx, ecx
cmp eax, ecx
mov edi, 0x401508
je 0x4016e7
push ebp
push ecx
push ecx
push 0x1a
push ecx
call eax
cmp byte [ebp], 0
jne 0x4016f4
push 0x800
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0xe
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x401719
push 0x401504
push ebp
call fcn.00402370
jmp 0x401717
push 0x401504
push ebp
call fcn.00402380
pop ecx
pop ecx
mov esi, 0x401500
push esi
push ebp
call fcn.00402380
push dword [esp + 0x1c]
push ebp
call fcn.00402380
add esp, 0x10
mov eax, ebx
push 6
cdq
pop ecx
idiv ecx
test edx, edx
je 0x401778
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
add ebx, dword [esp + 0x1c]
push esi
push ebp
call fcn.00402380
pop ecx
mov eax, ebp
pop ecx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401758
sub eax, esi
lea ecx, [eax + ebp]
jmp 0x401772
mov al, bl
and al, 7
add al, 0x30
shr ebx, 4
mov byte [ecx], al
inc ecx
test ebx, ebx
jne 0x401766
mov byte [ecx], bl
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push ebp
call esi
test eax, eax
jne 0x4017ac
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40179b
pop edi
pop esi
pop ebp
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
call esi
test eax, eax
jne 0x4017ac
pop edi
pop esi
pop ebp
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
call fcn.0040160f
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401a63
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov ecx, dword [ebp + 8]
push ebx
push edi
call fcn.004017b8
mov dword [ebp - 8], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
push edi
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0xc], ebx
jne 0x401abc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401b44
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp dword [ebp - 8], esi
jne 0x401ad1
push 2
pop esi
jmp 0x401b38
push edi
push edi
push edi
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x401aef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x401b2a
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, edi
jne 0x401b09
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401b1d
mov eax, dword [ebp - 8]
sub esi, eax
push esi
add eax, ebx
push eax
push dword [ebp + 0xc]
call fcn.004018d9
add esp, 0xc
cmp ebx, edi
mov esi, eax
je 0x401b2a
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 4], edi
je 0x401b38
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x401bb1
Capabilities:
Accept command line arguments
Delete directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10894
call fcn.004027b0
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 4
jae 0x401c0d
push 0x800
lea eax, [ebp - 0x894]
push eax
push 1
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x10
push 0
lea eax, [ebp - 0x894]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401d29
push ebx
push esi
push edi
push 0x401594
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x401580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x403014], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp byte [eax], 0x22
mov edi, dword [sym.imp.USER32.dll_CharNextA]
sete bl
push eax
lea ebx, [ebx + ebx + 0x20]
jmp 0x401c4a
cmp al, bl
je 0x401c54
push esi
call edi
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x401c45
cmp byte [esi], 0x22
jne 0x401c5a
inc esi
cmp byte [esi], 0
je 0x401c60
inc esi
push 0x12
push esi
push 0x40156c
call fcn.004027f0
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0xc
test eax, eax
je 0x401c8e
push 0xc
push esi
push 0x40155c
call fcn.004027f0
add esp, 0xc
test eax, eax
jne 0x401c9d
push 0x40
xor esi, esi
push esi
push 0x40154c
push esi
call edi
jmp 0x401c9f
xor esi, esi
lea eax, [ebp - 0x10894]
push eax
push dword [ebp + 8]
call fcn.00401a63
cmp eax, esi
pop ecx
pop ecx
jne 0x401cca
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10894]
push eax
call fcn.00401b48
cmp eax, esi
pop ecx
pop ecx
je 0x401cf6
push esi
push 0x800
lea ecx, [ebp - 0x894]
push ecx
push esi
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x401cf6
push 0x10
push esi
lea eax, [ebp - 0x894]
push eax
push esi
call edi
mov eax, dword [0x403004]
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
je 0x401d11
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x403004], 0xffffffff
push 0x401548
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10894]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
or eax, 0xffffffff
leave
ret 0x10
Function at 0x4070bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d468
cmp edx, dword [eax]
je 0x4070df
add eax, 8
inc ecx
cmp eax, 0x40d4f8
jl 0x4070d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d468]
jne 0x40720d
mov eax, dword [0x40e498]
cmp eax, 1
je 0x4071e7
test eax, eax
jne 0x407110
cmp dword [0x40d39c], 1
je 0x4071e7
cmp edx, 0xfc
je 0x40720d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407147
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404340
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404190
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40718a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404190
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b5ec
push edi
call fcn.00408c50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404340
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404350
lea eax, [ebp - 0xa0]
push 0x40b5cc
push eax
call fcn.00404350
push dword [esi + 0x40d46c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404350
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00408bc2
add esp, 0x2c
pop edi
jmp 0x40720d
lea eax, [ebp + 8]
lea esi, [esi + 0x40d46c]
push 0
push eax
push dword [esi]
call fcn.00404190
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x9955832
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xdf36b99
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4
Function at 0x406690
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47956b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046e3ae
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x406712
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046c2c0
mov eax, dword [eax]
push 0x494c48
push eax
call fcn.0045efd4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046e639
test bl, bl
je 0x406712
push 0x494c48
lea ecx, [esp + 0xc]
call fcn.0046e9c9
push 0x494c54
lea ecx, [esp + 0xc]
call fcn.0046e9c9
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40674e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046e639
jmp 0x406819
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4067d2
lea edx, [esp + 0x7c]
push 0x494c50
push edx
call fcn.0045efd4
add esp, 8
test eax, eax
je 0x4067d2
lea eax, [esp + 0x7c]
push 0x494c4c
push eax
call fcn.0045efd4
add esp, 8
test eax, eax
je 0x4067d2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406762
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046e639
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x407020
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x407082
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x407090
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4795eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x49e640]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4071c8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4070f6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046e639
xor eax, eax
jmp 0x40723f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046e776
push esi
lea ecx, [esp + 0xc]
call fcn.0046ea05
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x494c88
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40721d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00407020
test eax, eax
jne 0x40721d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00407020
test eax, eax
jne 0x40721d
lea eax, [esp + 0x14]
push 0x494c64
push eax
call fcn.00460050
mov esi, eax
add esp, 8
test esi, esi
jne 0x4071fc
lea ecx, [esp + 0x14]
push 0x494c60
push ecx
call fcn.0045ffd0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4071fc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4071ff
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046e726
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40710e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046e639
xor eax, eax
jmp 0x40723f
mov byte [esi], 0
push 0x494c5c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046e639
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x417f60
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x417fce
cmp si, 0x69
ja 0x417fce
add esi, 0xffd0
cmp si, 0x11
je 0x417f9e
push 0x11
call edi
test ax, ax
jge 0x417f9e
or esi, 0x2000
cmp si, 0x10
je 0x417fb3
push 0x10
call edi
test ax, ax
jge 0x417fb3
or esi, 0x4000
cmp si, 0x12
je 0x417fc8
push 0x12
call edi
test ax, ax
jge 0x417fc8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x417fdb
mov esi, 0xbd
jmp 0x417f8f
cmp si, 0x6e
jne 0x417fe8
mov esi, 0xbe
jmp 0x417f8f
cmp si, 0x6f
jne 0x417f89
mov esi, 0xbf
jmp 0x417f8f

Function at 0x4197e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4aed90]
xor edx, edx
cmp eax, edx
jne 0x419806
xor eax, eax
mov byte [eax + 0x4aec90], al
inc eax
cmp eax, 0x100
jl 0x4197ee
mov dword [0x4aed90], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4aec90
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x419897
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41986a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x419838
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x419910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x419963
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41994a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret