joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bc0d
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x41527c]
xor ecx, ecx
xor eax, ebp
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x40bc49
xor eax, eax
jmp 0x40bdb3
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x416880]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x40bc87
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.0040d53d
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x40bd21
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x40bd84
jmp 0x40bcab
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x40bce6
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x40bcd7
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x40bcb7
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40bd45
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x40bd4e
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x40bca9
jmp 0x40bd4e
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40bd45
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x40bd4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x40bdae
cmp dword [ebp - 0x68], eax
je 0x40bd81
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x40bd76
call fcn.004068e1
mov dword [eax], 9
call fcn.004068ea
mov dword [eax], esi
jmp 0x40bda9
push dword [ebp - 0x68]
call fcn.004068f3
pop ecx
jmp 0x40bda9
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x40bd96
cmp byte [edi], 0x1a
jne 0x40bd96
xor eax, eax
jmp 0x40bdb1
call fcn.004068e1
mov dword [eax], 0x1c
call fcn.004068ea
and dword [eax], 0
or eax, 0xffffffff
jmp 0x40bdb1
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call fcn.004052d1
add ebp, 0x3a4
leave
ret
Function at 0x40c28d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4166f0], ebx
push esi
push edi
jne 0x40c30d
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40c348
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x413dcc
push edi
call esi
test eax, eax
mov dword [0x4166f0], eax
je 0x40c348
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x4166f4], eax
call esi
cmp dword [0x41652c], 2
mov dword [0x4166f8], eax
jne 0x40c30d
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x416700], eax
je 0x40c30d
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x4166fc], eax
mov eax, dword [0x4166fc]
test eax, eax
je 0x40c352
call eax
test eax, eax
je 0x40c339
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x416700]
test eax, eax
je 0x40c339
test byte [ebp - 8], 1
jne 0x40c352
cmp dword [0x416538], 4
jb 0x40c34c
or byte [ebp + 0x12], 0x20
jmp 0x40c371
xor eax, eax
jmp 0x40c381
or byte [ebp + 0x12], 4
jmp 0x40c371
mov eax, dword [0x4166f4]
test eax, eax
je 0x40c371
call eax
mov ebx, eax
test ebx, ebx
je 0x40c371
mov eax, dword [0x4166f8]
test eax, eax
je 0x40c371
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4166f0]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4039d6
Capabilities:
Create pipe
Get common file path
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4d3588]
mov ecx, dword [0x4d24dc]
sub esp, 0xc34
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x403ace
mov ebx, ecx
mov dword [ebp - 4], eax
cmp dword [0x4d3588], 0x959
jne 0x403abc
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
push esi
lea eax, [ebp - 0xc30]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402c64
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0x402eb8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402f00
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.004037d9
add ebx, 8
dec dword [ebp - 4]
jne 0x4039ff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40559b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42233c]
jne 0x4055a5
repz ret
jmp fcn.00408b3c

Function at 0x40af1b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406b66
and dword [ebp - 4], 0
cmp dword [0x424104], 0
mov ebx, eax
jne 0x40afcc
push 0x4021bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b07d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4021b0
push edi
call esi
test eax, eax
je 0x40b07d
push eax
call fcn.00406af4
mov dword [esp], 0x4021a0
push edi
mov dword [0x424104], eax
call esi
push eax
call fcn.00406af4
mov dword [esp], 0x40218c
push edi
mov dword [0x424108], eax
call esi
push eax
call fcn.00406af4
mov dword [esp], 0x402170
push edi
mov dword [0x42410c], eax
call esi
push eax
call fcn.00406af4
pop ecx
mov dword [0x424114], eax
test eax, eax
je 0x40afcc
push 0x402158
push edi
call esi
push eax
call fcn.00406af4
pop ecx
mov dword [0x424110], eax
mov eax, dword [0x424110]
cmp eax, ebx
je 0x40b024
cmp dword [0x424114], ebx
je 0x40b024
push eax
call fcn.00406b6f
push dword [0x424114]
mov esi, eax
call fcn.00406b6f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b024
test edi, edi
je 0x40b024
call esi
test eax, eax
je 0x40b01b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b01b
test byte [ebp - 0xc], 1
jne 0x40b024
or dword [ebp + 0x10], 0x200000
jmp 0x40b05d
mov eax, dword [0x424108]
cmp eax, ebx
je 0x40b05d
push eax
call fcn.00406b6f
pop ecx
test eax, eax
je 0x40b05d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b05d
mov eax, dword [0x42410c]
cmp eax, ebx
je 0x40b05d
push eax
call fcn.00406b6f
pop ecx
test eax, eax
je 0x40b05d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x424104]
call fcn.00406b6f
pop ecx
test eax, eax
je 0x40b07d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b07f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415a2f
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
push esp
leave
cwde
sub edi, dword [edi - 0xa3f5b6f]
xchg ecx, eax
movsb byte es:[edi], byte [esi]
sal ch, 0x20
mov dword [esi + 0x5c4ecfb], esp
test dword [ecx], ecx
sub dword [ecx - 0x1e], ebp
jbe 0x415a23
and byte [ecx - 0x3b13045a], cl
add eax, 0x69290985
loop 0x415a7d
sbb edx, dword [edi + 0x6737eae5]
sti
xchg edi, eax
in eax, 0xea
aaa
sti
or ebx, dword [ebx]
mov bl, 0xcf
sbb byte [ecx], cl
loope 0x415a71
xchg esi, eax
cli
cmp edi, dword [ebp + 0x54]
push cs
shr ebp, 0xb0
or dword [eax + ecx*2], eax
push edi
sub ch, byte [edx - 0x65]
or eax, 0x459197fe
dec ecx
and al, 9
xchg edx, eax
jg 0x415a69
loopne 0x4159fa
outsb dx, byte cs:[esi]
jge 0x4159f6
push ds
test eax, esi
jne 0x4159f0
push edx
xor dword [ebx + 0x704dbf30], eax
and eax, 0x4873742a
push 1
sar byte [edx + edi + 0x29], 0x91
pop ss
lds edi, [edx + 5]
fcmovbe st(0), st(4)
or dword [edx + eax], edi
in eax, 0xeb
lds edi, [esi - 0x19]
mov word [esi + ecx*2 - 0x57b0464f], fs
jb 0x415ae5
mov eax, 0x9c9da89
salc
leave
or esi, edx
and eax, 0xc5b8f443
xchg edi, eax
fsub st(4)
cld
ljmp 0xc1a
mov al, byte [0x8d8b3aff]
retf
sub byte [eax + esi*8 + 0x3a], dh
or dword [ecx], edx
stc
in al, 3
adc ebx, ecx
das
or dword [esi - 0x28], edi
cmp byte [ecx + 0x60], cl
rol dword [ebp + 0x7559bb95], cl
outsd dx, dword [esi]
pop ebx
invalid
Function at 0x44a6a1
Capabilities:
Accept command line arguments

Disassembly:
lcall 0x5545, 0xbe9a658b
mov ebp, esp
push ecx
push ecx
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
movzx ecx, word [edi]
movzx edx, cx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
cmp ax, cx
jne 0x44a6c5
mov eax, dword [ebp + 8]
jmp 0x44a8fc
cmp dword [0x41cc70], 1
push esi
jle 0x44a7c4
mov eax, edi
and eax, 0xfff
push 2
pop esi
cmp eax, 0xff0
ja 0x44a6e9
movups xmm0, xmmword [edi]
jmp 0x44a717
movaps xmm0, xmmword [0x414310]
push 8
movzx edx, cx
pop ecx
movzx eax, dx
psrldq xmm0, 2
pinsrw xmm0, eax, 7
xor eax, eax
cmp ax, dx
je 0x44a70f
add edi, esi
movzx edx, word [edi]
sub ecx, 1
jne 0x44a6f6
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov eax, edx
and eax, 0xfff
cmp eax, 0xff0
ja 0x44a787
pcmpistri xmm0, xmmword [edx], 0xd
jbe 0x44a738
add edx, 0x10
mov ecx, dword [ebp - 8]
jmp 0x44a71a
jae 0x44a8f9
pcmpistri xmm0, xmmword [edx], 0xd
lea edx, [edx + ecx*2]
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov eax, edi
mov dword [ebp - 4], ecx
and eax, 0xfff
cmp eax, 0xff0
ja 0x44a7a1
mov eax, ecx
and eax, 0xfff
cmp eax, 0xff0
ja 0x44a7a1
movups xmm1, xmmword [ecx]
pcmpistri xmm1, xmmword [edi], 0xd
jno 0x44a7bd
js 0x44a8ff
mov ecx, dword [ebp - 4]
add edi, 0x10
add ecx, 0x10
jmp 0x44a74c
movzx eax, word [edx]
xor edi, edi
cmp di, ax
je 0x44a8f9
cmp ax, cx
je 0x44a747
add edx, esi
jmp 0x44a71a
movzx eax, word [ecx]
and dword [ebp - 4], 0
cmp word [ebp - 4], ax
je 0x44a8ff
cmp word [edi], ax
jne 0x44a7bd
add edi, esi
add ecx, esi
jmp 0x44a74c
add edx, esi
jmp 0x44a733
jne 0x44a8ad
movaps xmm3, xmmword [0x414310]
movzx eax, cx
mov ecx, dword [ebp + 8]
push 2
pop esi
movd xmm0, eax
pshuflw xmm0, xmm0, 0
pshufd xmm4, xmm0, 0
mov eax, ecx
and eax, 0xfff
cmp eax, 0xff0
ja 0x44a81d
movups xmm1, xmmword [ecx]
movaps xmm0, xmm3
pcmpeqw xmm0, xmm1
int3
add byte gs:[edx], ch
shld dword [eax], eax, cl
mov eax, dword [0x850f78]
test dword [eax], eax
cmp eax, edi
je 0x44a90e
push eax
call esi
mov dword [0x850f78], edi
mov eax, dword [0xa50f80]
cmp eax, edi
je 0x44a920
push eax
call esi
mov dword [0xa50f80], edi
mov eax, dword [0xa50f7c]
cmp eax, edi
je 0x44a932
push eax
call esi
mov dword [0xa50f7c], edi
pop edi
mov al, 1
pop esi
ret
Function at 0x49ba38
Capabilities:
Encode data using xor

Disassembly:
pop ebp
test al, 0x8f
inc esi
call [ebp - 0x8cbcb23]
dec edx
cmp bl, byte [edx]
xor al, 0xe2
jbe 0x49ba60
xchg ecx, eax
leave
jle 0x49bac8
wait
xor byte [ebx - 0x1e], dl
cmp al, 0x5f
jne 0x49baa2
adc bh, 0x52
test cl, bl
invalid
dec ecx
push 0xffffffffffffffae
jg 0x49ba87
jmp 0xd8597e0b
lcall 0x509, 0x830d81bf
adc dword [edi + 0x44], ebp
lea ebx, [ebx + 0x7f797aec]
out dx, eax
jp 0x49bb02
jg 0x49ba7a
mov dh, 0x4d
mov eax, dword [0x9cd4c720]
add byte [edi - 0x7585487f], 0x21
mov cl, 0x25
dec edx
sbb al, 0x37
xor dword [edi - 0x4ede7586], 0x371c4a25
fldcw word [edi]
popal
dec edi
cwde
mov al, 0xb5
jp 0x49bb03
add edi, ecx
pushfd
movsb byte es:[edi], byte [esi]
cwde
invalid
mov es, word [esi + edx*4]
or al, 0x6f
loop 0x49bb30
mov ss, word [esp + eax*4 - 0x11]
jbe 0x49bb0f
inc ebp
imul esi, dword [edx], 0xffffffb8
aas
and esp, edi
pop ebx
mov ch, 0x30
dec ebx
mov esp, 0xd7ef7453
jle 0x49bb12
or ebx, dword [edx]
cmc
xchg esp, eax
int1
and al, 0xc2
stosb byte es:[edi], al
xchg dword [eax - 0x4b608afa], esp
insb byte es:[edi], dx
push es
jne 0x49ba95
mov ah, 0x6c
loopne 0x49baf3
sbb eax, 0xe6fdab5e
xor dword [esi - 0xc337cb], 0x52
enter 0xffffffffffffff3c, 0x52
cmp al, 0xff
push edx
cwde
inc ebx
invalid
xchg ebx, eax
xor al, 4
sbb esi, dword [esp + ecx]
add al, 0x1b
xor al, 0xc
or al, 0x95
xchg ebp, eax
mov edi, 0x8fbbae11
pop es
sub dh, byte [edi - 0x7c]
outsb dx, byte [esi]
and dword [eax + 0x17], eax
mov al, byte [0x8f9f7f0]
inc ebp
cmp al, 0x25
mov edx, 0x414abdf2
xlatb
loope 0x49bb0d
fsubr st(6), st(0)
dec edx
out 0x4a, al
cmp eax, 0x92dd1b9c
pop edi
and esi, dword [esi + 0x64c18f79]
push esp
xchg edx, eax
invalid

Function at 0x5ce0c2
Capabilities:
Encode data using xor

Disassembly:
cmp dword [edx], ebp
push edx
rcr word [ecx], cl
sub eax, edx
xchg ecx, eax
out dx, al
sub eax, 0xe576e698
mov word [edi - 0x131dc8ad], es
fdivr qword [edi + 0x22]
wait
cmp edi, dword [edi - 0x9371494]
mov ebx, 0x75202690
fnstenv [edi - 0x5a18ae9d]
jne 0x5ce16a
sbb dword es:[edx + ebx*8], esi
add byte [edx - 0x19], 0x47
mov ebx, 0xd37462c
bswap esi
into
dec ebp

Function at 0x5fa90f
Capabilities:
Encode data using xor

Disassembly:
mov byte [0x4b2b96df], al
inc esp
jg 0x5fa95a
outsb dx, byte [esi]
rcl dword [0x3b0fa7ab], cl
pop ds
out 0xef, al
inc esi
mov dh, 0
inc ebx
and dword ss:[esi], 0xffffffa8
sub bh, byte [ebp + 0x16]
add dword [ebx + 0x53], 0x66
outsd dx, dword [esi]
xchg esi, eax
jl 0x5fa94a
add edi, dword [edx - 0x29e919bd]
bnd retf 0xfa03
fbld tbyte [esi]
and edx, dword [esi - 0x41]
inc esi
invalid
mov edi, 0x564e8f46
dec edx
stosd dword es:[edi], eax
xchg byte [esi], ah
mov byte [ebx - 0x46], 2
outsb dx, byte [esi]
sti
xor dword [ebx + 0x14], 0xffffffcb
cli
ja 0x5fa946
jae 0x5fa970
retf
mov bl, 0x16
inc eax
iretd
lodsd eax, dword [esi]
adc edi, dword [edi + 0x5fb64f0b]
insb byte es:[edi], dx
aaa
mov byte [0xf653c633], al
cmp eax, 0xb30a2f8e
dec ebx
ret
Function at 0x437a30
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ac3eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0049cbb3
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x437ab2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049a110
mov eax, dword [eax]
push 0x4d1ce4
push eax
call fcn.0048cb84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0049ce3e
test bl, bl
je 0x437ab2
push 0x4d1ce4
lea ecx, [esp + 0xc]
call fcn.0049d21a
push 0x4d1cf0
lea ecx, [esp + 0xc]
call fcn.0049d21a
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x437aee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0049ce3e
jmp 0x437bb9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x437b72
lea edx, [esp + 0x7c]
push 0x4d1cec
push edx
call fcn.0048cb84
add esp, 8
test eax, eax
je 0x437b72
lea eax, [esp + 0x7c]
push 0x4d1ce8
push eax
call fcn.0048cb84
add esp, 8
test eax, eax
je 0x437b72
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x437b02
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0049ce3e
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x438e20
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x438e82
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x438e90
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ac54b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4d89f4]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x438fc8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x438ef6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0049ce3e
xor eax, eax
jmp 0x43903f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0049cfc7
push esi
lea ecx, [esp + 0xc]
call fcn.0049d256
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x4d1d24
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x43901d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00438e20
test eax, eax
jne 0x43901d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00438e20
test eax, eax
jne 0x43901d
lea eax, [esp + 0x14]
push 0x4d1d00
push eax
call fcn.0048dd30
mov esi, eax
add esp, 8
test esi, esi
jne 0x438ffc
lea ecx, [esp + 0x14]
push 0x4d1cfc
push ecx
call fcn.0048dcb0
mov esi, eax
add esp, 8
test esi, esi
jne 0x438ffc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x438fff
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0049cf77
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x438f0e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0049ce3e
xor eax, eax
jmp 0x43903f
mov byte [esi], 0
push 0x4d1cf8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0049ce3e
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x449d10
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x449d7e
cmp si, 0x69
ja 0x449d7e
add esi, 0xffd0
cmp si, 0x11
je 0x449d4e
push 0x11
call edi
test ax, ax
jge 0x449d4e
or esi, 0x2000
cmp si, 0x10
je 0x449d63
push 0x10
call edi
test ax, ax
jge 0x449d63
or esi, 0x4000
cmp si, 0x12
je 0x449d78
push 0x12
call edi
test ax, ax
jge 0x449d78
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x449d8b
mov esi, 0xbd
jmp 0x449d3f
cmp si, 0x6e
jne 0x449d98
mov esi, 0xbe
jmp 0x449d3f
cmp si, 0x6f
jne 0x449d39
mov esi, 0xbf
jmp 0x449d3f

Function at 0x44b610
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4e98f0]
xor edx, edx
cmp eax, edx
jne 0x44b636
xor eax, eax
mov byte [eax + 0x4e97f0], al
inc eax
cmp eax, 0x100
jl 0x44b61e
mov dword [0x4e98f0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4e97f0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x44b6c7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x44b69a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x44b668
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x44b740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x44b793
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x44b77a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret