joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49037c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4903e5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4ad0f4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4903cf
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0049036c
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48eb94]
call fcn.00491234
mov dword [0x4ad15c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4903ec
lea eax, [ebp - 8]
call fcn.00406214
ret

Function at 0x490484
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x490497
or esi, 2
test dl, dl
je 0x4904a0
or esi, 0
jmp 0x4904a3
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret
Function at 0x4910c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040494c
xor eax, eax
push ebp
push 0x491218
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x48e97c]
call fcn.00411eb0
test eax, eax
jl 0x491127
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.00490468
and eax, 0x7f
mov eax, dword [eax*4 + 0x4ad0f4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x49118a
mov eax, dword [ebx]
call fcn.00404764
test eax, eax
jle 0x49118a
mov eax, dword [ebx]
call fcn.00404764
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x49114e
mov eax, ebx
mov edx, 0x491230
call fcn.0040476c
mov eax, dword [ebx]
call fcn.00404764
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.00405314
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.0049036c
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x4911d5
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x4adab8]
call fcn.004066e0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040983c
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404500
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x40799c]
call fcn.0040b6a4
call fcn.00403e88
mov eax, dword [ebp - 8]
call fcn.00491038
mov ebx, eax
test edi, edi
je 0x4911ea
mov eax, edi
call fcn.004036bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49121f
lea eax, [ebp - 0x1c]
call fcn.004044ac
lea eax, [ebp - 0x18]
call fcn.00406214
lea eax, [ebp - 0x14]
call fcn.004044ac
lea eax, [ebp - 4]
call fcn.004044ac
ret
Function at 0x492918
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x492a82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4adea4]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x4adea4]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0045abd4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.0047cc98
xor edx, edx
push ebp
push 0x492a65
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4929d5
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00406214
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.00490a80
push eax
mov eax, dword [0x4add28]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x4929cb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403f34
jmp 0x492a6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492a11
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.0047c878
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004927a8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x4929ed
push 0
mov edx, 0x492740
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.0047c430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492a6c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.0047cce4
mov eax, dword [0x4adea4]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.0045abd4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492a89
lea eax, [ebp - 0x10]
call fcn.00406214
ret
Function at 0x498d78
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x498da6
mov eax, ebx
call fcn.00499830
cmp dword [ebx + 0x3c], 0
je 0x498d9f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x498e17
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x498e09
cmp dword [ebx + 8], 0
je 0x498dc8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x498dda
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x498e09
cmp dword [ebx + 8], 0
je 0x498dbb
cmp eax, 3
je 0x498ded
dec eax
jne 0x498dbb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x498dbb
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x498dbb
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x498e35
cmp dword [ebx + 0x10], 0xcc
je 0x498e35
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00498e40
pop ebx
ret

Function at 0x4aa07c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040494c
xor eax, eax
push ebp
push 0x4aa0d0
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040495c
push eax
push 0
mov eax, ebx
call fcn.00442ca0
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa0d7
lea eax, [ebp - 4]
call fcn.004044ac
ret
Function at 0x4f5e35
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.004f5df2
call fcn.004f5e4b
pop ss
mov word [edx], es
xchg esp, eax
push eax
sbb dword [ecx], 0xffffff89
call 0x7b330642
call 0xdc1dd8bb
xor cl, byte [ecx - 0x2017dbe4]
invalid
mov word [esp], bp
push dword [esp + 2]
jmp 0x4f5eb7
mov dword [esp + 2], esi
mov word [esp + 4], ax
mov dword [esp + 4], ebp
call fcn.004f5e81
daa
mov eax, 0xeb8492e
adc eax, 0x89669c84
pushfd
mov word [esp + 2], ax
pop dword [esp + 3]
jmp 0x4f5e08
mov dword [esp + 4], ebp
jmp 0x4f5e68
jl 0x4f5e5b
mov dword [esp + 2], esi
mov word [esp + 4], ax
jmp 0x4f5e97

Function at 0x4f5e4b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp + 2]
mov dword [esp], esp
call fcn.004f5e35

Function at 0x4f5e81
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf04e233c
jmp 0x4f5f0f
mov byte [esp + 2], al
pop word [esp]
lea esp, [esp]
lea esp, [esp + 2]
jmp 0x4f5e9d
mov dword [esp], esi
push edi
pop word [esp]
push ecx
pop word [esp]
push dword [esp + 2]
jmp 0x4f5ec4
jl 0x4f5eda
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x4f5ee2
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x4f5f25
mov dl, 2
xchg dx, bp
push sp
setbe cl
lea esp, [esp + 2]
jmp 0x4f5f4d
pushfd
jmp 0x4f4efa
lea ebp, [esp]
sub esp, 3
jmp 0x4f5f84
cpuid
lea edi, [esi*4]
btc edi, esp
lea esp, [esp + 3]
jmp 0x4f5fa7
mov esi, dword [esp + 0x2c]
mov di, 0x86bc
lea edi, [esi*4]
cpuid
mov dh, byte [esp]
jmp 0x4f5f2b
btc edi, esp
lea esp, [esp + 3]
jmp 0x4f5fa7
sub esp, 0x1e
jp 0x4f5f91
push cx
jmp fcn.004f5f93
jge 0x4f5f37
cpuid
lea edi, [esi*4]
jmp 0x4f5f63
push cx
sub esp, 0xc0
mov edi, esp
setge ah
cpuid
jmp 0x4f5f6c

Function at 0x5d4243
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [esp + edi]
mov di, 0x94e2
stc
inc edx
push bp
jmp 0x5d4288
mov esi, edx
lea esp, [esp + 2]
mov ax, word [esp + 2]
dec edx
xchg al, dh
and bx, si
jmp 0x5d426e
Function at 0x5d4a76
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1b
sete bl
mov word [esp + 0x2a], sp
jmp 0x5d4899
lea esp, [esp + 5]
mov al, byte [esp + 0x14]
lea esp, [esp + 0x26]
cpuid
cpuid
jmp 0x5d48fd
neg dl
xchg dword [esp + 0x10], edx
call fcn.005d4872
mov dword [esp + 0x1f], eax
mov dword [esp + 0x18], edi
pop word [esp + 0x1e]
mov cl, 0xe4
sbb si, 0xeac5
mov bl, dh
jmp 0x5d4881
mov si, sp
bswap ecx
pop eax
rdtsc
bswap eax
mov eax, dword [esp]
jmp 0x5d4967
bt si, bx
mov word [esp], si
shl dh, cl
xchg dword [esp], edi
or cx, 0x2411
cpuid
jmp 0x5d48e7
lea edi, [edx + 0x38]
xchg esi, eax
call 0x5d493f
pop edi
push edx
bts ecx, eax
pop word [esp + 2]
push word [esp + 4]
jmp 0x5d49a3
xchg edi, ebx
lea esi, reloc.WSOCK32.dll_gethostbyname
lea ebx, [eax - 0xf6]
lea ebx, [esi + esi]
bsr cx, si
lea edi, [ecx + 0x17]
jmp 0x5d4aaf
push word [esp + 8]
lea esi, [ebx*4]
push dword [esp + 9]
bswap ecx
mov edi, dword [esp + 0x10]
xchg ah, al
jmp 0x5d4a1d
mov byte [esp + 0xc], dh
rdtsc
mov byte [esp + 6], bl
mov edi, dword [esp + 0xf]
mov dword [esp + 7], edi
dec edx
jmp 0x5d49e6
push word [esp + 0x16]
lea esp, [esp + 0xb]
xchg dword [esp + 6], edi
cmp cx, 0x2e3d
jmp 0x5d4a5e
mov byte [esp], dh
xchg ebx, ecx
mov bp, cx
xchg dword [esp + 0xc], ebx
mov bx, 0x9bed
clc
jmp 0x5d4a08
mov word [esp + 0xb], dx
push dword [esp]
neg al
mov ebp, 0xe6571fdb
sub edx, edx
cpuid
call fcn.005d4a48
push dword [esp + 0xd]
mov eax, dword [esp + 0x1d]
mov edx, 0x974a022a
mov bh, ch
jmp 0x5d4a93
bts edi, ebp
mov bp, 0xafdb
cmc
bswap edx
rdtsc
ror ecx, cl
jmp 0x5d4ac6
pop dword [esp + 0xb]
mov ebp, ebx
pop dx
mov cx, sp
setns bl
mov dword [esp + 4], ebx
jmp 0x5d4a35
not al
mov byte [esp + 0xf], al
not dl
mov byte [esp + 0xa], al
mov byte [esp + 0xe], cl
mov cl, 0x33
jmp 0x5d4b14
pop ax
lea edx, [esi + ebp]
xchg bh, al
cld
bsr edi, esp
setl ch
jmp 0x5d4b2a
lea ecx, [ebx + 0xd3]
pushfd
mov di, 0x9b85
mov cx, bx
clc
mov word [esp + 0x13], bp
jmp 0x5d4afe
neg ah
xchg dword [esp + 4], ecx
mov dx, bx
xchg ch, dh
cld
mov word [esp + 0x10], bp
jmp 0x5d4d4a
mov byte [esp + 0x19], ah
xchg ah, dh
bswap esi
stc
mov esi, dword [esp + 0xa]
rdtsc
call fcn.005d4b64
mov bx, 0xa969
lea ebx, [edi + 0x5a]
mov dword [esp + 3], ebx
pop word [esp + 0x20]
cpuid
add esp, 0x22
jmp 0x5d4bc2
xchg cl, bl
lea esp, [esp]
sub esp, 0x13
call fcn.005d4c1b
add dword [eax], reloc.WSOCK32.dll_gethostbyname
int1
add dh, ah
aas
mov ebp, 0x24c7342d
jle 0x74f3c6fd
lahf
out 0x11, al
mov ax, 0xe7b2
mov word [esp + 0x11], bx
shl bx, cl
clc
mov bx, cx
xchg dl, bl
jmp 0x5d4b7a
push word [esp + 2]
mov dword [esp + 0x14], ebx
cmc
mov bp, ax
mov edx, dword [esp + 0x11]
xchg dword [esp + 0x12], ebp
jmp 0x5d4be4
add esp, 1
xchg ch, bh
xchg dword [esp + 0x19], esi
xchg ah, cl
cld
push dword [esp + 0xc]
jmp 0x5d4c8b
Function at 0x5d4d75
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, reloc.WSOCK32.dll_gethostbyname
rdtsc
rdtsc
rdtsc
xchg byte [esp + 0xa], dl
jmp 0x5d4db8
lea esp, [esp + 0x11]
xchg bp, cx
inc eax
pop word [esp + 0xc]
neg ebx
jmp 0x5d4d5f
bswap edx
dec ebx
neg ebx
std
pushfd
mov ebp, 0xe3c3c47e
jmp 0x5d4de1
add esp, 3
mov di, word [esp]
rdtsc
add esp, 0
add esp, 0
rdtsc
jmp 0x5d4d86
mov ah, byte [esp + 5]
cpuid
xchg al, ah
mov dh, cl
mov dword [esp + 8], edi
add esp, 0x14
jmp 0x5d4d9c
add esp, 3
rcl bl, cl
lea esp, [esp + 1]
rdtsc
add esp, 0
jmp 0x5d4e49
rcr dl, 4
mov ax, di
cmc
cpuid
mov dword [esp], esi
dec bx
jmp 0x5d4dcb
pushal
lea esp, [esp + 0x1c]
mov di, si
cmc
xchg dh, bh
xchg si, bp
jmp 0x5d4e05
rdtsc
pushfd
lea edx, [esp + esi]
push word [esp]
rcl ax, 2
push dx
jmp 0x5d4e5a
add esp, 0
mov byte [esp], bl
mov eax, 0x8b118a4b
seto al
mov ecx, 0xf64c2c53
inc dh
jmp 0x5d4df1
bt ecx, edi
xchg byte [esp], dl
mov ah, al
neg dl
bsr bx, di
cld
jmp 0x5d4e1d
lea esi, reloc.WSOCK32.dll_gethostbyname
mov al, byte [esp + 1]
xchg dword [esp + 5], ebx
bswap esi
mov dword [esp], eax
pop si
jmp 0x5d5034
outsd dx, dword [esi]
insd dword es:[edi], dx
push ebx
je 0x5d4efa
imul ebp, dword [esi + 0x67], reloc.WSOCK32.dll_gethostbyname
xchg byte [esp], cl
mov al, byte [esp]
mov ecx, 0x675587a8
lea esp, [esp]
jmp 0x5d4eff
neg edi
bswap eax
pop ecx
lea esp, [esp]
lea eax, [edi*4]
cmc
jmp 0x5d4e8c
xchg si, bp
rol bx, 3
mov si, bx
mov si, word [esp + 1]
mov byte [esp + 1], ch
adc ah, dl
jmp 0x5d4ea2
cpuid
bsr ecx, edi
xchg byte [esp], dl
lea edi, [esp + edi]
lea esp, [esp]
lea esp, [esp]
call fcn.005d4f7b
stosd dword es:[edi], eax
cmp al, 0xd2
mov ch, 0x44
in eax, dx
mov dword [eax], ebp
dec ebx
loop 0x5d4e83
add esp, 0
les eax, [eax]
cpuid
cpuid
xchg byte [esp], dh
ror ebx, cl
mov bp, 0x9fe2
jmp 0x5d4edf
mov ebx, dword [esp + 0xa]
pop eax
push word [esp]
pop dword [esp]
xchg cx, bp
xchg byte [esp + 1], dl
jmp 0x5d4ec8
xchg bp, bx
xchg dword [esp + 4], ebx
mov dword [esp + 3], ecx
push word [esp]
xchg byte [esp], al
pop word [esp + 1]
jmp 0x5d4fad
Function at 0x5d4f7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr cx, di
mov dl, byte [esp]
xchg ecx, eax
mov cx, di
bswap esi
push ebp
jmp 0x5d4f50
add esp, 3
rcl dx, cl
lea edx, [eax + edi]
mov bp, sp
mov ah, bh
lea esp, [esp]
jmp 0x5d4f11
pop dword [esp]
sub ebx, ebx
mov si, word [esp + 4]
sets bh
lea ebx, [edx + ebp]
jmp 0x5d4f93
btc ax, ax
lea ecx, [esi + 0xfb]
lea eax, reloc.WSOCK32.dll_gethostbyname
pushfd
bt si, dx
mov ch, 0x1d
jmp 0x5d4f3a
jmp 0x5d4f27
lea ebp, [ecx*4]
lea ecx, [edx*4]
jmp 0x5d4fdb
rcr bh, 1
mov bl, bh
mov byte [esp + 2], dl
lea edx, [esp + ebx]
mov byte [esp + 1], dl
pop ebp
jmp 0x5d4f7d
not eax
bts ebp, ebx
bsr ecx, esp
setb bl
mov byte [esp], ah
cpuid
jmp 0x5d500d
lea ebp, [eax*4]
lea esp, [esp + 1]
rcl al, cl
rdtsc
mov di, 0xd24
lea edi, [ebx*4]
jmp 0x5d4fc5
rol bh, 3
mov edi, 0xb6fcdc99
mov bl, 0xc0
sub esp, 8
jmp 0x5d501e
rdtsc
bswap edx
mov edx, dword [esp]
lea eax, [esp + 0x22]
inc edx
xchg si, bx
jmp 0x5d4ff7
mov ebx, 0x372d0ec
call fcn.005d520c
xchg esi, eax
push cs
pushfd
sti
push ss
mov eax, dword [reloc.WSOCK32.dll_gethostbyname]
xchg ebx, eax
or ah, byte [esi - 0x79]
fld qword [edi - 0x76fbdba4]
dec esp
and al, 3

Function at 0x5d51ce
Capabilities:
Check for peb beingdebugged flag

Disassembly:
jmp 0x5d00b0
call fcn.005d00b5
call 0x5d4086
jmp 0x5d5224
pushal
pop dword [esp + 0x18]
jmp 0x5d52f8
pop eax
jmp 0x5d5261
mov eax, dword [eax + 8]
push eax
jmp 0x5d4081
sub eax, 0x1d4086
push eax
jmp 0x5cfeaf
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x5d523a
push word [esp + 0x19]
lea esp, [esp + 2]
mov dword [esp + 0x54], edi
lea esp, [esp + 0x54]
mov eax, dword fs:[0x30]
jmp 0x5d5298
Function at 0x409ca0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46b25b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045f9b0
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x409d22
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045d75d
mov eax, dword [eax]
push 0x4821d0
push eax
call fcn.0044fbe4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045fc3b
test bl, bl
je 0x409d22
push 0x4821d0
lea ecx, [esp + 0xc]
call fcn.0045ffcb
push 0x485d4c
lea ecx, [esp + 0xc]
call fcn.0045ffcb
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x409d5e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045fc3b
jmp 0x409e29
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x409de2
lea edx, [esp + 0x7c]
push 0x485d48
push edx
call fcn.0044fbe4
add esp, 8
test eax, eax
je 0x409de2
lea eax, [esp + 0x7c]
push 0x485d44
push eax
call fcn.0044fbe4
add esp, 8
test eax, eax
je 0x409de2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409d72
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045fc3b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a620
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a682
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40a690
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46b2db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x48c6d0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40a7c8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40a6f6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045fc3b
xor eax, eax
jmp 0x40a83f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045fd78
push esi
lea ecx, [esp + 0xc]
call fcn.00460007
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40a81d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040a620
test eax, eax
jne 0x40a81d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040a620
test eax, eax
jne 0x40a81d
lea eax, [esp + 0x14]
push 0x485d60
push eax
call fcn.00450c20
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a7fc
lea ecx, [esp + 0x14]
push 0x485d5c
push ecx
call fcn.00450ba0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a7fc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40a7ff
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045fd28
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40a70e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045fc3b
xor eax, eax
jmp 0x40a83f
mov byte [esi], 0
push 0x485d58
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045fc3b
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41c770
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41c7de
cmp si, 0x69
ja 0x41c7de
add esi, 0xffd0
cmp si, 0x11
je 0x41c7ae
push 0x11
call edi
test ax, ax
jge 0x41c7ae
or esi, 0x2000
cmp si, 0x10
je 0x41c7c3
push 0x10
call edi
test ax, ax
jge 0x41c7c3
or esi, 0x4000
cmp si, 0x12
je 0x41c7d8
push 0x12
call edi
test ax, ax
jge 0x41c7d8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41c7eb
mov esi, 0xbd
jmp 0x41c79f
cmp si, 0x6e
jne 0x41c7f8
mov esi, 0xbe
jmp 0x41c79f
cmp si, 0x6f
jne 0x41c799
mov esi, 0xbf
jmp 0x41c79f

Function at 0x41de90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x49cdc8]
xor edx, edx
cmp eax, edx
jne 0x41deb6
xor eax, eax
mov byte [eax + 0x49ccc8], al
inc eax
cmp eax, 0x100
jl 0x41de9e
mov dword [0x49cdc8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x49ccc8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41df47
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41df1a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41dee8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41dfc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41e013
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41dffa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret