joyce8/EMBER2024-capa huggingface dataset:
Function at 0x871b05
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xd]
pop word [esp + 0xc]
pop word [esp + 0xc]
pop word [esp + 7]
jmp 0x871ace
push word [esp + 2]
cld
push dword [esp + 6]
pop dword [esp + 1]
cld
cld
jmp 0x871b5e
call 0x871b05
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor dword cs:[esi], ebp
cmp dword [esi], ebp
xor byte [eax], al
pushfd
pushal
pop word [esp + 7]
push word [esp + 0x19]
jmp 0x871aa5
bsf bx, ax
mov edx, dword [esp]
xchg ch, dl
neg ax
xchg dh, al
neg ax
jmp 0x871b48
rdtsc
mov ecx, 0x88df6ade
mov si, sp
rcr ch, 5
xchg dx, cx
mov cx, di
jmp 0x871b13
xchg ch, dl
cpuid
mov esi, dword [esp]
sub edi, eax
setae ch
neg bx
jmp 0x871bbe
push word [esp + 1]
lea esp, [esp + 1]
lea esp, [esp + 0x10]
pushal
clc
not cx
jmp 0x871b33
mov ah, byte [esp + 0x17]
xchg word [esp + 0x1d], bp
lea edi, [esp + edx]
mov dword [esp + 3], eax
popal
mov dl, 0xc
jmp 0x871c72
sub esp, 0x1a
xchg dword [esp + 0x12], esi
sub esp, 0x10
pop dword [esp + 0xe]
mov bx, word [esp + 8]
jmp 0x871b93
rcl di, cl
push edx
pushal
pop si
pop di
ror bh, 3
jmp 0x871c3b
pop word [esp + 1]
mov dh, byte [esp + 3]
not dh
mov byte [esp + 3], ah
add esp, 0
jmp 0x871c1d
mov bl, 8
xchg edi, eax
cpuid
mov edx, ebp
mov bl, 0x60
neg cx
jmp 0x871be8
xchg si, bp
stc
pop word [esp]
btc eax, ebx
mov cl, ch
xchg ebp, eax
jmp 0x871cc4
add esp, 0x17
pop bx
btr ecx, esp
mov bp, 0xdd3b
mov cx, sp
jmp 0x871bf6
rdtsc
bswap ebp
pop ecx
cpuid
lea edi, [ecx + 3]
pop si
jmp 0x871c0e
cld
xchg ch, dl
mov dx, 0xd70d
mov eax, ecx
xchg esi, eax
sub ebp, eax
jmp 0x871c52
clc
mov byte [esp], ah
add esp, 0
mov ebp, dword [esp]
lea edi, [edi*4]
cpuid
jmp 0x871cad
mov bh, byte [esp + 2]
add esp, 2
cld
add esp, 0
mov esi, ecx
xchg cx, bp
jmp 0x871c81
xchg ch, dl
call fcn.00871d89
cmc
cli
popfd
insb byte es:[edi], dx
popfd
add eax, 0x93600191
and al, 0x90
adc ecx, dword [edx - reloc.RASAPI32.dll_RasHangUpA]
add byte [eax], al
add byte [eax], al
lea edx, [eax*4]
setno dh
mov ebp, dword [esp]
mov ax, 0x9d23
rdtsc
neg ax
jmp 0x871c9b

Function at 0x871d89
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0
mov eax, 0x175dacde
not si
sub si, 0x610
jmp 0x871d56
add esp, 4
xchg byte [esp], al
rdtsc
mov eax, dword [esp]
cpuid
bswap eax
jmp 0x871cf4
lea edi, [esi + edi]
neg ebx
bswap ebx
rdtsc
sub bl, ah
mov dl, 0x24
jmp 0x871d0c
lea esp, [esp]
xchg byte [esp], dl
lea edx, reloc.RASAPI32.dll_RasHangUpA
add esp, 0
lea esp, [esp]
add esp, 0
jmp 0x871d71
mov dx, word [esp]
setp ch
lea eax, [eax - 0xc9]
xchg ch, dl
lea edi, [eax*4]
btc ecx, edi
jmp 0x871d32
bsf di, ax
xchg dx, bx
not esi
mov byte [esp], bh
btc edx, ebx
add esp, 0
jmp 0x871de6
mov ebp, 0x9e61da74
lea ebx, [esp + edx]
lea edi, [edx + ebx]
xchg word [esp + 2], cx
not ah
jmp 0x871d23
push esp
rcr esi, 7
lea edi, [edx + esi]
lea esp, [esp + 2]
call fcn.00871db6
mov al, 0x28
mov esi, 0xc59f28d9
je 0x871d71
mov dl, dh
salc
mov ebx, ebp
not ah
bswap edi
btr ecx, esp
xchg byte [esp], bl
jmp 0x871dce
Function at 0x871ebb
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov edx, 0xb6398fc8
push word [esp + 2]
lea ebp, [ebp*4]
btr edx, esp
mov word [esp], dx
jmp 0x871ee5
rdtsc
lea edi, [edx*4]
bswap eax
mov dword [esp], ebp
bswap esi
jmp 0x871e96
xchg word [esp + 1], bp
xchg byte [esp], cl
push word [esp + 2]
push word [esp + 3]
inc ecx
mov edx, dword [esp + 6]
inc dx
mov bx, word [esp + 5]
pop word [esp + 2]
jmp 0x871ecd

Function at 0x872033
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xb]
mov dword [esp], eax
xchg bh, cl
lea ebx, [ecx*4]
lea ebp, reloc.RASAPI32.dll_RasHangUpA
jmp 0x872076
lea esi, [edi*4]
mov bp, word [esp + 2]
cld
mov cl, ch
lea edi, [ebx + ebx]
mov cl, 0xca
jmp 0x8720d7
mov eax, dword [esp + 3]
not dh
bsr bx, bp
mov word [esp], dx
inc bx
xchg ah, bl
jmp 0x872055
mov edx, dword [esp]
mov ebx, ebp
mov si, bx
cpuid
cld
lea esp, [esp + 1]
jmp 0x872122
stc
bsr si, cx
neg ch
pop dword [esp]
pop word [esp]
inc esi
jmp 0x87209c
add al, dh
mov si, word [esp]
cmc
push dword [esp + 2]
mov esi, 0x66ce016c
xchg dword [esp], ebp
jmp 0x8720b2
mov esi, 0x3ce611b6
xchg byte [esp], dl
clc
rdtsc
neg ebx
setg ch
jmp 0x872134
sete dh
mov bp, word [esp]
mov edx, 0xd5fa4114
btr edi, edx
jmp 0x8720ec
mov esi, dword [esp]
mov ax, word [esp]
mov dl, dh
bswap edx
lea ecx, [edi + edi]
and edx, ecx
jmp 0x872108
cld
lea esp, [esp]
mov ah, byte [esp]
ror ch, 5
add esp, 0
cpuid
jmp 0x87262c
bsf di, ax
lea ebp, [ecx*4]
pop eax
push dword [esp + 1]
push dword [esp + 0x18]
rdtsc
jmp 0x872286
xchg dx, bp
stc
not ecx
xchg si, bp
pushal
xchg word [esp + 0x1c], bx
jmp 0x8722f3
not ecx
xor si, 0x8e9c
mov dl, 0xe4
not ah
lea edx, [esi + 0xdd]
mov ah, byte [esp]
jmp 0x87237f
Function at 0x872324
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, word [esp + 0x19]
cld
mov ebx, 0x83679b32
bsr cx, bp
jmp 0x87233a
mov ebp, 0x19891a
clc
jmp 0x87229f
pop word [esp + 0xc]
call 0x872324
int1
adc dword [ebx], 0x76
test dword [eax - 0x3a], ebp
jno 0x872391
jae 0x87238d
test dword [esi + 0xf], esp
mov ebp, 0x2474ffe9
adc al, 0x66
mov edi, ebx
mov bh, byte [esp + 0x15]
stc
jmp 0x872365
cpuid
setno ch
lea ecx, [ebx*4]
mov bl, 0x50
xchg si, ax
btc ebx, ebx
jmp 0x87230e
not bx
pop dword [esp + 0x16]
mov bx, word [esp + 0x1f]
jmp 0x8724c6
xchg ebp, ecx
lea eax, [ebx + ebx]
mov byte [esp + 3], ah
mov word [esp + 0x11], di
mov dword [esp + 0x26], ebp
jmp 0x87234f
sbb al, 0xe9
pushal
invalid
invalid
mov ecx, 0x8a266c48
mov ecx, eax
setge ah
xchg di, ax
mov al, 0x76
jmp 0x872405
bsf dx, si
bswap eax
add esp, 8
xchg dh, al
mov bl, bh
xchg ebp, edx
jmp 0x872393
mov ah, byte [esp + 0x11]
mov edx, 0x1d14aedc
pop word [esp + 2]
popal
pop di
rdtsc
jmp 0x8723aa
bswap edi
lea eax, [eax - 0x69]
mov bh, byte [esp]
btc edx, ebx
call 0x8723ea
out 0xe8, al
cwde
add byte [eax], al
add byte [esi - 0x71], ah
inc esp
and al, 0x13
pushal
lea esp, [esp + 0x47]
mov dx, 0x861b
jmp 0x872460
bsr bp, cx
mov byte [esp], ch
mov cx, di
add esp, 0
lea ebp, [ebp*4]
lea eax, [edi + ebp]
jmp 0x8723d9
lea ecx, [edx + edi]
mov dword [esp + 7], eax
mov word [esp + 4], bx
mov edx, 0xd8914aca
cpuid
rdtsc
jmp 0x8723c4
push edx
mov ah, byte [esp + 1]
mov byte [esp], ah
cpuid
mov di, sp
xchg bx, si
jmp 0x8724a5
mov si, word [esp]
mov ax, word [esp]
mov ebx, dword [esp]
mov dl, byte [esp]
inc bl
lea esi, [esp + edx]
jmp 0x872449
lea esi, [esp + eax]
pop dword [esp + 0x14]
xchg bh, cl
pop eax
lea ebp, [edi*4]
jmp 0x872594
pushal
mov edi, dword [esp + 0x23]
push dword [esp + 0x12]
xchg ch, dl
mov al, ah
push dword [esp + 0x1a]
jmp 0x87248e
and bp, 0x3aa2
mov bp, dx
mov al, 0x8e
xchg di, ax
setl ch
not ah
jmp 0x87242f
neg bp
rcl bp, cl
call fcn.00872511
adc byte [edx + ebx - 0x59c57383], al
xor dword [ecx - reloc.RASAPI32.dll_RasHangUpA], esp
xor ah, byte [eax - 0x4c73cd39]
stosb byte es:[edi], al
mov edx, eax
btc ecx, edi
xchg dword [esp + 6], ebp
lea edx, reloc.RASAPI32.dll_RasHangUpA
pop ebp
add esp, 9
jmp 0x8724dd
setge ch
inc esi
popal
sub esp, 0x10
mov cl, 0xa
cld
jmp 0x8724fc
btc edi, edi
neg ax
cpuid
rdtsc
neg esi
lea esi, [edx + edx]
jmp 0x87253c
Function at 0x872511
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, ch
sub esp, 0xa
xchg ch, dl
xchg byte [esp + 8], al
jmp 0x872522
mov si, di
xchg di, bx
xchg bx, ax
mov dl, 0xec
xchg byte [esp], al
rdtsc
jmp 0x872568
inc esi
rdtsc
ror ah, 1
cpuid
pop bp
shl cx, cl
jmp 0x87257e
not ch
xchg byte [esp], cl
pop eax
xchg di, si
lea esi, reloc.RASAPI32.dll_RasHangUpA
mov word [esp + 8], bx
jmp 0x872549
mov si, word [esp + 9]
mov cl, ch
pop ax
mov eax, 0x5596a1bc
mov al, ah
jmp 0x8725c6
lea edi, [esi - 0x4d]
call fcn.00872602
lea esp, [esp + 0x16]
mov cl, ch
mov dx, word [esp]
add esp, 0
mov ch, byte [esp]
rcl bp, cl
jmp 0x8725dd
mov byte [esp + 5], bh
sub esp, 2
push dword [esp + 4]
mov dword [esp + 6], ecx
cpuid
push dword [esp + 0x12]
jmp 0x8725a5
pushal
pop dword [esp + 0x16]
pop cx
setno bh
cld
bsf bp, ax
jmp 0x87270f
bswap ebp
pop dword [esp + 2]
pop word [esp + 6]
cpuid
shr ebp, 0x1d
xchg di, dx
jmp 0x8726d0
mov ecx, eax
xchg byte [esp + 0x10], al
xchg dword [esp], ebp
mov byte [esp + 0xd], bh
mov edx, ebp
pop bp
jmp 0x872645
mov dl, 0x7c
inc bx
mov ebx, dword [esp]
xor ebx, esi
sub esp, 0x18
ror ch, 5
jmp 0x87265e
not cx
mov ebp, dword [esp]
mov ax, word [esp]
mov ah, byte [esp]
xchg bh, cl
inc bl
jmp 0x87267f
pop word [esp + 3]
xchg si, ax
mov ebp, 0x31b332f2
lea esp, [esp + 8]
inc cx
ror ebx, 0x17
jmp 0x8728a5
btc esi, edi
pop di
pop dword [esp + 4]
xchg dh, al
mov bh, byte [esp + 8]
rdtsc
jmp 0x8726b3
mov bp, 0x3337
lea esp, [esp + 0x17]
neg di
bswap esi
neg cx
rdtsc
jmp 0x8726a0
add esp, 5
pop word [esp + 1]
push dword [esp]
rdtsc
mov edi, eax
mov dword [esp + 1], ecx
jmp 0x8726ea
not cx
stc
neg bx
lea ebp, [ebx + edi]
inc di
mov al, 0x9e
jmp 0x8727b5
mov si, dx
mov bx, word [esp + 0x1b]
setno dh
pop word [esp + 0x1a]
jmp 0x872724
pop esi
clc
rdtsc
lea edx, [eax*4]
mov byte [esp], ch
pushal
jmp 0x87273c
not si
lea esp, [esp + 0x18]
lea esp, [esp]
lea esp, [esp]
neg ch
push edx
jmp 0x872754
lea eax, [ebx*4]
btr esi, esp
lea ebp, reloc.RASAPI32.dll_RasHangUpA
xchg dx, di
bswap edx
mov byte [esp + 5], bh
call fcn.008727cb
int3
mov dl, 0x4c
xchg word [esp], bx
mov dword [esp + 0x11], ecx
xchg byte [esp], dl
pop di
mov cx, word [esp + 0x18]
jmp 0x87278c
push dword [esp + 0xa]
cpuid
pop word [esp + 0xe]
xchg dword [esp + 6], ecx
btr eax, esp
jmp 0x87277a
mov byte [esp + 5], dh
xchg byte [esp + 4], cl
pop word [esp + 0xa]
push word [esp + 4]
not dh
stc
jmp 0x8727e1
sub esp, 0x1a
pop edi
mov si, word [esp + 4]
mov dl, dh
xchg ah, bl
not edx
jmp 0x8727fa
mov bh, byte [esp]
mov esi, 0xf867b166
lea edi, [edi*4]
inc al
mov eax, dword [esp]
xchg dh, al
jmp 0x872870

Function at 0x872602
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [eax*4]
mov ebx, 0xccbcc0f0
mov word [esp + 6], di
pop dword [esp + 0x11]
lea edi, [ecx + 0x9b]
jmp 0x8725ad
Function at 0x8729ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ch
setno bh
cpuid
sub esp, 0xe
jmp 0x8729db

Function at 0x872bda
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, byte [esp + 5]
xchg dword [esp + 6], edi
rdtsc
cld
jmp 0x872c66
lea esi, [edx*4]
push dword [esp + 8]
call fcn.00872c4a
jl 0x872c6f
salc
inc ecx
ret
mov byte [esp + 0xb], bh
mov byte [esp + 1], bh
xchg ah, bl
pop esi
mov dl, dh
push edx
jmp 0x872c0e
add al, dh
rdtsc
bswap edi
shr ch, 5
cpuid
bswap esi
jmp 0x872c24
mov word [esp + 4], di
lea ebp, [esi*4]
mov bx, di
pop word [esp + 3]
add byte [eax], al
add byte [esi - 0x75], ah
fbld tbyte [esi - 0x71]
inc esp
and al, 3
xchg dword [esp + 4], edi
mov si, word [esp + 2]
jmp 0x872c3b

Function at 0x872cd9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [esi*4]
rdtsc
add esp, 0xf
mov cl, ch
rdtsc
jmp 0x872b8a
bsf di, si
mov byte [esp + 0xb], ch
push dword [esp + 9]
btr ecx, esp
mov esi, dword [esp + 2]
push esp
jmp 0x872b5e
neg ah
btc eax, ebx
call fcn.00872bda
je 0x872b88
pushal
pop es
sbb esi, dword [esi - 9]
add dh, cl
pop ds
push 0xffffffffffffff85
xor al, 0x86
inc esp
and al, 0xc
xchg byte [esp + 0xc], al
mov ah, byte [esp + 9]
mov edx, dword [esp + 3]
btr ecx, edx
cpuid
lea ecx, [eax + 0x11]
jmp 0x872b74
push edx
inc bl
sub cx, 0x2a8
ror dh, 7
mov bl, bh
xchg word [esp + 0x10], dx
jmp 0x872ba3
push word [esp + 0xd]
mov ah, byte [esp + 0x35]
xchg word [esp + 0x1e], di
add esp, 0x29
lea esp, [esp + 5]
not ebx
jmp 0x872bc6
pop dword [esp + 0x1d]
jmp 0x872bf5

Function at 0x872e53
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x1d], ebp
pop dword [esp + 0x12]
push dword [esp + 0x10]
lea esp, [esp + 2]
jmp 0x872f21
pushal
lea esp, [esp + 3]
jmp 0x872e3b
mov dword [esp + 0x38], edx
call 0x872e73
push dword [esp + 6]
mov word [esp + 2], bx
pop dword [esp + 0x16]
jmp 0x872f72
push word [esp + 0xf]
push word [esp + 0xd]
pushal
push edx
lea esp, [esp + 0x44]
call fcn.00872f5a
cmp al, 0xb5
and eax, 0x2e1abf4c
cmpsb byte [esi], byte es:[edi]
xor al, 0x53
scasb al, byte es:[edi]
jp 0x872feb
mov esi, 0x884b2889
and al, 2
pop edx

Function at 0x872ec5
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x40], ebx
pushal
push edx
mov byte [esp + 0xa], dh
lea esp, [esp + 0x15]
pop word [esp + 3]
jmp 0x872ef5
push edx
push word [esp + 3]
mov byte [esp + 0xb], ah
mov dword [esp + 2], eax
lea esp, [esp + 3]
jmp 0x872e88
mov word [esp + 2], di
jmp 0x872eac
lea esp, [esp + 1]
call fcn.00872f41
pop word [esp + 0xb]
pushal
lea esp, [esp + 3]
mov dword [esp + 0x70], ebp
pushal
pop dword [esp + 0x14]
jmp 0x872f2a
push word [esp + 8]
mov byte [esp + 9], bh
lea esp, [esp + 3]
mov dword [esp + 0x48], esp
call fcn.00872ecc
push dword [esp + 2]
push edx
jmp 0x872ed1
Function at 0x872f0b
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x40], ebx
pushal
push edx
mov byte [esp + 0xa], dh
lea esp, [esp + 0x15]
pop word [esp + 3]
jmp 0x872ef5
push edx
push word [esp + 3]
mov byte [esp + 0xb], ah
mov dword [esp + 2], eax
lea esp, [esp + 3]
jmp 0x872e88
mov word [esp + 2], di
jmp 0x872eac
lea esp, [esp + 1]
call fcn.00872f41
pop word [esp + 0xb]
pushal
lea esp, [esp + 3]
mov dword [esp + 0x70], ebp
pushal
pop dword [esp + 0x14]
jmp 0x872f2a
push word [esp + 8]
mov byte [esp + 9], bh
lea esp, [esp + 3]
mov dword [esp + 0x48], esp
call fcn.00872ecc
push dword [esp + 2]
push edx
jmp 0x872ed1

Function at 0x872f41
Capabilities:
Parse pe header

Disassembly:
pop dword [esp + 8]
push word [esp + 4]
push word [esp + 7]
mov byte [esp + 0xb], ch
pop word [esp + 2]
jmp 0x872eda
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x40d308
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x9e
sahf
xchg edi, eax
pop ds
or al, 0x43
mov bh, 0x67
xor edx, esi
jae 0x40d309
sahf
mov dword [ebp + 0x3a], edx
arpl word [edi - 0x6e392676], sp
fnstcw word [edx + 0x78]
sbb byte [esi + 0x5e], al
push es
jg 0x40d309
or eax, 0x3b44741e
adc eax, 0x2cc8c4c8
jl 0x40d34c
invalid
cmp byte [ebp - 0x23], ah
adc eax, 0xbc35f2a9
pop ds
hlt
Function at 0x40b5c0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46784b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045c249
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40b642
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045a160
mov eax, dword [eax]
push 0x9681f0
push eax
call fcn.0044cd94
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045c4d4
test bl, bl
je 0x40b642
push 0x9681f0
lea ecx, [esp + 0xc]
call fcn.0045c864
push 0x96bd6c
lea ecx, [esp + 0xc]
call fcn.0045c864
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40b67e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045c4d4
jmp 0x40b749
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40b702
lea edx, [esp + 0x7c]
push 0x96bd68
push edx
call fcn.0044cd94
add esp, 8
test eax, eax
je 0x40b702
lea eax, [esp + 0x7c]
push 0x96bd64
push eax
call fcn.0044cd94
add esp, 8
test eax, eax
je 0x40b702
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b692
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045c4d4
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40bf40
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40bfa2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40bfb0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4678cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x9722e0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40c0e8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40c016
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045c4d4
xor eax, eax
jmp 0x40c15f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045c611
push esi
lea ecx, [esp + 0xc]
call fcn.0045c8a0
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40c13d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040bf40
test eax, eax
jne 0x40c13d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040bf40
test eax, eax
jne 0x40c13d
lea eax, [esp + 0x14]
push 0x96bd80
push eax
call fcn.0044ddd0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c11c
lea ecx, [esp + 0x14]
push 0x96bd7c
push ecx
call fcn.0044dd50
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c11c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40c11f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045c5c1
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40c02e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045c4d4
xor eax, eax
jmp 0x40c15f
mov byte [esi], 0
push 0x96bd78
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045c4d4
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41cae0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41cb4e
cmp si, 0x69
ja 0x41cb4e
add esi, 0xffd0
cmp si, 0x11
je 0x41cb1e
push 0x11
call edi
test ax, ax
jge 0x41cb1e
or esi, 0x2000
cmp si, 0x10
je 0x41cb33
push 0x10
call edi
test ax, ax
jge 0x41cb33
or esi, 0x4000
cmp si, 0x12
je 0x41cb48
push 0x12
call edi
test ax, ax
jge 0x41cb48
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41cb5b
mov esi, 0xbd
jmp 0x41cb0f
cmp si, 0x6e
jne 0x41cb68
mov esi, 0xbe
jmp 0x41cb0f
cmp si, 0x6f
jne 0x41cb09
mov esi, 0xbf
jmp 0x41cb0f

Function at 0x41e200
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x982960]
xor edx, edx
cmp eax, edx
jne 0x41e226
xor eax, eax
mov byte [eax + 0x982860], al
inc eax
cmp eax, 0x100
jl 0x41e20e
mov dword [0x982960], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x982860
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41e2b7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41e28a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41e258
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41e330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41e383
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41e36a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4300d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4697b8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
call fcn.0042a9d0
test eax, eax
je 0x4301d8
lea ecx, [esp + 0xc]
call fcn.00402cf0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0042a9d0
mov ecx, eax
call fcn.004280a0
test eax, eax
je 0x4301bf
mov eax, dword [esp + 0x1c]
test eax, eax
mov ebp, eax
je 0x4301bf
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4301bf
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
neg esi
push edi
push ebx
sbb esi, esi
and esi, edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebp
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00402ef0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop edi
jne 0x4301a1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4301bf
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [0x982db0]
push ebx
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x9581b0
call fcn.00402ef0
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10