joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412c80
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareBaiduHao123hao123desk
push 0x80000001
mov dword [esp + 0x24], 0
call dword [0x427018]
test eax, eax
jne 0x412cdc
push esi
mov esi, dword [esp + 4]
push str.IEHomePage
push esi
call dword [0x427014]
test esi, esi
je 0x412cd2
push esi
call dword [0x427008]
mov eax, 1
pop esi
add esp, 8
ret
mov eax, 1
add esp, 8
ret

Function at 0x412cf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
lea eax, [esp + 0xc]
push eax
xor edi, edi
lea ecx, [esp + 8]
push ecx
push edi
push 0x2001f
push edi
push edi
push edi
push str.SoftwareBaiduHao123hao123desk
push 0x80000001
mov dword [esp + 0x28], edi
call dword [0x427018]
test eax, eax
jne 0x412d74
push esi
mov esi, dword [esp + 8]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edi
push str.InstallValue
push esi
mov dword [esp + 0x28], 4
call dword [0x427010]
test eax, eax
jne 0x412d68
cmp dword [esp + 8], 4
jne 0x412d68
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov dword [edx], eax
mov edi, 1
test esi, esi
je 0x412d73
push esi
call dword [0x427008]
pop esi
mov eax, edi
pop edi
add esp, 0xc
ret

Function at 0x412d80
Capabilities:
Delete registry value
Get geographical location

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareBaiduHao123hao123desk
push 0x80000001
mov dword [esp + 0x24], 0
call dword [0x427018]
test eax, eax
jne 0x412ddc
push esi
mov esi, dword [esp + 4]
push str.CountryType
push esi
call dword [0x427014]
test esi, esi
je 0x412dd2
push esi
call dword [0x427008]
mov eax, 1
pop esi
add esp, 8
ret
mov eax, 1
add esp, 8
ret

Function at 0x412df0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
lea eax, [esp + 0xc]
push eax
xor edi, edi
lea ecx, [esp + 8]
push ecx
push edi
push 0x2001f
push edi
push edi
push edi
push str.SoftwareBaiduHao123hao123desk
push 0x80000001
mov dword [esp + 0x28], edi
call dword [0x427018]
test eax, eax
jne 0x412e74
push esi
mov esi, dword [esp + 8]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edi
push str.LaunchCount
push esi
mov dword [esp + 0x28], 4
call dword [0x427010]
test eax, eax
jne 0x412e68
cmp dword [esp + 8], 4
jne 0x412e68
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov dword [edx], eax
mov edi, 1
test esi, esi
je 0x412e73
push esi
call dword [0x427008]
pop esi
mov eax, edi
pop edi
add esp, 0xc
ret
Function at 0x412e80
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareBaiduHao123hao123desk
push 0x80000001
mov dword [esp + 0x24], 0
call dword [0x427018]
test eax, eax
jne 0x412eef
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push str.LaunchCount
push esi
mov dword [esp + 0x20], edx
call dword [0x427004]
test esi, esi
je 0x412ee5
push esi
call dword [0x427008]
mov eax, 1
pop esi
add esp, 8
ret
mov eax, 1
add esp, 8
ret

Function at 0x412f40
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareBaiduHao123hao123desk
push 0x80000001
mov dword [esp + 0x24], 0
call dword [0x427018]
test eax, eax
jne 0x412f9c
push esi
mov esi, dword [esp + 4]
push str.LaunchCount
push esi
call dword [0x427014]
test esi, esi
je 0x412f92
push esi
call dword [0x427008]
mov eax, 1
pop esi
add esp, 8
ret
mov eax, 1
add esp, 8
ret

Function at 0x412fb0
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareBaiduHao123hao123desk
push 0x80000001
mov dword [esp + 0x24], 0
call dword [0x427018]
test eax, eax
jne 0x41300c
push esi
mov esi, dword [esp + 4]
push str.InstallValue
push esi
call dword [0x427014]
test esi, esi
je 0x413002
push esi
call dword [0x427008]
mov eax, 1
pop esi
add esp, 8
ret
mov eax, 1
add esp, 8
ret

Function at 0x415740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x425e48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00415370
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00415030
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4157d2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x417840
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429ea0
push 0x418f50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push ecx
call dword [0x427138]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x4178d7
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x4178d7
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x4178d7
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x4178d7
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417c70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429eb0
push 0x418f50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [0x427138]
test eax, eax
je 0x417cf7
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x5a4d
jne 0x417cf0
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ecx], 0x4550
jne 0x417cf0
cmp word [ecx + 0x14], 0
je 0x417cf0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41aa96
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x41aac4
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x41aacb
cmp ebx, dword [eax + 4]
jae 0x41aacb
xor eax, eax
jmp 0x41acbb
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x41aadc
xor eax, eax
inc eax
jmp 0x41acba
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x41aaf2
cmp ecx, edx
jae 0x41ac37
cmp dword [eax + 4], 0
je 0x41aafb
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x41aae3
cmp dword [ebp + 8], 0
je 0x41ab1d
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x41ac37
cmp eax, esi
jae 0x41ac37
mov eax, dword [0x431f28]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x41ab42
cmp dword [esi*4 + 0x431f30], edi
je 0x41ac3b
inc esi
cmp esi, eax
jl 0x41ab30
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x427138]
test eax, eax
je 0x41acb7
cmp dword [ebp - 8], 0x1000000
jne 0x41acb7
test byte [ebp - 0xc], 0xcc
je 0x41abc0
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x41acb7
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x41acb7
cmp word [eax + 0x18], 0x10b
jne 0x41acb7
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x41acb7
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x41abc0
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x41abc0
test byte [ecx + 0x27], 0x80
jne 0x41ac37
push 1
push 0x431f70
call dword [0x427220]
test eax, eax
jne 0x41aad4
mov ecx, dword [0x431f28]
test ecx, ecx
mov edx, ecx
jle 0x41abf4
lea eax, [ecx*4 + 0x431f2c]
cmp dword [eax], edi
je 0x41abf4
dec edx
sub eax, 4
test edx, edx
jg 0x41abe8
test edx, edx
jne 0x41ac25
push 0xf
pop ebx
cmp ecx, ebx
jg 0x41ac01
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x41ac19
lea eax, [edx*4 + 0x431f30]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x41ac07
cmp ecx, 0x10
jge 0x41ac25
inc ecx
mov dword [0x431f28], ecx
push 0
push 0x431f70
call dword [0x427220]
jmp 0x41aad4
xor eax, eax
jmp 0x41acba
test esi, esi
jle 0x41aad4
mov ebx, dword [0x427220]
push 1
push 0x431f70
call ebx
test eax, eax
jne 0x41aad4
cmp dword [esi*4 + 0x431f30], edi
je 0x41ac91
mov eax, dword [0x431f28]
lea esi, [eax - 1]
test esi, esi
jl 0x41ac7f
cmp dword [esi*4 + 0x431f30], edi
je 0x41ac7b
dec esi
jns 0x41ac6f
test esi, esi
jge 0x41ac8f
cmp eax, 0x10
jge 0x41ac8a
inc eax
mov dword [0x431f28], eax
lea esi, [eax - 1]
jmp 0x41ac91
je 0x41aca9
xor ecx, ecx
test esi, esi
jl 0x41aca9
lea eax, [ecx*4 + 0x431f30]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x41ac97
push 0
push 0x431f70
call ebx
jmp 0x41aad4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x648566
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
lea edi, [edi*4]
setp dh
jmp 0x6485b9
mov edi, 0xacc51ea8
xchg ah, dh
mov di, word [esp + 3]
mov dh, byte [esp + 1]
mov dword [esp + 6], ebp
jmp 0x648618
pop word [esp + 8]
rol dh, 3
lea esp, [esp + 2]
mov eax, ebp
xchg ah, dh
xchg di, dx
jmp 0x64859e
lea edi, [ebp + 0x8f]
xchg dh, al
xchg edx, eax
neg edi
pop dword [esp + 0x1b]
push esp
jmp 0x64866e
lea edi, [ecx*4]
lea eax, [ebp*4]
rdtsc
jmp 0x648645
mov byte [esp + 0x11], bh
btr eax, edi
mov dh, byte [esp + 1]
mov byte [esp + 0xb], ah
xchg di, ax
xchg byte [esp + 0xa], dh
jmp 0x6485ce
bsr di, cx
mov byte [esp + 9], bh
mov word [esp + 7], sp
sub esp, 0x18
jmp 0x6485fa
push word [esp + 0xd]
mov edi, dword [esp + 0xf]
push word [esp + 3]
lea edx, [ebx*4]
pushal
lea esp, [esp + 0x48]
jmp 0x648743
xchg byte [esp + 0x1c], al
bswap edi
add esp, 1
bsr ax, bp
mov word [esp + 4], bx
mov dword [esp + 5], ecx
jmp 0x6485e4
bt edx, esp
not dx
lea edi, [ecx + 0xcb]
lea esp, [esp + 2]
jmp 0x6486a1
btr edi, edx
btc eax, edi
mov edi, dword [esp]
bsf di, ax
lea edi, [ebp - 0x5f]
bswap edi
jmp 0x6486ba
btr edi, esp
not dh
push esp
xchg byte [esp], al
rdtsc
add esp, 1
jmp 0x6486d1

Function at 0x648afc
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x41]
rdtsc
jmp 0x648ccd
xchg di, ax
xchg edi, edx
xchg dword [esp], eax
xchg byte [esp], dl
sub esp, 0x18
mov dword [esp + 0x19], ecx
jmp 0x648c0f
not dx
setae ah
sub esp, 0x10
stc
mov di, word [esp + 4]
add esp, 9
jmp 0x648b4d
lea esp, [esp]
neg dx
mov dh, 0xc2
push word [esp + 2]
push word [esp]
mov dh, byte [esp + 6]
jmp 0x648ba9
cmc
pop word [esp + 2]
pop dx
add esp, 0x10
mov al, 6
neg eax
jmp 0x648b7d
pop eax
mov byte [esp + 3], ch
bsr dx, bp
push word [esp]
not edx
setg dh
call int.00648bf8
jg 0x648c08
int1
mov byte [esp + 0xd], ah
mov byte [esp + 0xd], ah
xchg ah, dh
rdtsc
add esp, 6
xchg dh, dl
mov word [esp + 0xc], bx
jmp 0x648b98
mov ebx, 0xceca2dde
pop ecx
mov eax, 0xfc8bfb8b
mov edi, ebx
mov edi, esp
mov al, 0xc6
mov edi, dword [esp + 0xb]
mov byte [esp + 9], bh
mov edx, ebp
jmp 0x648bc5
mov edi, ecx
mov al, 0x56
dec edx
mov dx, di
cld
add di, 0xa9d8
jmp 0x648b69
xchg edi, eax
neg edi
mov dx, 0x6b89
mov dx, si
ror edi, 0x11
mov eax, dword [esp]
jmp 0x648c28

Function at 0x648ce2
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
xchg dword [esp], edi
add esp, 0
mov edi, dword [esp + 4]
xchg edi, eax
jmp 0x648d21
lea eax, [edx + ebx]
mov eax, dword [esp]
mov ax, 0xacb
mov dh, byte [esp + 4]
rdtsc
btc edi, edi
jmp 0x648d04
Function at 0x648e50
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x1b], ch
push dword [esp + 0x13]
bswap edx
pop dword [esp + 0x11]
mov eax, 0xa9fce504
jmp 0x648ef2
lea edx, [esi + 0x8d]
inc edi
rdtsc
add esp, 0x2e
mov dx, 0x5c33
rdtsc
jmp 0x648edc
mov edi, 0xf57fa2fc
push dword [esp + 0x26]
mov eax, 0x8a3e4148
push edx
mov dh, byte [esp + 0x11]
jmp 0x648e8a
xchg edi, eax
pop ax
pop ax
xor edi, esi
cmc
pop di
jmp 0x648eb2
neg edx
rcl edi, 0xf
mov di, dx
cld
add esp, 0
lea edi, [esp + eax]
jmp 0x649156
push edx
cmc
mov dword [esp + 0x1b], esi
push word [esp + 0x24]
pop ax
push dword [esp + 0xe]
jmp 0x648ed0
add byte [ecx - 0x38], dl
pop esi
cmp eax, ecx
dec edi
stc
cmc
pushfd
outsd dx, dword [esi]
ljmp 0xd68b
mov di, bx
mov edx, esi
xchg byte [esp], dl
lea esp, [esp]
lea eax, [edi*4]
call fcn.00648f3c
mov byte [esp + 1], dh
mov eax, dword [esp + 0xb]
mov word [esp + 7], di
mov dword [esp + 7], ebp
call fcn.0064906d
xchg dword [esi], ebp
cmp dword [eax], ebx
jnp 0x648f8f
sub ah, byte [edi + 0x3c8ded13]
lodsd eax, dword [esi]
add byte [eax], al
add byte [eax], al
pop dword [esp + 2]
jmp 0x648fb4
mov dh, bh
lea eax, [eax - 0xa1]
not di
lea edi, [esi - 0x9d]
not ah
rdtsc
jmp 0x648f9d

Function at 0x648f3c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, 0x72ef
pop dx
mov dh, byte [esp + 1]
setae dh
mov dh, bh
jmp 0x648f65
mov di, ax
jmp 0x648f25
pop word [esp + 0xe]
mov edx, ebp
rdtsc
mov ax, 0x682f
pop dword [esp + 0x28]
mov byte [esp + 0x1f], ch
jmp 0x648f76
setns dh
sub esp, 0x1c
mov dh, ch
sub esp, 0x1e
rdtsc
mov dh, bh
jmp 0x648f41
add esp, 0x24
xchg dword [esp + 7], edx
push esp
mov ah, byte [esp + 0x13]
mov dword [esp + 4], ecx
push word [esp + 0x13]
jmp 0x6490a4
mov edi, 0xed13a72a
lea edi, [ebp*4]
mov byte [esp + 7], dh
mov dh, byte [esp + 5]
lea esp, [esp + 0xd]
xchg byte [esp], dh
cmc
sub esp, 0x10
jmp 0x648fcf
push edx
pop eax
dec di
lea esp, [esp + 0xb]
sbb eax, ebp
neg dx
jmp 0x648fe6
Function at 0x416980
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47d74b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00471b58
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x416a02
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046f76d
mov eax, dword [eax]
push 0x56c200
push eax
call fcn.00461904
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00471de3
test bl, bl
je 0x416a02
push 0x56c200
lea ecx, [esp + 0xc]
call fcn.00472173
push 0x56fd7c
lea ecx, [esp + 0xc]
call fcn.00472173
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x416a3e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00471de3
jmp 0x416b09
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x416ac2
lea edx, [esp + 0x7c]
push 0x56fd78
push edx
call fcn.00461904
add esp, 8
test eax, eax
je 0x416ac2
lea eax, [esp + 0x7c]
push 0x56fd74
push eax
call fcn.00461904
add esp, 8
test eax, eax
je 0x416ac2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x416a52
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00471de3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x417300
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x417362
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x417370
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47d7cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x576840]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4174a8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4173d6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00471de3
xor eax, eax
jmp 0x41751f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00471f20
push esi
lea ecx, [esp + 0xc]
call fcn.004721af
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x56fdb4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4174fd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push 0x80000000
call fcn.00417300
test eax, eax
jne 0x4174fd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x80000000
mov ecx, edi
call fcn.00417300
test eax, eax
jne 0x4174fd
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.00462a10
mov esi, eax
add esp, 8
test esi, esi
jne 0x4174dc
lea ecx, [esp + 0x14]
push 0x56fd8c
push ecx
call fcn.00462990
mov esi, eax
add esp, 8
test esi, esi
jne 0x4174dc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4174df
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00471ed0
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4173ee
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00471de3
xor eax, eax
jmp 0x41751f
mov byte [esi], 0
push 0x56fd88
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00471de3
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x42b380
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x42b3ee
cmp si, 0x69
ja 0x42b3ee
add esi, 0xffd0
cmp si, 0x11
je 0x42b3be
push 0x11
call edi
test ax, ax
jge 0x42b3be
or esi, 0x2000
cmp si, 0x10
je 0x42b3d3
push 0x10
call edi
test ax, ax
jge 0x42b3d3
or esi, 0x4000
cmp si, 0x12
je 0x42b3e8
push 0x12
call edi
test ax, ax
jge 0x42b3e8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x42b3fb
mov esi, 0xbd
jmp 0x42b3af
cmp si, 0x6e
jne 0x42b408
mov esi, 0xbe
jmp 0x42b3af
cmp si, 0x6f
jne 0x42b3a9
mov esi, 0xbf
jmp 0x42b3af

Function at 0x42cbb0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x586f88]
xor edx, edx
cmp eax, edx
jne 0x42cbd6
xor eax, eax
mov byte [eax + 0x586e88], al
inc eax
cmp eax, 0x100
jl 0x42cbbe
mov dword [0x586f88], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x586e88
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x42cc67
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x42cc3a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x42cc08
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x42cce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x42cd33
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x42cd1a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret