joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fcb33
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
xchg dword [esp + 0xc], edx
jmp 0x4fcb5f
btr eax, edx
jg 0x4fcc25
lea edx, [eax + edi]
btc eax, ebx
mov ax, sp
shr ah, 1
shl dh, 3
jmp 0x4fcbd5
lea esp, [esp + 0x14]
dec cl
mov dh, 0x88
bsf dx, si
jmp 0x4fcbfb
mov dl, dh
rdtsc
mov dx, 0x10d7
bsf ax, si
mov dh, byte [esp]
pushal
jmp 0x4fcc46
xchg word [esp + 0x10], dx
lea esp, [esp + 2]
jmp 0x4fcbac
mov ax, sp
shr ah, 1
shl dh, 3
jmp 0x4fcbd5
jb 0x4fcbbe
mov dl, dh
rdtsc
jmp 0x4fcc07
mov dx, 0x10d7
bsf ax, si
mov dh, byte [esp]
jmp 0x4fcbcd
lea edx, [eax + edi]
btc eax, ebx
jmp 0x4fcbf1
call 0x4fcd5b
inc esp
fimul dword [eax + 0x2f]
fisubr dword [eax - 0x5a]
aas
scasd eax, dword es:[edi]
retf 0xf539
sub esp, 0x1e
jnp 0x4fcc2d
jp 0x4fcc2d
jmp 0x4fcd33
stc
call fcn.004fcc8e
rol dh, 3
jbe 0x4fccde
bswap edx
mov edx, 0x98f5d742
jmp 0x4fcd15
mov ax, 0x20d1
mov dh, 0xe0
mov dh, byte [esp]
sub esp, 0xa
jmp 0x4fcd43
bswap edx
mov edx, 0x98f5d742
jmp 0x4fccc0
mov ax, 0x20d1
mov dh, 0xe0
mov dh, byte [esp]
jmp 0x4fccc9
inc cl
neg dh
jnp 0x4fcca7
stc
jmp 0x4fcca8
mov dh, bh
mov word [esp + 2], dx
dec dx
jnp 0x4fcff1
jp 0x4fcf12
add edi, dword [edx + reloc.WINMM.dll_midiStreamStop]
inc edx
inc dl
jge 0x4fcc4d
jl 0x4fcc4d
lea esp, [esp + 2]
jmp 0x4fcdd1
je 0x4fcdc6
lea edx, [edx + edx]
pop dword [esp + 6]
jmp 0x4fcd6d
mov dl, byte [esp]
lea eax, [eax + 0x29]
jmp 0x4fcdaa
jmp 0x4fcd92
mov edx, dword [ecx + ebp]
mov eax, dword [esp]
mov ax, word [esp]
xchg ecx, eax
xchg cl, ch
jmp 0x4fce70
lea edx, [edx + edx]
pop dword [esp + 6]
lea esp, [esp + 2]
sub esi, 4
lea eax, [ebx*4]
adc eax, esi
jno 0x4fcda8
mov dl, byte [esp]
lea eax, [eax + 0x29]
jmp 0x4fcdaa
bswap eax
call fcn.004fce33
pop es
xchg dword [esp], edi
push edx
lea eax, [ebx + edi]
add esp, 1
mov dx, 0x8c13
mov al, ah
jmp 0x4fce59
add esp, 0
lea esp, [esp + 1]
xchg dword [esp], edi
rdtsc
mov dx, 0x7b95
jmp 0x4fce42
sub esp, 2
mov ax, 0x1553
mov ah, byte [esp + 1]
lea esp, [esp + 2]
jmp 0x4fcea3
lea esp, [esp + 3]
lea edi, [edi - 0x22]
push esp
pop cx
add esp, 1
lea esp, [esp]
jmp 0x4fce1c
mov dword [esi], edx
bt ecx, edx
jo 0x4fce02
bswap eax
xchg dx, cx
mov edx, 0xa2b9abe
jmp fcn.004fce88
push dword [esp]
ret 4
not ax
mov dword [esp + 0x13], esi
and ecx, 0x3c
lea eax, [edx + ebx]
sub esp, 0x1a
jmp 0x4fcd87
lea esp, [esp + 2]
jmp 0x4fcff5
lea esp, [esp + 2]
lea esp, [esp + 8]
ror cl, 0
pushal
setp dh
jmp 0x4fceba

Function at 0x4fce33
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, ebx
sete dh
mov cl, byte [esp]
rdtsc
setae ah
jmp 0x4fce0a

Function at 0x4fd59b
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x4fd59b
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
sub al, 0xaf
sub al, 0x1b
mov byte [esp], bh
lea esp, [esp + 0x28]
sub eax, 0x1b2df3b7
jmp 0x4fd589
pushal
jmp 0x4fd5b5
Function at 0x4fd5e5
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0x4fbaad
call fcn.004fbab2
jmp 0x4fd5eb
jmp fcn.004fbe8d
bswap eax
bsr cx, bp
jle 0x4fd4cf
jg fcn.004fbe8d
sub dword [edx + ebp + reloc.WINMM.dll_midiStreamStop], esi
pushal
mov dword [reloc.WINMM.dll_midiStreamStop], eax
not ecx
xchg ch, dl
not cx
add esi, 4
lea ecx, [esi - 0xf5]
xchg edx, eax
jmp 0x4fd4e7
inc al
mov dword [ecx + ebp], edx
xchg edx, eax
bswap eax
jmp 0x4fd4ff
stc
neg al
jmp 0x4fd520
test eax, eax
jmp 0x4fd5c3
je 0x4fba76
jne 0x4fd5cf
rol dword [eax + reloc.WINMM.dll_midiStreamStop], 0
add byte [eax], al
call 0x4fd5e5
inc edi
je 0x4fd61b
jne 0x4fd64c
jb 0x4fd641
outsb dx, byte [esi]
je 0x4fd633
push 0x64616572
add bl, ch
and al, 0xd5
inc esp
neg esi
pop eax
sub eax, 0xdd4c8481
call dword [eax - 0x22b4c014]
jmp 0x4fd5a1
jae 0x4fd671
invalid
or ax, 0x523a
jne 0x4fd561
cmp dl, byte [edx + 0xf]
test dword [esi], esp
invalid
stc
neg al
inc al
jmp 0x4fd522
invalid
and al, 0x20
jmp 0x4fd6a5
daa
or byte [0xa317e49d], 0x1c
outsd dx, dword [esi]
jbe 0x4fd6d1
mov ebp, esi
mov edx, dword [ebp]
pop ebp
jmp 0x4fd631
call fcn.004fd6b9
add byte [eax], al
add byte [eax], al

Function at 0x505dbb
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0x4f0857

Function at 0x53d582
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp - 8]
push esp
add esp, 3
jmp 0x53d448
call 0x53d63f
lea esp, [esp + 4]
jmp 0x4f29f9
pushal
pop word [esp + 3]
push word [esp + 1]
jmp 0x53d67e
mov dword [ebp - 8], edx
jmp 0x53d45f
mov byte [esp], ch
add esp, 1
lea esp, [esp + 3]
jmp 0x53d426
lea esp, [esp]
add esp, 0
lea esp, [esp + 1]
jmp 0x53d553
lea esp, [esp + 0x3c]
jmp 0x4f296b
mov dl, byte [edx]
clc
call fcn.0053d4e0
pop word [esp]
mov word [esp], bx
lea esp, [esp + 2]
inc ecx
call 0x53d584
lea eax, [edx]
add byte [eax], al
add byte [ebp + 0x2f79002], cl
mov ebp, 0x3257c74d
sar dword [eax - 0xb], 0x78
out dx, al
nop
test dword [edx], reloc.WINMM.dll_midiStreamStop
xor al, cl
js 0x53d56f
js 0x53d56a
mov dword [eax - 0x32], edi
aad 0x44
imul ebx
jmp 0x53d55b
call fcn.0053d5d8
mov byte [esp + 3], dh
lea esp, [esp + 2]
lea esp, [esp + 4]
inc ecx
sub esp, 0x12
jmp 0x53d5c1
push esp
pushal
pop dword [esp + 0x20]
lea esp, [esp + 2]
jmp 0x53d656
lea esp, [esp + 0x20]
jne 0x4f296b
je 0x4f2985
xor ecx, ecx
jmp 0x4f298a
lea esp, [esp + 0x30]
test dl, dl
pushal
push word [esp + 0x17]
lea esp, [esp + 2]
jmp 0x53d62f
mov byte [esp + 9], ch
lea esp, [esp + 0x20]
test ecx, ecx
call fcn.0053d668
clc
jmp 0x53d740
lea esp, [esp + 4]
cmp ecx, dword [eax + 0x18]
call fcn.0053d71d
mov byte [esp + 1], ch
jmp 0x53d756
lea esp, [esp + 4]
lea ecx, [edx + ecx*4]
jmp fcn.004f2955
Function at 0x60bf0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc dl
rdtsc
neg si
xchg word [esp], ax
xchg ch, dl
mov bl, 0x20
jmp 0x60bef4
rdtsc
mov ebp, esi
add cx, 0xb74e
pop bp
lea eax, [esp + edi]
inc ax
jmp 0x60beaf
xchg byte [esp], al
mov byte [esp], dh
and cl, bh
xchg ecx, eax
and cx, 0xbad2
xchg esi, eax
jmp 0x60bf23
xchg cx, si
btr eax, esp
inc al
xchg word [esp], bx
mov byte [esp], ch
jmp 0x60bedb
jmp 0x60bec9
neg ah
sub esp, 0x1e
xchg dh, al
lea esp, [esp + 0x1b]
pop edx
add esp, 1
jmp 0x60bfc2
cpuid
not dx
lea ebx, [ecx + 0xf3]
mov byte [esp], dh
not bh
push esp
jmp 0x60bf0d
mov dl, 0xf4
xchg ch, dl
btc ebx, ebx
popal
mov byte [esp + 1], ch
sub si, 0x350
jmp 0x60bf54
add esp, 1
xor esi, esi
xchg esi, eax
and dx, 0xec22
pushal
inc bl
jmp 0x60bf7a

Function at 0x60c1f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop si
mov byte [esp + 2], ch
bswap ebx
btr ecx, edx
not si
cmc
jmp 0x60c1dd

Function at 0x60c287
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], di
jmp 0x60c291
pop eax
mov cl, ch
mov byte [esp], bh
xchg di, bx
bswap esi
mov ch, byte [esp + 1]
jmp 0x60c2be

Function at 0x60c64e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
mov bl, 0x60
push word [esp + 2]
cpuid
push dword [esp + 8]
xchg edi, ebx
jmp 0x60c65d
xchg word [esp + 5], di
cpuid
rdtsc
mov ah, byte [esp + 1]
jmp 0x60c62d
xor esi, esi
rdtsc
mov ebp, 0xed84bf44
mov esi, dword [esp + 0xb]
lea esi, [edi + edi]
btc ecx, ebx
jmp 0x60c72d
xor di, 0xeed4
mov dword [esp + 7], ecx
mov word [esp + 0xc], bx
mov cl, 0x1a
bsr di, bp
pop word [esp]
call fcn.0060c70a
dec ecx
jae 0x60c790
push 0x646c69

Function at 0x60cb1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, 0x6353
inc bx
jmp 0x60cb73
push esp
mov cl, ch
lea eax, [edx*4]
pop bp
mov byte [esp + 3], ah
jmp 0x60cbe4
lea ebx, [eax - 0x21]
mov word [esp + 0x1a], bx
popal
bswap edx
sub esp, 0x10
pop dword [esp + 8]
jmp 0x60cb25
inc eax
bswap ebp
not dx
pushal
rcr eax, 0x1b
popal
jmp 0x60cbcd
pushal
push esp
cld
mov dh, byte [esp + 0x25]
lea edi, [edx + esi]
inc ebp
jmp 0x60cc1d
push word [esp + 7]
inc bl
btr eax, edx
xchg cx, ax
stc
mov bx, word [esp + 8]
jmp 0x60cbbc
pop dword [esp + 0x21]
bswap ecx
xchg bx, ax
mov dword [esp + 0x22], eax
mov ax, bx
cpuid
jmp 0x60d096
sub esp, 0x1e
inc edi
neg dh
pop cx
rcr ch, 5
xchg word [esp + 2], cx
inc esi
mov edx, 0x2c11b356
lea esp, [esp + 0x10]
mov cl, ch
jmp 0x60cca4
mov word [esp + 0xf], bx
pop word [esp + 4]
mov word [esp + 7], bx
mov ax, word [esp + 5]
neg bp
rdtsc
jmp 0x60cd68
shr dh, 7
xchg dword [esp + 0xb], edx
mov byte [esp + 0xb], bh
rdtsc
sub dx, 0x7108
xchg ebx, edx
jmp 0x60cdaa
xchg ebx, edi
mov word [esp + 8], sp
sub esp, 0xc
pop dword [esp + 0x10]
rdtsc
mov word [esp + 0xe], dx
jmp 0x60cde9
pop di
add esp, 0x14
cld
bsf di, ax
mov ebx, dword [esp + 0xe]
pop ax
jmp 0x60ceaa
stc
pop dword [esp + 0x12]
pop bx
pop dword [esp + 0xb]
mov dx, word [esp + 4]
mov cx, 0x3477
jmp 0x60cfbc
Function at 0x61126b
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
invalid
inc dword [eax + 0x4e601d]
pushfd
sub esp, 0x1e
mov byte [esp + 0x1c], dh
call fcn.0060bcce
mov bx, 0xf8f9
mov byte [esp], dh
setns ch
inc cx
xchg byte [esp], dl
cld
jmp 0x60be99
push eax
jmp 0x60c071
mov cx, dx
lea edx, reloc.WINMM.dll_midiStreamStop
bsr di, cx
call fcn.0060bd9d
scasd eax, dword es:[edi]
cmp ch, byte [eax - 0x7c6cc531]
pop ds
invalid
rdtsc
mov ch, byte [esp]
mov dl, 0x5c
sub esi, eax
mov byte [esp], ch
bswap edx
jmp 0x60bdba
mov cl, ch
mov si, word [esp]
neg ax
xchg byte [esp], dl
sub ebx, eax
rcl dx, cl
jmp 0x60bdde
call 0x60c076
jmp 0x60cf11
cmp dword [eax + reloc.WINMM.dll_midiStreamStop], 0
jmp 0x60cf9a
pop eax
sub eax, 0x60c076
jmp 0x60cef8
je 0x60bd1d
lea esp, [esp + 8]
popal
jmp 0x60aaa1
call 0x610017
jmp 0x611230
movzx ebx, word [eax + 0x3c]
jmp 0x611254
int3
mov eax, dword [eax + 8]
push eax
jmp 0x610012
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x6112a0
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x611227
add ebx, eax
jmp 0x6112b9
lea esp, [esp + 2]
mov dword [esp + 0x6c], edi
lea esp, [esp + 0x6c]
mov eax, dword fs:[0x30]
jmp 0x61124a
je 0x60bd79
jne 0x6112a6
fistp word [ebx - 0x35]
scasb al, byte es:[edi]
pop ebp
mov ecx, 0x3552bc37
les esp, [ebx + 3]
mov dword [ecx], ebx
js 0x611223
pop ebp
mov dword [reloc.WINMM.dll_midiStreamStop], eax
invalid
je 0x61006a
sub eax, 0x10000
jmp 0x611234
cmp word [ebx], 0x4550
jmp 0x61127f
Function at 0x40ced0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47718b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00469cfa
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40cf52
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004674d0
mov eax, dword [eax]
push 0x493200
push eax
call fcn.00459f44
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00469f85
test bl, bl
je 0x40cf52
push 0x493200
lea ecx, [esp + 0xc]
call fcn.0046a361
push 0x496d74
lea ecx, [esp + 0xc]
call fcn.0046a361
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40cf8e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00469f85
jmp 0x40d059
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40d012
lea edx, [esp + 0x7c]
push 0x496d70
push edx
call fcn.00459f44
add esp, 8
test eax, eax
je 0x40d012
lea eax, [esp + 0x7c]
push 0x496d6c
push eax
call fcn.00459f44
add esp, 8
test eax, eax
je 0x40d012
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40cfa2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00469f85
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40d850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40d8b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40d8c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47720b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x49dd60]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40d9f8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40d926
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00469f85
xor eax, eax
jmp 0x40da6f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046a10e
push esi
lea ecx, [esp + 0xc]
call fcn.0046a39d
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40da4d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040d850
test eax, eax
jne 0x40da4d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040d850
test eax, eax
jne 0x40da4d
lea eax, [esp + 0x14]
push 0x496d88
push eax
call fcn.0045b0f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40da2c
lea ecx, [esp + 0x14]
push 0x496d84
push ecx
call fcn.0045b070
mov esi, eax
add esp, 8
test esi, esi
jne 0x40da2c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40da2f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046a0be
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40d93e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00469f85
xor eax, eax
jmp 0x40da6f
mov byte [esi], 0
push 0x496d80
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00469f85
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41e440
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41e4ae
cmp si, 0x69
ja 0x41e4ae
add esi, 0xffd0
cmp si, 0x11
je 0x41e47e
push 0x11
call edi
test ax, ax
jge 0x41e47e
or esi, 0x2000
cmp si, 0x10
je 0x41e493
push 0x10
call edi
test ax, ax
jge 0x41e493
or esi, 0x4000
cmp si, 0x12
je 0x41e4a8
push 0x12
call edi
test ax, ax
jge 0x41e4a8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41e4bb
mov esi, 0xbd
jmp 0x41e46f
cmp si, 0x6e
jne 0x41e4c8
mov esi, 0xbe
jmp 0x41e46f
cmp si, 0x6f
jne 0x41e469
mov esi, 0xbf
jmp 0x41e46f

Function at 0x41fb60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4aeb70]
xor edx, edx
cmp eax, edx
jne 0x41fb86
xor eax, eax
mov byte [eax + 0x4aea70], al
inc eax
cmp eax, 0x100
jl 0x41fb6e
mov dword [0x4aeb70], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4aea70
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41fc17
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41fbea
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41fbb8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41fc90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41fce3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41fcca
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426720
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x4268b8
cmp ebp, ebx
jle 0x4268b8
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, reloc.OLEAUT32.dll_VariantInit
mov dword [esp + 0x10], edi
jns 0x42677e
dec eax
or eax, 0xfffffff8
inc eax
je 0x426785
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, reloc.WS2_32.dll_accept
jns 0x426794
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x42679b
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.00469cc6
add esp, 4
cmp eax, ebx
je 0x4267bc
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.00469cc6
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x4268ae
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x426895
mov al, byte [edx]
cmp al, 0xc0
jbe 0x426881
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x426876
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x426884
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x426884
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x426820
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x426811
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x429b00
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x478718
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
test edi, edi
jne 0x429b39
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
push 0x400
lea ecx, [esp + 0xc]
call fcn.004717c3
mov eax, dword [esp + 0x40]
push 0
push edi
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call fcn.0047184b
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.00429bc0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.00471888
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
Function at 0x42e090
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x478ea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x74]
push edi
push eax
mov eax, dword [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.0042ec10
lea edx, [esp + 0x18]
push eax
push edx
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [esp + 0x18]
xor edi, edi
xor ecx, ecx
cmp eax, edi
setl cl
dec ecx
xor edx, edx
and ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, edi
mov dword [esp + 0x18], ecx
setl dl
dec edx
and edx, eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x20], edx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x42e139
mov eax, dword [esp + 0x6c]
push ebx
mov ebx, eax
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0042dd20
mov edx, eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push ecx
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push edi
lea ecx, [esp + 0x4c]
call fcn.00470a74
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], edi
call fcn.0043d310
mov edx, dword [esp + 0x5c]
add esp, 0xc
lea ecx, [esp + 0x18]
push 2
push ecx
push edx
call dword [sym.imp.GDI32.dll_LPtoDP]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
lea edx, [esp + 0x38]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.USER32.dll_IntersectRect]
mov esi, dword [esp + 0x6c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, esi
mov dword [esp + 0x64], 0xffffffff
mov dword [edx], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x48]
call fcn.00470ae6
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14