joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ca50
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x46cab6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x46cab6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x46ca97
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4817c1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4817f9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047f7e5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047f7bd
jmp 0x481805
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x483032
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x483074
call fcn.0048960c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x483074
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48306b
xor eax, eax
jmp 0x48307c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00483082
pop edi
pop esi
pop ebx
ret 4

Function at 0x489b3c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x489b6a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x489b88
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00489aa2
jmp 0x489b88
mov eax, dword [esi + 0x14]
test eax, eax
je 0x489b88
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00489aa2
test edi, edi
mov eax, edi
jne 0x489b72
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x48c4e6
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x48c50e
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x48c51f
push 2
call edi
test ax, ax
jge 0x48c51f
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.00480df6
cmp dword [esi + 0x30], ebx
jne 0x48c5f9
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.00480df6
cmp eax, dword [esp + 0x34]
jne 0x48c5f9
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x48c595
push 1
push pe_nt_image_headers32
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x48c5da
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x48c5f9
cmp eax, 0x205
je 0x48c5f9
cmp eax, 0x201
je 0x48c5f9
cmp eax, 0x204
je 0x48c5f9
cmp eax, ebx
jne 0x48c5c0
cmp dword [esp + 0x1c], 0x1b
je 0x48c5f9
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x952794]
jbe 0x48c5ef
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x48c552
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x44145e
Capabilities:
Encode data using xor

Disassembly:
or edi, dword [esi + ebp*4 + 0x50]
imul edx, dword [edi], 0xffffffaa
sub dh, byte [0x41311534]
mov ecx, ss
js 0x4414b3
xchg ecx, eax
pop edx
pop edi
add dword [edx + 0x5f], esi
or ch, 0x40
add byte [edi + 0x61], cl
jmp 0x441440
arpl word [edx - 0x76a750a3], sp
pushfd
xchg ebx, eax
add dword [edx + 0x133cd731], 0xe9181422
pop ebx
clc
adc dword [ebx + ebx + 0x5f4b8695], esp
mov byte [0xaad62035], al
add eax, 0x59569d1b
jo 0x441535
mov ch, 0x21
loope 0x4414b9
sbb ebx, dword [ecx + ecx*4 + 0x30c8e5dc]
ror byte [edi], cl
les edi, [esi - 0x593c604a]
xchg dword [ecx], edx
in al, 0x51
imul edx, dword [edi + 2], 0xffffff80
aaa
nop
salc
and dword [esi], ecx
jmp 0x643ad279
xor byte [esi + 0x6ad47b75], dl
test eax, 0x13576f5
sub al, 0x70
or al, 0x6a
mov al, byte [0xcf6deb37]
cwde
sbb al, 0xc1
fisubr dword [ecx]
inc ebx
push edi
or edi, dword [eax]
inc esi
inc edi
popfd
mov bx, 0x6d81
nop
jecxz 0x4415c5
test ch, bh
scasb al, byte es:[edi]
mov ebx, 0x19cfd34d
cmp eax, eax
push ebx
movsb byte es:[edi], byte [esi]
add eax, dword [ebp + 0x2cea1a60]
mov dword [esi], ecx
add eax, 0x1ded77bf
popal
push edi
sbb dword [edi], edi
pop ebx
and eax, 0x2e30119f
xor eax, 0x9845ad7c
xor ebp, esi
fdivr qword [eax]
dec edi
dec eax
mov ebx, esp
pop es
mov bh, 0x28
add byte [ebp - 0x6c], 0xf8
or eax, 0x9486be1d
out dx, al
in eax, 0x48
cli
outsb dx, byte [esi]
stosb byte es:[edi], al
invalid
jo 0x441556
mov ecx, 0x2b85682b
adc ah, ah
invalid

Function at 0x44aad0
Capabilities:
Get file version info

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x214
lea eax, [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x220]
push esi
push edi
push 0x104
push eax
push ecx
mov word [ebp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x44ab92
cmp eax, 0x104
jne 0x44ab15
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x44ab92
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x44ab92
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x44ab92
mov ecx, dword [esp + 0x10]
push ebx
push esi
push edi
lea edx, [esp + 0x24]
push ecx
push edx
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44ab7a
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44ab7a
mov edx, dword [esp + 0x10]
mov ebx, 1
mov ax, word [edx]
mov word [ebp], ax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x214
ret 8
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x214
ret 8
Function at 0x451cc1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4568046a
ljmp 0x8baf
xor al, 0x32
jle 0x451c6e
dec esp
ret 0x7aff
aam 0xf1
cmc
stosd dword es:[edi], eax
mov byte [0x4ef25c], al
jno 0x451c88
dec esi
add byte [ecx - 0x1d], dh
invalid
and dl, byte [0x18ffc6d]
jnp 0x451c9a
fisubr word [ebp + ebx*2 + 0x34]
rep stosb byte es:[edi], al
rcr dword ds:[ebp - 0x1c970c6f], 1
test byte [eax], al
xchg ecx, eax
push 0x84f2e3
cmc
and bh, byte [0x26fd7fe9]
adc ecx, dword [ebp + 0x22]
add ebx, ecx
loop 0x451cd2
xor byte [eax + 0x54], bl
add esp, dword [edx]
jne 0x451ca0
invalid

Function at 0x4e61b7
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x5f527c25
mov dword [0x96d562ab], eax
inc ebx
mov dh, 0x35
fldenv [edi]
stosb byte es:[edi], al
fist word [esi]
cmp dword [eax + 0x343e08bf], edi
neg dword [ecx + 0x20]
dec eax
sub edi, dword [ecx - 0x7789db79]
mov byte [ecx], dh
fiadd dword [ebx - 0x59]
mov byte [ecx], dh
fiadd dword [ebx - 0x59]
xchg byte [eax - 0x14], ah
cmpsb byte [esi], byte es:[edi]
jne 0x4e6196
push esi
lea esp, [esi]
or esp, dword [ebx + edi*4]
sal esi, 1
in eax, 0x3e
mov esp, 0xf04b3eda
mov ecx, 0x1069bf20
inc esi
dec ebx
call 0xfb3fd5a5
out dx, al
mov dword [0x6a971a98], esp
cli
mov ecx, 0x8757c78b
cmpsb byte [esi], byte es:[edi]
into
aaa
or esp, dword [eax - 0x2e6d7369]
push ebp
cmp ch, byte [edi + 0x7a]
popfd
mov esp, 0x4df6f9fe
xor al, 0x86
add dword [edx - 0x5230f2ba], edx
out 0x78, al
jp 0x4e624d
enter 0x36, 0xffffffffffffffa7
sbb byte [eax + ecx*8 + 3], cl
aad 0xd7
ljmp 0xc863
inc ecx
test eax, 0x8c2a9077
lahf
clc
xchg edi, eax
mov word [edi + 0x3ab997f8], ds
out dx, eax
cmpsb byte [esi], byte es:[edi]
sti
mov ecx, 0xfba6ef3a
test eax, 0x6259cd7c
pop eax
or ecx, edi
sub ebx, dword [eax - 2]
cwde
pop es
push cs
aaa
lodsb al, byte [esi]
jbe 0x4e6248
mov dh, 0x3c
dec ebx
int 0xaa
cmp dword [eax + 0x4d], ebp
adc dword fs:[eax - 0x7f92af63], 0x527a8ea9
push esp
adc eax, 0x25e91481
js 0x4e6251
jno 0x4e62d5
popal
and eax, 0xccd75d50
ret 0xf165
sahf
pop esp
xor edi, dword [ecx + ecx*4]
fist dword [ebx + esi*4 - 0x458c51e8]
invalid

Function at 0x4e7743
Capabilities:
Encode data using xor

Disassembly:
mov dword [0xd51a4576], eax
pop edx
imul esp, ebx, 0xffffffe2
adc al, 0xc9
shl edx, 0xb9
scasd eax, dword es:[edi]
daa
add esi, dword [ebp - 0x1f44b9b8]
pop ebx
cmp esi, ebx
add eax, esp
xor dword [edi + eax*4 + 0x37], ecx
dec esp
xchg dword [edi], esi
dec esp
xchg dword [edi], esi
mov esp, 0x299558d9
or al, 0x62
call 0x8958eafb
xlatb
scasd eax, dword es:[edi]
mov ecx, 0x250da12c
dec esp
adc al, 0xbb
out 0x6a, al
jl 0x4e7726
test byte [ebx], dl
push gs
add eax, 0xe0fe07c5
fcom dword [ebp + 0x75fa0b0d]
invalid
Function at 0x53c94e
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
pop ss
mov ecx, 0x40acb273
mov eax, dword [0xbd43b8a7]
enter 0x34d9, 0x2e
lahf
outsb dx, byte [esi]
or cl, bl
sbb al, 0xfe
mov edx, 0xe26eace0
mov edi, 0xad405b51
mov dword [ebx + 0x49d3872d], edi
imul ebx, dword [edx - 0x62], 0x555291dd
movsd dword es:[edi], dword [esi]
xchg byte [ebx + 0x51], al
dec bx
outsd dx, dword [esi]
mov edi, 0xc2a159af
add esp, ecx
mov ah, 0xa8
pop esi
fimul word [eax + ebx*2 - 0x11d8b9f5]
or eax, dword [esi + 0x27]
out dx, al
out dx, eax
and dword [ecx + 0x42], eax
sal dword [ebp + 0x3e], cl
inc edi
inc esi
and eax, 0x4013f05e
cli
jne 0x53c895
movsb byte es:[edi], byte [esi]
pop ebx
stc
mov es, ecx
xor byte [edx], 0x56
fcomp dword [ebx - 0x3e]
sub eax, 0x897d4cb8
insd dword es:[edi], dx
jg 0x53c8e2
pushal
pop ecx
or al, 0xf3
mov ch, 0x18
fidiv word [edx - 0x31]
sbb dh, bl
jb 0x53c8d7
xor al, 0x18
shl dword [ebp - 0x7f], 0xc5
or eax, 0xecdee860
cmp al, 0x2e
mov al, byte [0xec54aac2]
xchg ebx, eax
jg 0x53c904
xchg esi, eax
rol eax, 1
xchg ebp, eax
add eax, 0x4f8fcb55
jle 0x53c947
and byte [esi + 0x6d5eb07c], cl
iretd
invalid
cmpsb byte [esi], byte es:[edi]
pop edx
mov gs, word [edi + edi*8 - 0xe4a4222]
test byte [ebx - 0x431de17a], al
jae 0x53c8e2
int 0x5d
in al, dx
push eax
pop eax
and byte [edx + 0x45], al
lds edx, [ebx + 0x1b]
fnstsw word [edx]
test dword [ecx + 0x18d2fbc3], ebx
add eax, esp
stosd dword es:[edi], eax
paddd mm3, mm6
push ebp
add edi, ebx
fnstsw word [ecx + 0x1b]
sbb dl, 0x72
cpuid
sbb al, 0x57
inc esp
cmp eax, 0x18bf75ff
jo 0x53c9b8
xor eax, 0x897f4107
push cs
sub al, 0xf1
lahf
insd dword es:[edi], dx
mov cl, 0x2e
nop
and esp, eax
insd dword es:[edi], dx
mov cl, 0x8e
jne 0x53c9e1
invalid
pop ebp
fcom qword [eax - 0x30]
xchg edx, eax
outsd dx, dword [esi]
popal
cmp edx, dword [eax + ebx*4]
pop esi
pop ebp
inc ebx
aam 0x52
sar esi, 1
add bh, byte [edi + 0x650b1950]
xchg edi, eax
or esp, dword [ebp - 0x69]
retf
and edi, dword [edx + 0xc]
jo 0x53c99f
pop edi
dec esp
inc edi
cmpsb byte [esi], byte es:[edi]
adc dword [ebp - 0x6357dea6], eax
test al, 0x9c
jb 0x53c9ef
dec esi
pop es
xlatb
sub dword [esi], 0xffffffef
or bh, byte [esi - 0x39]
inc ebx
add eax, 0xbfe02553
outsb dx, byte [esi]
mov edi, 0x5e2fe38e
sal ecx, 1
sub dword [edi + 0x12], ebp
pop ebx
adc eax, ecx
sal byte [esi + edi*8], 1
jp 0x53c9f6
adc eax, dword [eax]
test dword [edx - 0x6dd29f1], 0x60d3b819
cmc
pop ecx
xor eax, ebp
loop 0x53ca8c
leave
mov cl, 0x2b
retf 0x3da5
popal
jmp 0x53e1e3
rcr cl, 1
das
call 0x41a472e1
mov al, byte fs:[0x4585713f]
js 0x53e25a
mov byte [esi - 0x1a7b5ea7], cl
mov gs, ecx
mov eax, 0x2777ccb0
mov esi, 0x4806884a
fistp dword [eax + 0x41f0829c]
popal
sbb ebx, dword [ecx + 0x14]
rcl dword [ecx - 0x51], 0x57
ffreep st(0)
xor byte [ecx + 0x6c8f1cae], 0x49
lodsb al, byte [esi]
xor byte [ecx + 0x672e0332], 0x3f
jo 0x53e26f
mov dl, 0x81
rcr edi, 0x27
mov edi, 0xbdd1aa30
aad 0x2f
add cl, byte [esi - 0x78]
xlatb
invalid
xchg eax, ebp
imul ebp, dword [edi], 0x67bdc242
ret 0xf476
mov word [ebx], ss
scasd eax, dword es:[edi]
adc eax, dword [eax + 0x773dba92]
jmp 0x53e2f7
pop ebp
dec edx
std
dec ebx
push eax
cmc
iretd
Function at 0x5b16fe
Capabilities:
Encode data using xor

Disassembly:
or al, 0x8c
retf 0xdacc
loopne 0x5b16fa
fdiv dword [edx - 0x7f]
push cs
jg 0x5b1719
mov cl, 0x2e
sbb ah, dl
invalid
aam 0xc6
inc dword [edx + 0x753e2c92]
xchg edx, eax
sub al, 0x3e
jne 0x5b1721
iretd
sbb al, 0x7e
add byte [edi + ebp*8 + 0x7f682091], al
jae 0x5b16ea
mov gs, word [esi + ebx*4 - 0x1331120]
add byte [ecx], 0xec
fisub word [eax + 0x1c6f9ce3]
pop ebx
lodsb al, byte [esi]
push ds
test al, 0x62
xlatb
xchg ebp, eax
sar dword [esi + 0x4d2c523c], 0xdc
mov dl, 0xcc
xor byte [ebx], 0x4b
mov ebp, 0x80ae9cbe
invalid
inc ebx

Function at 0x5b177e
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x5b17c2
aam 0xdc
mov dl, 0xcc
jno 0x5b17b6
inc ebx
dec ah
invalid
aam 0xb9
into
dec ebx
push cs
or al, 0x5e
xor byte [edx + 0x2e016486], bl
pushfd
pushfd
invalid

Function at 0x5f77f9
Capabilities:
Encode data using xor

Disassembly:
cli
jle 0x5f7803
mov cs, word [edx]
xchg ebp, eax
aad 0x94
or al, 7
popal
inc ebx
lea edx, [edx - 0x36]
sti
jmp 0x9abed6c8
and ecx, ebp
and byte [ecx], ch
sub dword [esi + 0x31], eax
cli
sub dword [esi + 0x31], eax
cli
bound esp, qword [ebx + 0x69fe3dd7]
das
xchg ebx, edi
js 0x5f77f6
mov al, 0x54
jbe 0x5f77b0
xchg esp, eax
inc esi
cmc
invalid

Function at 0x5f909e
Capabilities:
Encode data using xor

Disassembly:
cmc
mov bl, 6
shr ecx, 0x25
inc ebp
push 0x12
movsd dword es:[edi], dword [esi]
xchg edx, eax
shl byte [edi - 0x77], 0x56
sub al, 0xb7
insb byte es:[edi], dx
sub byte [bp + si + 0x12], bl
xchg ebx, eax
push esi
add bh, byte [edx - 1]
aaa
push 0xaf9bbca8
xor al, 0x3a
popal
xor edi, eax
fbstp tbyte [edi]
or byte [ecx + 0x62], al
rcl byte [ecx + 0xa], cl
mov edx, 0x9d755e93
jg 0x5f90fb
adc edi, dword [eax - 0x22c74d26]
lahf
neg dword [ecx]
ficomp word [edi]
mov byte [0x390f33da], al
out dx, al
mov dword [edx + ecx*8 - 0x46], ecx
clc
push esi
push ebp
jb 0x5f904d
push 0xffffffffffffffbf
sbb al, 0xa6
insb byte es:[edi], dx
adc ecx, dword [esp + esi*8]
fadd qword [edx + ecx*4 - 0x1a]
sbb ecx, dword [0x23872c0b]
cmp byte [ebp + 0x4f], al
xor eax, 0xf3eb70ca
mov es, ebx
test eax, 0xd870b582
xor byte [0x3e568a32], dl
sub dword [edi], ebp
loop 0x5f90a6
je 0x5f90d0
ret 0x15de
adc eax, 0x13a421b7
adc byte [edx + ebx*8], dl
mov dword [esp + edx*2 - 0x758db97b], ecx
xlatb
adc cl, byte [ebx + 0x370b7733]
add bl, byte [edi]
imul byte [0x7d933ec5]
mov dword [0x168ea182], eax
clc
rsqrtps xmm6, xmmword [eax + 0xa2083d4]
xchg edx, eax
dec esi
mov ch, 0xee
out dx, al
sbb dword [ecx + edi*2 + 0x37], esi
pop ebp
mov eax, dword [0xfb4fa786]
loope 0x5f90fe
add dl, byte [eax - 0x6d]
or cl, byte [esi - 0x1e]
aam 0xa5
jo 0x5f90d8
scasb al, byte es:[edi]
add dword [edi - 0x40], esp
mov eax, dword [0xdb25a417]
or ebx, dword [eax + esi*8 - 0x2ca783a8]
sub byte [eax - 0xbebc166], al
stosb byte es:[edi], al
xchg edx, eax
invalid
Function at 0x4148c0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a6f8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0049b3c8
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x414942
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00498c90
mov eax, dword [eax]
push 0x534230
push eax
call fcn.0048a5c4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0049b653
test bl, bl
je 0x414942
push 0x534230
lea ecx, [esp + 0xc]
call fcn.0049b9e3
push 0x537db0
lea ecx, [esp + 0xc]
call fcn.0049b9e3
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41497e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0049b653
jmp 0x414a49
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x414a02
lea edx, [esp + 0x7c]
push 0x537dac
push edx
call fcn.0048a5c4
add esp, 8
test eax, eax
je 0x414a02
lea eax, [esp + 0x7c]
push 0x537da8
push eax
call fcn.0048a5c4
add esp, 8
test eax, eax
je 0x414a02
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x414992
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0049b653
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x415240
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4152a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4152b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a700b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x546140]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4153e8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x415316
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0049b653
xor eax, eax
jmp 0x41545f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0049b790
push esi
lea ecx, [esp + 0xc]
call fcn.0049ba1f
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x537de8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41543d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push 0x537de0
push closesocket
call fcn.00415240
test eax, eax
jne 0x41543d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push 0x537dcc
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00415240
test eax, eax
jne 0x41543d
lea eax, [esp + 0x14]
push 0x537dc4
push eax
call fcn.0048b600
mov esi, eax
add esp, 8
test esi, esi
jne 0x41541c
lea ecx, [esp + 0x14]
push 0x537dc0
push ecx
call fcn.0048b580
mov esi, eax
add esp, 8
test esi, esi
jne 0x41541c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41541f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0049b740
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41532e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0049b653
xor eax, eax
jmp 0x41545f
mov byte [esi], 0
push 0x537dbc
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0049b653
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x426950
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x4269be
cmp si, 0x69
ja 0x4269be
add esi, 0xffd0
cmp si, 0x11
je 0x42698e
push 0x11
call edi
test ax, ax
jge 0x42698e
or esi, 0x2000
cmp si, 0x10
je 0x4269a3
push 0x10
call edi
test ax, ax
jge 0x4269a3
or esi, 0x4000
cmp si, 0x12
je 0x4269b8
push 0x12
call edi
test ax, ax
jge 0x4269b8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x4269cb
mov esi, 0xbd
jmp 0x42697f
cmp si, 0x6e
jne 0x4269d8
mov esi, 0xbe
jmp 0x42697f
cmp si, 0x6f
jne 0x426979
mov esi, 0xbf
jmp 0x42697f

Function at 0x428070
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5569b8]
xor edx, edx
cmp eax, edx
jne 0x428096
xor eax, eax
mov byte [eax + 0x5568b8], al
inc eax
cmp eax, 0x100
jl 0x42807e
mov dword [0x5569b8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5568b8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x428127
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4280fa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4280c8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4281a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4281f3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4281da
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret