joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408280
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [edi + 0x10]
sub esp, 0x20
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x408297
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
push esi
neg ecx
or ecx, eax
push ecx
call fcn.0040b16c
add esp, 4
cmp dword [edi + 0x14], 8
mov esi, eax
jb 0x4082c0
mov eax, dword [edi]
jmp 0x4082c2
mov eax, edi
push eax
mov eax, dword [edi + 0x10]
add eax, 2
push eax
push esi
call fcn.0040be12
mov ecx, dword [edi + 0x10]
mov dword [esi + ecx*2], ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov word [ebp - 4], ax
mov dword [ebp - 0xc], eax
add esp, 0xc
lea eax, [ebp - 0x20]
mov edx, 0x414
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x10], dx
mov dword [ebp - 6], ebx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
push esi
sete bl
call fcn.0040bb97
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408330
Capabilities:
Create directory
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ae6b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x422084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
xor edi, edi
mov word [ebp - 0x234], ax
push edi
mov eax, 0x41e888
lea esi, [ebp - 0x234]
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
call fcn.00406ce0
push 1
push 0x1a
lea ecx, [ebp - 0x218]
push ecx
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
js 0x408433
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4083b5
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
lea esi, [ebp - 0x234]
call fcn.00406ce0
push 0xe
mov eax, 0x41eaac
mov ecx, esi
call fcn.00406390
cmp dword [eax + 0x14], 8
jb 0x4083ec
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408405
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x408433
mov dword [ebx + 0x10], edi
xor edx, edx
mov dword [ebx + 0x14], 7
lea edi, [ebp - 0x234]
mov esi, ebx
mov word [ebx], dx
call fcn.00406320
cmp dword [ebp - 0x220], 8
jb 0x408467
mov eax, dword [ebp - 0x234]
push eax
jmp 0x40845f
xor ecx, ecx
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], edi
push edi
mov eax, 0x41e888
mov esi, ebx
mov word [ebx], cx
call fcn.00406ce0
cmp dword [ebp - 0x220], 8
jb 0x408467
mov edx, dword [ebp - 0x234]
push edx
call fcn.0040b23d
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040b177
mov esp, ebp
pop ebp
ret
Function at 0x408fe0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
je 0x409088
mov eax, dword [edi + 8]
test eax, eax
je 0x409005
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [edi + 8], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x40901a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
push esi
lea esi, [ebp - 0x14]
mov dword [edi + 0xc], 0
call fcn.00406e10
mov ecx, dword [ebp + 8]
push ecx
push 0x5834
push 0
push 4
add eax, 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi + 4], eax
mov eax, dword [ebp - 4]
pop esi
test eax, eax
je 0x40905e
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi + 4]
test eax, eax
je 0x409088
push 0x5834
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 8], eax
test eax, eax
jne 0x409090
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret 4
mov eax, 1
mov dword [edi + 0xc], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40b177
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422084]
jne 0x40b181
repz ret
jmp fcn.0040c45a

Function at 0x4122f8
Capabilities:
Encode data using xor

Disassembly:
daa
cmp edi, esp
add eax, 0x66a145e9
outsd dx, dword [esi]
aaa
frstor dword [ebp + 0x6a]
invalid

Function at 0x416000
Capabilities:
Encode data using xor

Disassembly:
popfd
xchg ebp, eax
scasd eax, dword es:[edi]
mov dword [0x7abc20f2], eax
popal
pop ebp
retf
mov ah, 0xa6
mov edi, 0xd8443895
adc eax, 0xbf03b980
movsb byte es:[edi], byte [esi]
fucomi st(2)
insd dword es:[edi], dx
xor eax, 0x3efe127a
cmp dword [eax - 0xf], esp
sbb byte [esi - 0x2460a911], dh
xor dword [edi + esi*8 + 0x31], ecx
mov ch, 0x22
inc esi
sub ebx, ebp
dec ebp
cmp eax, 0xa2f395be
mov dl, 0xe2
test eax, 0x3e5c02ac
loop 0x415fda
xchg esi, eax
xor al, byte [eax]
loopne 0x415f15
cli
je 0x415f15
pop ds
pop eax
int3
xor eax, 0xe194dbdb
inc ebx
mov esi, gs
invalid
jnp 0x415ffb
aaa
or byte [ecx + 0x59], cl
aam 0x6c
cld
retf
wait
inc esi
adc byte [eax + 0x6e], bl
outsb dx, byte [esi]
jl 0x415fc2
leave
dec byte ss:[0x4af0901e]
push es
sbb edx, dword [ebp + 0x366448ca]
xchg dword [ebp - 7], esi
lcall 0x15f8, 0x90f05cde
inc eax
mov al, 0xfe
pushal
jno 0x41600b
invalid
push 0x41
js 0x41604b
test dword [ecx - 0x3c], esi
push edi
hlt
push ss
mov ah, 0xcb
stosd dword es:[edi], eax
mov esi, ebx
adc dword [edi], esp
adc eax, 0x8a3b84db
lodsb al, byte [esi]
sub esi, dword [esi]
push eax
sub eax, 0x81986fcb
mov byte [0x33c2c7f9], al
mov ebp, 0xdbb61706
ja 0x415fb5
xchg esp, edi
cld
pop ebp
clc
jecxz 0x416053
push ecx
sbb al, byte [ebp - 0x20]
adc dl, bl
cwde
popfd
lahf
cmp eax, 0x38df4a23
jns 0x415fc3
push 0xffffffffffffffbf
mov dl, 0xdf
jno 0x4160bb
sub al, al
mov eax, dword [0xc3e974e6]
add ecx, dword [esi + esi*8 - 0x6e2fc7f4]
xchg edi, eax
jno 0x416065
or al, 0x38
rcl byte [ecx + 0x420b7197]
inc edx
jle 0x41602d
mov al, 0x20
out 0xb9, al
cmc
or al, 0xf6
pop eax
aam 0x8a
xor edx, 0xffffffc0
outsb dx, byte [esi]
je 0x41603a
fcom qword [esi + 0x51184a2]
mov ecx, 0xfff49eb6
invalid
jmp 0x6e5fa1ed
Function at 0x6d40f260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x6d40f26f
pop dword [ebp - 0x50]
mov eax, 0x7da2aab0
add eax, 0xef9e47bf
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x59bb4bcc
sub dword [ebp - 0x60], 0xb690681
mov dword [ebp - 0x5c], 0x4bdd587e
add dword [ebp - 0x5c], 0xe655f3c7
mov dword [ebp - 0x58], 0xc734362
add dword [ebp - 0x58], 0x3fd900cc
mov dword [ebp - 0x54], 0x9362e8fc
sub dword [ebp - 0x54], 0x9362e8fc
lea eax, [ebp - 0x60]
push eax
mov eax, 0x572ae264
add eax, 0x1616ade8
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xb7b4b75d
add dword [ebp - 0x60], 0xbcbdb1f9
mov dword [ebp - 0x5c], 0xb853c549
sub dword [ebp - 0x5c], 0x76e763d4
mov dword [ebp - 0x58], 0x1d7c0d93
sub dword [ebp - 0x58], 0xba0ca127
mov dword [ebp - 0x54], 0xef4c3ac6
sub dword [ebp - 0x54], 0xef4c3ac6
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x33729
push 0
call eax
mov ecx, 0xfba971cb
sub ecx, 0xfba935ed
mov ebx, eax
mov esi, 0x6aab119e
add esi, 0x2970862
add esi, dword [ebp - 0x50]
mov edi, 0xcb662ef9
sub edi, 0xb654ab35
xor dword [ebp - 0x3c], edi
mov edx, dword [esi]
mov dword [ebp - 0x28], 0x17e92bc5
sub edx, edi
add dword [ebp - 0x10], 0xabd83012
mov dword [ebx], edx
add ebx, 0xa85e468d
add ebx, 0x57a1b977
add esi, 0xaa37efd7
sub esi, 0xaa37efd3
loop 0x6d40f38c
add eax, 0xf504d05
add eax, 0xf0b09546
xor ebx, ebx
add ebx, eax
add eax, 0x40a2bf6f
sub eax, 0x40a2bf6a
mov ecx, 0x25870e63
sub ecx, 0xb8470e63
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x6d417400
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [0x6d41e7f8]
mov eax, dword [eax]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x22c]
call eax
test eax, eax
je 0x6d417450
push 0x502
push str..._.._.._src_share_demo_jvmti_hprof_hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.6d405ce0
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.6d405ca0
ret

Function at 0x6d417460
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x6d41e7f8]
mov eax, dword [eax]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x6d4174a3
push 0x50f
push str..._.._.._src_share_demo_jvmti_hprof_hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.6d405ce0
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.6d405ca0
ret

Function at 0x6d417d33
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d41e108]
jne 0x6d417d3d
repz ret
jmp fcn.6d4181c2

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x58630bec
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x37190a18
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x425070
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42509d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42509d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x50c620
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
jmp 0x50c63a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50c641
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50c630
mov eax, 1
add ebx, ebx
jne 0x50c653
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50c648
jne 0x50c664
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50c648
xor ecx, ecx
sub eax, 3
jb 0x50c678
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50c6ea
mov ebp, eax
add ebx, ebx
jne 0x50c683
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50c690
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50c6b4
inc ecx
add ebx, ebx
jne 0x50c6a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50c695
jne 0x50c6b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50c695
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50c6d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50c6c5
jmp 0x50c636
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50c6d4
add edi, ecx
jmp 0x50c636
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x50c733
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeacc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50c6f1
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb2c]
or eax, eax
je 0x50c72d
mov dword [ebx], eax
add ebx, 4
jmp 0x50c70e
call dword [esi + 0xeb28]
mov ebp, dword [esi + 0xeb30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50c767
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4031a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4031b0
pop dword [ebp - 0x3c]
mov eax, 0x4031b0
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xb4114747
sub dword [ebp - 0x4c], 0x65bf01fc
mov dword [ebp - 0x48], 0xf47e7fdb
sub dword [ebp - 0x48], 0xc24b3396
mov dword [ebp - 0x44], 0x97bfc400
sub dword [ebp - 0x44], 0x4b737fd2
mov dword [ebp - 0x40], 0x9b76ceb2
add dword [ebp - 0x40], 0x6489314e
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x7771fabf
add eax, 0x88ce45ad
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x1ccf09b8
add dword [ebp - 0x4c], 0x57a35f9e
mov dword [ebp - 0x48], 0x1b6d1708
sub dword [ebp - 0x48], 0xda00b593
mov dword [ebp - 0x44], 0xbca73991
sub dword [ebp - 0x44], 0x5937cd25
mov dword [ebp - 0x40], 0x3d9cb1a0
sub dword [ebp - 0x40], 0x3d9cb1a0
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x84bb47e9
sub eax, 0x847b0765
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x35658
push 0
call eax
mov ecx, 0x864baa3d
sub ecx, 0x864b6726
mov esi, eax
mov edi, 0x4b74ac96
add edi, 0xb4cc5b6a
add edi, dword [ebp - 0x3c]
mov ebx, 0xb8c410fb
sub ebx, 0xa57d7dcc
xor dword [ebp - 0x34], 0x482848f
mov edx, dword [edi]
sub dword [ebp - 8], ebx
xor edx, ebx
mov dword [esi], edx
add esi, 4
add edi, 0x215c8e5
add edi, 0xfdea371f
loop 0x4032cd
add eax, 0x37548bbf
sub eax, 0x37538c90
xor ebx, ebx
add ebx, eax
add eax, 0xdc632cdf
sub eax, 0xdc632cda
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x40ea70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x487dcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047c9f1
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40eaf2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047a30d
mov eax, dword [eax]
push 0x4aac54
push eax
call fcn.0046cf74
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047cc7c
test bl, bl
je 0x40eaf2
push 0x4aac54
lea ecx, [esp + 0xc]
call fcn.0047d00c
push 0x4aac60
lea ecx, [esp + 0xc]
call fcn.0047d00c
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40eb2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047cc7c
jmp 0x40ebf9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40ebb2
lea edx, [esp + 0x7c]
push 0x4aac5c
push edx
call fcn.0046cf74
add esp, 8
test eax, eax
je 0x40ebb2
lea eax, [esp + 0x7c]
push 0x4aac58
push eax
call fcn.0046cf74
add esp, 8
test eax, eax
je 0x40ebb2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40eb42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047cc7c
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40f400
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40f462
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40f470
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x487e4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4b44c8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40f5a8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40f4d6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047cc7c
xor eax, eax
jmp 0x40f61f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0047cdb9
push esi
lea ecx, [esp + 0xc]
call fcn.0047d048
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40f5fd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.0040f400
test eax, eax
jne 0x40f5fd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.0040f400
test eax, eax
jne 0x40f5fd
lea eax, [esp + 0x14]
push 0x4aac70
push eax
call fcn.0046dff0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40f5dc
lea ecx, [esp + 0x14]
push 0x4aac6c
push ecx
call fcn.0046df70
mov esi, eax
add esp, 8
test esi, esi
jne 0x40f5dc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40f5df
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047cd69
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40f4ee
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047cc7c
xor eax, eax
jmp 0x40f61f
mov byte [esi], 0
push 0x4aac68
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047cc7c
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x4208d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x42093e
cmp si, 0x69
ja 0x42093e
add esi, 0xffd0
cmp si, 0x11
je 0x42090e
push 0x11
call edi
test ax, ax
jge 0x42090e
or esi, 0x2000
cmp si, 0x10
je 0x420923
push 0x10
call edi
test ax, ax
jge 0x420923
or esi, 0x4000
cmp si, 0x12
je 0x420938
push 0x12
call edi
test ax, ax
jge 0x420938
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x42094b
mov esi, 0xbd
jmp 0x4208ff
cmp si, 0x6e
jne 0x420958
mov esi, 0xbe
jmp 0x4208ff
cmp si, 0x6f
jne 0x4208f9
mov esi, 0xbf
jmp 0x4208ff

Function at 0x422150
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4c4cf0]
xor edx, edx
cmp eax, edx
jne 0x422176
xor eax, eax
mov byte [eax + 0x4c4bf0], al
inc eax
cmp eax, 0x100
jl 0x42215e
mov dword [0x4c4cf0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4c4bf0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x422207
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4221da
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4221a8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x422280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4222d3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4222ba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret