joyce8/EMBER2024-capa huggingface dataset:
Function at 0x736802
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
mov ah, byte [esp + 5]
mov ebp, dword [esp + 3]
rdtsc
mov dh, byte [esp + 5]
push word [esp + 3]
jmp 0x736908
rdtsc
mov dx, word [esp + 2]
jmp 0x7367e1
mov dh, bh
call 0x736876
mov ah, byte [esp + 1]
lea edx, [esp + ecx]
mov word [esp], sp
push edx
bswap ebp
mov eax, dword [esp + 0xc]
jmp 0x736890

Function at 0x752d9e
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp]
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x752d5d

Function at 0x7530ca
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
lea esp, [esp + 0x44]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
rol bx, cl
mov bl, 0x9e
jmp 0x7530d4
and edx, ecx
pushal
add esp, 3
add esp, 0x14
push dword [esp + 1]
jmp 0x75311a
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
pushal
jmp 0x75309e
movzx ebx, byte [esi + 9]
push esp
mov byte [esp], ah
jmp 0x7530b2
lea esp, [esp + 1]
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 0x16
sub esp, 0x1a
pop word [esp + 0x17]
jmp 0x7532d7
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x75315d
clc
mov dword [esi + 4], edi
mov di, word [esp]
neg di
mov edi, 0x6354c2e6
jmp 0x753175
neg edx
stc
mov edx, dword [esi + 8]
pushal
cmc
jmp 0x75318e
push word [esp + 5]
and edx, ecx
lea esp, [esp + 0x40]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x753222

Function at 0x7531a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 1]
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
push edx
sub esp, 4
jmp 0x7531d2

Function at 0x75324c
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
stc
stc
sub esp, 2
lea esp, [esp + 2]
jmp 0x753252
lea esp, [esp + 3]
jmp 0x75322f
and ebx, ecx
sub esp, 4
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x7532ae
sub esp, 8
jmp 0x75328c
mov bx, 0x99f1
mov bx, 0xffc1
dec ebx
mov bx, 0xbf9
movzx ebx, byte [esi + 0xd]
jmp 0x753264

Function at 0x753435
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp]
mov word [esp + 2], dx
jmp 0x753410
Function at 0x7534a6
Capabilities:
Encrypt data using aes

Disassembly:
pushal
push dword [esp + 0x18]
pushal
jmp 0x7534d8
mov dword [esp], eax
lea ecx, [ebx + edi]
setle cl
mov cx, word [esp]
push eax
call fcn.00751f69
xor edx, ecx
not cl
bswap ecx
mov ecx, 0xc63f1ff0
jmp 0x7529ad
mov ecx, dword [eax + 8]
push esp
push word [esp + 1]
mov word [esp + 2], dx
jmp 0x7529ba
mov dword [eax + 0x14], edx
lea ecx, [edx + edx]
not ecx
btr ecx, edi
jmp 0x752996
lea esp, [esp + 2]
xor ecx, edx
inc dh
mov dword [eax + 0x18], ecx
jmp 0x753945
jmp 0x752927
xor edx, ecx
cmc
call fcn.00752b63
pop dword [esp]
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
push esp
and ebx, ecx
jmp 0x75343f
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x753490
sub esp, 2
push word [esp + 1]
jmp 0x75341f
push dword [esp + 2]
lea esp, [esp + 7]
lea esp, [esp + 1]
dec dword [ebp - 4]
pushal
call fcn.007534c6
pop dword [esp + 0x10]
push dword [esp + 0x18]
jmp 0x75349d
and edx, ecx
clc
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
push edx
jmp 0x753465
mov dword [esi + 0xc], edi
call 0x7534a6
add ecx, dword [ecx + reloc.RASAPI32.dll_RasHangUpA]
and al, 0x8f
add al, 0x24
jmp 0x7534c8
lea esp, [esp + 0x28]
jne 0x724dc8
je 0x724de2
lea esp, [esp + 0x44]
pop edi
mov esi, dword [esp]
mov si, word [esp]
bswap ebx
jmp 0x753598
push esp
call fcn.007534f9
pop esi
pop ebx
leave
jmp 0x75351c
mov edx, dword [eax + 0xc]
sub esp, 0xc
push dword [esp + 0xa]
cmc
jmp 0x753408

Function at 0x75985f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
jmp 0x7597bc
lea edx, [edx + 0x78]
mov eax, dword [edx]
pop edx
push edx
sub esp, 0x1c
clc
jmp 0x759688
pushal
lea edi, [esp + ecx]
mov dword [esp + 0x14], ecx
popal
jmp 0x75969e
je 0x75936d
rcr ch, 5
neg ecx
btc ecx, edx
jmp 0x75970f
lea esp, [esp + 4]
mov dword [esp + 0x24], ecx
push esp
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x7596c7
mov ecx, dword [eax + 0x20]
sub esp, 0x1a
call fcn.007596f8
cmp ecx, edx
call 0x759722
jmp 0x759789
lea esp, [esp + 0x64]
mov dword [esp + 0x20], eax
push edx
push dword [esp]
pop dword [esp]
jmp 0x7596e5
ljmp 0x8cd:0x3e5bcb42
mov ecx, dword [ecx + 0x7c]
sub esp, 0x1a
sub esp, 0x1e
add eax, ebp
jmp 0x759741
mov byte [esp + 2], bh
push word [esp + 1]
push word [esp + 3]
push edx
jmp 0x7596bc
Function at 0x8546fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 5]
mov word [esp], bx
lea esp, [esp + 2]
lea esp, [esp + 0xc]
pushal
bswap ecx
jmp 0x854700
jmp 0x8546e0
inc ebp
ror edi, 3
bsr ax, bp
stc
mov eax, 0xba83368e
neg cx
jmp 0x854725
sub esp, 0x1c
xchg word [esp + 0xd], di
mov bp, dx
mov bx, sp
mov ax, 0xec51
jmp 0x8547d0
mov byte [esp + 1], bh
cpuid
push word [esp + 0x15]
lea ebx, [edx*4]
shr dh, 7
mov esi, dword [esp + 0x13]
jmp 0x85478e
btc edi, ebx
rdtsc
mov ax, 0x31c1
mov dword [esp + 1], ecx
mov dl, dh
pop ax
jmp 0x854744
rcl di, cl
mov byte [esp + 4], ch
mov word [esp + 0xc], di
mov dword [esp + 0xf], esi
jmp 0x8547b6
btr ebx, esp
setl dh
cmc
inc bp
btr ebp, esp
mov bl, bh
jmp 0x854777
btc edx, ebx
mov ah, byte [esp + 7]
pop di
bswap eax
btc edx, edi
sub eax, eax
jmp 0x8547fc
lea esp, [esp + 1]
btc edi, ebx
sub eax, eax
xchg word [esp + 0xe], bp
bsf si, ax
xchg bx, ax
jmp 0x85479e
btc edi, edi
pop dword [esp + 0xe]
mov bp, dx
mov eax, esi
rcl cx, cl
rdtsc
jmp 0x854764
pop eax
not ch
mov word [esp + 0x12], dx
mov ax, word [esp + 0xd]
push word [esp + 0x14]
jmp 0x8549c0
xchg word [esp + 0x12], bp
sub esp, 4
bsr dx, cx
xchg dword [esp + 7], ebx
xchg ah, bl
cld
jmp 0x8547e3
cpuid
bswap ebp
mov bl, bh
mov dl, 0x8c
cpuid
xchg ebp, eax
jmp 0x8548f1
mov si, dx
lea eax, [eax - 0x89]
lea ebp, [eax*4]
inc ebp
xchg ebp, ecx
bsf ax, ax
jmp 0x854826
setle ah
bswap ecx
xchg ah, bl
pop word [esp + 0x10]
call fcn.00854865
mov ebx, dword [esp + 2]
pop di
mov dl, dh
stc
push dword [esp + 0x16]
push esp
jmp 0x8549a5
rol bp, cl
popal
xchg byte [esp + 0x12], dl
push edx
xchg byte [esp + 4], cl
bswap esi
jmp 0x854888
mov word [esp + 0xe], di
lea eax, [ecx + 0x3b]
bswap edx
sub esp, 0x1a
push dword [esp + 0x15]
setg dh
jmp 0x8548cc
add esp, 0x1b
mov cx, 0xe3a5
mov word [esp], dx
add esp, 0
bsr ax, bp
add esp, 1
jmp 0x85497e
btc esi, ebx
mov byte [esp + 0xe], ah
bsr si, cx
xchg bx, di
mov bx, dx
cld
jmp 0x854907
pushal
not ax
not ax
xchg dh, al
pop word [esp + 7]
xchg dword [esp], eax
jmp 0x854931
add esp, 0
neg di
lea ebx, [eax*4]
sete ah
cpuid
setae ch
jmp 0x854a81
mov ch, byte [esp + 1]
btr eax, esp
lea ebp, [edi*4]
xchg ah, bl
add esp, 1
xchg byte [esp], dl
jmp 0x854961
xchg dx, ax
lea edi, [esp + esi]
pushal
lea esp, [esp + 0x43]
rol si, cl
lea ecx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x85494e
cpuid
mov ax, sp
xchg si, ax
xchg ah, bl
cpuid
lea edi, [esp + eax]
jmp 0x85484c
lea esp, [esp]
neg cx
add esp, 0
neg esi
cpuid
mov ebx, eax
jmp 0x854a57
mov bl, bh
xchg esi, ebp
mov byte [esp], dh
xchg ah, bl
mov cl, ch
xchg byte [esp], al
jmp 0x8549d3
lea edi, reloc.RASAPI32.dll_RasHangUpA
mov byte [esp], ah
mov bx, word [esp]
mov byte [esp], dh
push esp
xchg ah, bl
call fcn.00854a40
xchg edi, eax
add al, 0x9a
std
or al, 0xe5
and esi, dword [ecx + reloc.RASAPI32.dll_RasHangUpA]
xor byte [ebx], dh
sub al, byte [ebp - 0xc]
out 0x8b, eax
xor al, 0x24
mov esi, dword [esp]
cld
mov cx, word [esp]
inc bl
mov bx, sp
xchg byte [esp], al
jmp 0x8549ee
Function at 0x854d0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 8], ebp
cpuid
jmp 0x854d16
mov cx, sp
xor bx, 0x10ac
push word [esp + 1]
rdtsc
mov esi, dword [esp + 0xc]
mov dx, word [esp + 4]
jmp 0x854d49
bsr bx, bp
add esp, 6
mov word [esp + 3], di
lea ebx, [ebx + ebp]
jmp 0x854d98
lea ecx, [esi - 0xe5]
pop word [esp + 3]
lea esi, [esi + 0xb5]
jmp 0x854dd2
cpuid
add edx, ebp
popal
mov cl, ch
mov al, 0x6e
lea esp, [esp + 1]
jmp 0x854e22
mov word [esp + 4], bx
pop esi
pushal
setne ah
cpuid
xchg word [esp + 5], ax
jmp 0x854db5
mov al, 0x26
not dh
mov al, ah
btc edi, edi
push edx
lea ebp, [eax*4]
jmp 0x854f40
lea esp, [esp + 7]
xchg byte [esp + 4], bl
xchg ah, bl
xchg bp, ax
btc esi, ebx
add esp, 6
jmp 0x854de5
xchg byte [esp], cl
mov word [esp], di
mov bh, byte [esp + 1]
sub esp, 0xc
mov al, 6
jmp 0x854e03
cpuid
mov bl, 0xc0
mov word [esp + 0xb], dx
bswap ecx
pop dword [esp + 9]
push dword [esp + 6]
jmp 0x854e53
pop dword [esp + 3]
cpuid
xchg byte [esp + 4], al
setne bh
xchg dword [esp + 0xc], ecx
lea ecx, [ecx - 0xdb]
jmp 0x854e71
pop ax
cpuid
not bx
xchg word [esp + 0x12], si
mov ecx, dword [esp + 0x10]
pop si
jmp 0x854ee2
rcl bp, cl
clc
not dh
clc
pushal
lea eax, [esp + esi]
jmp 0x854f24

Function at 0x854f9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ebp, ecx
mov bl, bh
mov cl, ch
lea edi, [eax + 0x71]
cpuid
neg bp
rdtsc
xchg byte [esp], bl
mov ebp, esi
xchg dh, al
jmp 0x854b56
mov dl, dh
mov bx, 0xf2bf
lea ebx, [ebp + 0xe7]
lea esp, [esp]
xchg edi, edx
cpuid
jmp 0x854b7f
lea esp, [esp]
btc edi, edi
neg dh
rol cx, cl
mov eax, 0x6125111c
mov ebp, dword [esp]
jmp 0x854bb3
mov dl, 0x6c
neg eax
pop ebp
lea esp, [esp + 3]
not dx
mov ebx, 0x7bbf8bfa
jmp 0x854bd4
inc di
mov bp, word [esp + 3]
add esp, 0x1f
add ebx, ebp
sub esp, 2
jmp 0x854cf4

Function at 0x85a1e9
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x60], ebp
call fcn.0085a396
jmp 0x85a1c4

Function at 0x85a1eb
Capabilities:
Parse pe header

Disassembly:
pop dword [esp]
push dword [esp]
mov byte [esp + 4], bh
push word [esp + 9]
call fcn.0085a313
insd dword es:[edi], dx
call 0x26dbb83
lea eax, reloc.RASAPI32.dll_RasHangUpA
xor al, 0x27

Function at 0x85a396
Capabilities:
Parse pe header

Disassembly:
push word [esp + 0x1d]
lea esp, [esp + 2]
mov dword [esp + 0x80], esi
push esp
push word [esp + 1]
jmp 0x85a20d
mov word [esp + 2], sp
call fcn.0085a1eb
pushal
mov dword [esp + 5], ecx
mov byte [esp + 0xe], dh
mov dword [esp + 0x15], ecx
mov dword [esp + 9], ebp
jmp 0x85a1cd

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4377e5
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.004bef24
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004bef24
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.004bef24
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x20], esp
mov eax, 8
call fcn.004bef36
cmp dword [ebp - 0x20], esp
je 0x4378a2
push 6
call fcn.004bef30
add esp, 4
mov dword [ebp - 4], eax
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4378bb
push ebx
call fcn.004bef2a
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0xc]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 9
call fcn.004bef36
cmp dword [ebp - 0x20], esp
je 0x4378ea
push 6
call fcn.004bef30
add esp, 4
mov dword [ebp - 0x20], esp
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x55e19b
mov eax, 0xa
call fcn.004bef36
cmp dword [ebp - 0x20], esp
je 0x437914
push 6
call fcn.004bef30
add esp, 4
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x14]
add ebx, 8
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xc
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 2
mov dword [ebp - 0x20], esp
mov eax, 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push 0x1c
push dword [ebp - 0x14]
push 0
push dword [ebp - 0xc]
mov eax, 0xb
call fcn.004bef36
cmp dword [ebp - 0x20], esp
je 0x4379a8
push 6
call fcn.004bef30
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0xc]
mov eax, 0xc
call fcn.004bef36
cmp dword [ebp - 0x20], esp
je 0x4379cd
push 6
call fcn.004bef30
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x4379d5
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4379e6
push ebx
call fcn.004bef2a
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.004bef2a
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.004bef2a
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
call fcn.004bef2a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4b4a15
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.004bef24
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004bef24
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.004bef24
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x20], esp
mov eax, 0x11
call fcn.004bef36
cmp dword [ebp - 0x20], esp
je 0x4b4ad2
push 6
call fcn.004bef30
add esp, 4
mov dword [ebp - 4], eax
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4b4aeb
push ebx
call fcn.004bef2a
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0xc]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x12
call fcn.004bef36
cmp dword [ebp - 0x20], esp
je 0x4b4b1a
push 6
call fcn.004bef30
add esp, 4
mov dword [ebp - 0x20], esp
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x55e19b
mov eax, 0x13
call fcn.004bef36
cmp dword [ebp - 0x20], esp
je 0x4b4b44
push 6
call fcn.004bef30
add esp, 4
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x14]
add ebx, 8
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xc
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 2
mov dword [ebp - 0x20], esp
mov eax, 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push 0x1c
push dword [ebp - 0x14]
push 0
push dword [ebp - 0xc]
mov eax, 0x14
call fcn.004bef36
cmp dword [ebp - 0x20], esp
je 0x4b4bd8
push 6
call fcn.004bef30
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0xc]
mov eax, 0x15
call fcn.004bef36
cmp dword [ebp - 0x20], esp
je 0x4b4bfd
push 6
call fcn.004bef30
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x4b4c05
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4b4c16
push ebx
call fcn.004bef2a
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.004bef2a
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.004bef2a
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
call fcn.004bef2a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4cb3e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x55517b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00549930
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4cb462
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.005472e0
mov eax, dword [eax]
push 0x5c0234
push eax
call fcn.00539224
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00549bbb
test bl, bl
je 0x4cb462
push 0x5c0234
lea ecx, [esp + 0xc]
call fcn.00549f4b
push 0x5c3db4
lea ecx, [esp + 0xc]
call fcn.00549f4b
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4cb49e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00549bbb
jmp 0x4cb569
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4cb522
lea edx, [esp + 0x7c]
push 0x5c3db0
push edx
call fcn.00539224
add esp, 8
test eax, eax
je 0x4cb522
lea eax, [esp + 0x7c]
push 0x5c3dac
push eax
call fcn.00539224
add esp, 8
test eax, eax
je 0x4cb522
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4cb4b2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00549bbb
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4cbd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4cbdc2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4cbdd0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5551fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5d2f08]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4cbf08
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4cbe36
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00549bbb
xor eax, eax
jmp 0x4cbf7f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00549cf8
push esi
lea ecx, [esp + 0xc]
call fcn.00549f87
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4cbf5d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.004cbd60
test eax, eax
jne 0x4cbf5d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.004cbd60
test eax, eax
jne 0x4cbf5d
lea eax, [esp + 0x14]
push 0x5c3dc8
push eax
call fcn.0053a2f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4cbf3c
lea ecx, [esp + 0x14]
push 0x5c3dc4
push ecx
call fcn.0053a270
mov esi, eax
add esp, 8
test esi, esi
jne 0x4cbf3c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4cbf3f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00549ca8
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4cbe4e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00549bbb
xor eax, eax
jmp 0x4cbf7f
mov byte [esi], 0
push 0x5c3dc0
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00549bbb
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4

Function at 0x4d5206
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
mov eax, dword [esi + 0x3ac]
test eax, eax
jne 0x4d522e
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x3ac], eax
pop esi
add esp, 0x190
ret
Function at 0x4df370
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x4df3de
cmp si, 0x69
ja 0x4df3de
add esi, 0xffd0
cmp si, 0x11
je 0x4df3ae
push 0x11
call edi
test ax, ax
jge 0x4df3ae
or esi, 0x2000
cmp si, 0x10
je 0x4df3c3
push 0x10
call edi
test ax, ax
jge 0x4df3c3
or esi, 0x4000
cmp si, 0x12
je 0x4df3d8
push 0x12
call edi
test ax, ax
jge 0x4df3d8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x4df3eb
mov esi, 0xbd
jmp 0x4df39f
cmp si, 0x6e
jne 0x4df3f8
mov esi, 0xbe
jmp 0x4df39f
cmp si, 0x6f
jne 0x4df399
mov esi, 0xbf
jmp 0x4df39f

Function at 0x4e0ba0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5e3738]
xor edx, edx
cmp eax, edx
jne 0x4e0bc6
xor eax, eax
mov byte [eax + 0x5e3638], al
inc eax
cmp eax, 0x100
jl 0x4e0bae
mov dword [0x5e3738], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5e3638
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4e0c57
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4e0c2a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4e0bf8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4e0c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4e0cb3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4e0c9a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret