joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462bf4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404a78
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x462c4c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x47e2d8]
mov dl, 1
mov eax, dword [0x462560]
call fcn.0040b7fc
call fcn.00403fa4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00462704
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4668dc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4669b4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x47fcbc], 0
jne 0x466998
lea eax, [ebp - 4]
mov edx, 0x4669cc
call fcn.00404660
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a78
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x466998
mov eax, ebx
call fcn.00402744
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x466991
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46697b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4669dc
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46697b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x47fcbc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466998
mov eax, dword [ebp - 0xc]
call fcn.00402764
ret
mov ebx, dword [0x47fcbc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4669bb
lea eax, [ebp - 4]
call fcn.004045c8
ret

Function at 0x46e718
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x47fce0], 0
jne 0x46e73b
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x46e68c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x47fce0], eax
ret
Function at 0x470dd8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x471038
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x470e3b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004708a0
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040bf88
cmp al, 1
jne 0x470e3b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00470bb8
test al, al
je 0x470fc7
cmp dword [ebp - 8], 0
jge 0x470e59
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004708a0
mov eax, dword [ebp - 0x210]
call fcn.00404880
cmp ebx, eax
jge 0x470ea3
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004708a0
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x47e2b8]
and eax, 0xff
bt dword [edx], eax
jae 0x470ea3
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x470eb7
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00470db4
cmp ebx, dword [ebp - 8]
je 0x470fb9
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x470ee3
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004039d4
and eax, 0x7f
movzx eax, word [eax*2 + 0x47de9c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x470fa6
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004039d4
and eax, 0x7f
movzx eax, word [eax*2 + 0x47de9c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004449bc
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004039d4
and eax, 0x7f
movzx eax, word [eax*2 + 0x47de9c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004449bc
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470fad
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x47101a
cmp dword [ebp - 8], 0
jge 0x470fd2
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004708a0
mov eax, dword [ebp - 0x218]
call fcn.00404880
cmp eax, dword [ebp - 8]
jg 0x47100c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004708a0
mov eax, dword [ebp - 0x21c]
call fcn.00404880
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00470db4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47103f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004045ec
ret
Function at 0x47a9ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef0
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, ebx
call fcn.004045c8
push esp
push 0x20019
push 0
mov eax, esi
call fcn.00404a78
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47aa6c
mov dword [esp + 4], 0x105
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
mov eax, edi
call fcn.00404a78
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x47aa63
cmp dword [esp + 4], 0
jle 0x47aa63
mov eax, ebx
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.00404830
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x110
pop edi
pop esi
pop ebx
ret

Function at 0xeed260
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeed26a
pushal
call 0xeed270
pop ebp
sub ebp, 0x10
sub ebp, 0xaed260
jmp 0xeed286
mov eax, 0xaed260
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b1
mov edx, 0x4aa15ced
xor byte [eax], dl
inc eax
dec ecx
jne 0xeed29d
jmp 0xeed2b0
and byte [esi + 0x64], ah
shr ebp, 1
in eax, dx
in eax, dx
insb byte es:[edi], dx
sub al, 0x15
in eax, dx
in eax, dx
in eax, dx
out dx, al
and byte [ebp - 0x15], dl
in eax, dx
in eax, dx
in eax, dx
push edi
vpaddsw ymm5, ymm2, ymm5
sbb cl, byte [edi]
out dx, al
and eax, 0xede16c66
in eax, dx
in eax, dx
out dx, al
sub byte [ebp + 0x27f185bd], bh
int3
Function at 0x40980c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4098c0
jmp 0x4098b5
cmp dword [esi + 0x10], 0x1000
jne 0x4098a1
test byte [esi + 0x15], 1
jne 0x4098a1
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409860
cmp eax, 2
je 0x409860
cmp eax, 0x10
je 0x409860
cmp eax, 0x20
jne 0x409875
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409875
mov bl, 1
xor ebp, ebp
jmp 0x409886
mov eax, dword [esi]
add eax, ebp
call fcn.00409804
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409879
test bl, bl
je 0x4098a1
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4098c0
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409838
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x1b0432ff
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x221d24a6
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x404495
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
mov ecx, eax
mov edx, dword [esp + 0xc]
xor ecx, 0xc46
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x24], ecx
lea ebx, [edx + 0x2cf]
lea ecx, [eax + 0x25a]
add ebp, 0x347
mov eax, dword [esp + 0x18]
xor edx, 0x2de
push esi
mov esi, dword [esp + 0x14]
add eax, 0x40
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x28], eax
add edi, 0xffffff1c
lea eax, [ebp - 0x2ab]
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], ecx
cmp ecx, eax
je 0x40460c
mov eax, dword [esi + 0xd4]
sub ebx, 0x336
mov dword [esi + 0xd0], eax
mov ecx, dword [0x4a67bc]
mov eax, dword [esi + 0x7c]
cmp eax, dword [ecx + 0xe0]
jne 0x40452e
xor dword [esi + 0xa0], 0x2d501
mov ecx, dword [0x4a67bc]
jmp 0x404537
mov eax, dword [esi + 4]
add dword [0x4bcac0], eax
mov eax, dword [esi + 0x110]
cmp eax, dword [0x4bc9f8]
jbe 0x404558
mov eax, dword [esi + 8]
xor eax, dword [0x4bca58]
add eax, 0x1b8e8d
mov dword [ecx + 0x4c], eax
jmp 0x40456d
mov eax, dword [ecx + 0xdc]
add eax, dword [esi + 0x124]
add eax, dword [esi + 0x20]
mov dword [esi + 0xc4], eax
mov eax, dword [esi + 0x48]
cmp eax, dword [esi + 0x7c]
ja 0x404588
mov eax, dword [0x4a67bc]
mov eax, dword [eax + 0x34]
xor eax, dword [esi + 0x78]
xor eax, 0xdd4
sub dword [esi + 0x4c], eax
mov edx, dword [esp + 0x2c]
lea eax, [ebx + 0x226]
push esi
push eax
mov eax, dword [esp + 0x2c]
xor edi, 0xe93
xor eax, 0x5c3
push eax
mov eax, edx
xor eax, 0xc46
push eax
lea eax, [edx + 0x7d]
push eax
mov eax, dword [esp + 0x3c]
xor eax, 0x7ac
push edi
push eax
call fcn.00413e70
mov eax, dword [esi + 0x124]
add esp, 0x1c
mov ecx, dword [esi + 0x98]
sub eax, 0x13889f
add ecx, 0x193e11
push eax
push ecx
push dword [esi + 0x4c]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add eax, 0x4800
mov dword [0x4bcabc], eax
mov eax, dword [0x4bcacc]
add eax, 0x194be1
add eax, dword [esi + 0xf4]
mov dword [esi + 0x84], eax
jmp 0x4046bf
mov ecx, dword [0x4a67bc]
mov edi, dword [esi + 0xfc]
mov eax, dword [ecx + 0x74]
xor eax, edi
cmp dword [ecx + 0xec], eax
jb 0x404678
mov ecx, dword [0x4bcad8]
lea eax, [ebx - 0x1bb8]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esi + 0x8c]
sub eax, dword [esi + 0x88]
mov esi, dword [esp + 0x2c]
sub eax, ebp
push eax
mov eax, ecx
imul ecx, esi
imul eax, dword [esp + 0x34]
push eax
lea eax, [esi + edx]
push eax
mov eax, dword [0x4bcb10]
or eax, 0x1b3b
push ecx
sub eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
call esi
jmp 0x4046bf
mov ecx, dword [esi + 0x10c]
and edi, ebp
imul edi, ebx
lea eax, [ecx + edx]
and ecx, edx
or eax, edx
and ecx, 0x177d
push eax
mov eax, dword [esi + 0xe4]
and eax, 0x1bb8
push eax
mov eax, dword [esi + 0xd8]
xor eax, dword [esi + 0x44]
push eax
push ecx
imul ecx, ebp, 0x153c
push edi
xor ecx, edx
xor edx, 0x16db
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x404855
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [0x4bd5e4]
mov eax, dword [esp + 0xc]
dec ecx
mov dword [0x4bd5e4], ecx
push ebx
push ebp
mov eax, dword [eax]
mov ebp, dword [esp + 0x18]
add eax, eax
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x20]
mov eax, dword [ebp + eax*8]
cdq
idiv ecx
mov eax, dword [0x4bd5cc]
mov dword [esp + 0x1c], edx
xor edx, edx
div dword [0x4bd5f0]
push edi
mov edi, dword [esp + 0x18]
xor edx, edx
mov dword [esp + 0x10], eax
movzx eax, word [esi + 0x2aa8]
movzx ecx, word [edi]
imul ecx, ecx, 0xc
div dword [ecx + ebx + 0x38]
mov ecx, dword [0x4bd5ec]
mov edx, dword [0x1caa]
mov bl, al
mov eax, dword [esp + 0x2c]
movzx esi, word [esi + ecx*2]
movzx ecx, byte [eax]
cmp edx, dword [ebp + ecx*4]
jge 0x4048f3
mov edi, dword [esp + 0x1c]
dec dword [0x4bd5dc]
mov al, 0xc0
mov ecx, dword [edi]
sub al, byte [ecx + esi]
inc edx
mov byte [ecx + esi], al
mov eax, dword [esp + 0x2c]
movzx eax, byte [eax]
cmp edx, dword [ebp + eax*4]
jl 0x4048d1
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
dec bl
movzx eax, bl
xor edx, edx
mov dword [ecx + 0x300], eax
movzx eax, word [edi + 0x182]
and eax, dword [0x4bd564]
movzx ecx, word [0x4bd568]
xor eax, ecx
div ecx
movzx eax, word [edi]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov byte [eax + ecx], dl
mov eax, dword [esp + 0x1c]
dec dword [0x4bd564]
pop ebx
mov eax, dword [eax + 0x1604]
or eax, 0xc1
pop ecx
ret
Function at 0x413e70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x1c]
lea edx, [eax - 0x2bc]
xor esi, 0x1c14
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x24]
mov ebx, eax
push edi
lea edi, [eax - 0x5d5]
xor ecx, 0x378
lea eax, [esi + 0x15ed]
xor ebx, 0x79a
cmp ecx, eax
je 0x413eec
lea eax, [ecx + 0x460]
cmp ebx, eax
jl 0x413eec
mov eax, 0x13d5cb
sub eax, dword [edx + 0x44]
add dword [edx + 0x4c], eax
mov eax, dword [edx + 0x120]
xor eax, dword [0x4bcad8]
mov ecx, dword [edx + 0x4c]
sub ecx, eax
add ecx, 0xb41e3
mov dword [edx + 0x4c], ecx
mov eax, dword [0x4a67bc]
xor dword [eax + 0x4c], 0xc167f
lea eax, [edi + 0x123]
cmp esi, eax
je 0x413f0a
cmp ebx, edi
jle 0x413f51
mov eax, dword [edx + 0x98]
add eax, 0x1d2a87
add dword [edx + 0x4c], eax
jmp 0x413f51
mov eax, dword [0x4a67bc]
mov ecx, dword [0x4bcac8]
push ebp
mov edi, dword [eax + 0xa8]
mov ebp, dword [eax + 0xdc]
mov eax, ebp
or eax, esi
mov dword [esp + 0x14], edi
xor eax, edi
cmp ecx, eax
jbe 0x413f50
mov edi, esi
sub edi, dword [edx + 0xf4]
imul edi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
add esi, edi
mov eax, ebp
or eax, esi
add ecx, 3
xor eax, edx
cmp ecx, eax
ja 0x413f41
pop ebp
pop edi
pop esi
lea eax, [ebx - 0x42c]
pop ebx
ret
Function at 0x4148c4
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
add ecx, 0xfffffe1d
push esi
mov esi, dword [esp + 0x24]
add ebp, 0xfffffd42
push edi
mov edi, dword [esp + 0x20]
add edi, 0xffffea48
mov dword [esp + 0x28], ebp
lea ebx, [esi - 0x19d7]
mov dword [esp + 0x10], edi
lea edx, [esi - 0x3ea]
mov dword [esp + 0x20], ecx
xor esi, 0x19d7
mov eax, esi
xor eax, 0x19d7
cmp edi, eax
je 0x414ae2
lea eax, [edx + 0x5cb]
cmp edi, eax
je 0x414a9a
mov esi, dword [esp + 0x18]
xor ebp, ebp
mov eax, dword [esi + 0xb4]
mov ecx, dword [0x4a67bc]
mov ebx, dword [eax + ebp]
add ebp, 4
mov eax, dword [esi + 0x20]
add dword [ecx + 0x48], eax
mov eax, dword [0x4bcad0]
add eax, 0xffffffb8
mov ecx, dword [esi + 0x20]
add eax, dword [esi + 0xac]
add dword [esi + 0x1c], eax
mov eax, dword [0x4a67bc]
mov eax, dword [eax + 0x124]
xor eax, dword [esi + 0x114]
sub eax, 0x1388c2
xor dword [esi + 0x5c], eax
mov edx, dword [0x4a67bc]
mov eax, dword [0x4bca88]
inc eax
sub ecx, dword [edx + 0x70]
add eax, ecx
movzx ecx, bl
mov dword [0x4bca88], eax
mov eax, dword [esi + 0x34]
xor eax, dword [esi + 0x124]
sub eax, 0x1388dd
imul eax, dword [edx + 0xa0]
mov dword [edx + 0xa0], eax
mov eax, dword [esi + 0x10c]
sub eax, dword [esi + 0x7c]
add eax, 0x18c93f
xor dword [esi + 0x48], eax
mov eax, dword [0x4a67bc]
movzx edx, byte [eax + 0x80]
mov eax, dword [esi + 0xb8]
imul edx, ecx
mov ecx, dword [esi + 0x84]
mov byte [ecx + eax], dl
inc dword [esi + 0x84]
mov ecx, dword [0x4a67bc]
mov eax, dword [ecx + 0xdc]
add eax, dword [ecx + 0x70]
xor eax, 0x38
add dword [ecx + 0x78], eax
mov eax, dword [esi + 0x90]
xor eax, dword [esi + 0x48]
add dword [esi + 0xc4], eax
mov eax, dword [esi + 0xf4]
xor eax, 0xffe6b3e8
add dword [esi + 0x108], eax
mov ecx, dword [0x4a67bc]
mov eax, dword [esi + 0xfc]
sub dword [ecx + 0xa0], eax
mov eax, dword [0x4a67bc]
mov eax, dword [eax + 0x10c]
add dword [0x4bcad8], eax
mov eax, dword [0x4bca58]
sub eax, dword [esi + 0x118]
add eax, 0x2571e5
xor dword [esi + 0x34], eax
mov eax, dword [0x4a67bc]
mov ecx, dword [eax + 0x20]
inc ecx
imul ecx, dword [esi + 0xac]
mov dword [esi + 0xac], ecx
cmp ebp, 0x3b4c0
jl 0x41492c
cmp dword [esi + 0x48], 0x5cc
ja 0x414a88
mov eax, dword [0x4a67bc]
mov eax, dword [eax + 0xdc]
xor eax, 0x11b8
mov dword [esi + 0x80], eax
jmp 0x414ae2
mov eax, dword [esi + 0x44]
xor eax, 0x1acad
add eax, ecx
mov dword [esi + 0xac], eax
jmp 0x414ae2
mov eax, ecx
mov ecx, dword [esp + 0x18]
sub eax, dword [ecx + 0x7c]
cmp ebx, eax
je 0x414ae2
imul ebp, edi
mov edi, dword [esp + 0x28]
add edi, ebx
and edi, edx
mov eax, dword [0x4a67bc]
mov eax, dword [eax + 0x10c]
or eax, 0x19bd
imul eax, esi
push eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov eax, dword [esp + 0x18]
inc ebx
mov ecx, dword [esp + 0x20]
sub ecx, dword [eax + 0x7c]
cmp ebx, ecx
jne 0x414ab2
mov edi, dword [esp + 0x10]
xor edi, 0x1b8e
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x422420
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x65e96b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0064fbc9
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4224a2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0064c73f
mov eax, dword [eax]
push 0x74fd0c
push eax
call fcn.0063d744
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0064fe54
test bl, bl
je 0x4224a2
push 0x74fd0c
lea ecx, [esp + 0xc]
call fcn.006501e4
push 0x74fd18
lea ecx, [esp + 0xc]
call fcn.006501e4
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA_1]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4224de
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0064fe54
jmp 0x4225a9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA_1]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x422562
lea edx, [esp + 0x7c]
push 0x74fd14
push edx
call fcn.0063d744
add esp, 8
test eax, eax
je 0x422562
lea eax, [esp + 0x7c]
push 0x74fd10
push eax
call fcn.0063d744
add esp, 8
test eax, eax
je 0x422562
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA_1]
test eax, eax
jne 0x4224f2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose_1]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0064fe54
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x422db0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA_1]
mov esi, eax
test esi, esi
jne 0x422e12
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA_1]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey_1]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x422e20
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x65e9eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x7d7258]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x422f58
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x422e86
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0064fe54
xor eax, eax
jmp 0x422fcf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0064ff91
push esi
lea ecx, [esp + 0xc]
call fcn.00650220
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x74fd4c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA_1]
mov esi, eax
cmp esi, 0x20
ja 0x422fad
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push bind
call fcn.00422db0
test eax, eax
jne 0x422fad
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA_1]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push bind
mov ecx, edi
call fcn.00422db0
test eax, eax
jne 0x422fad
lea eax, [esp + 0x14]
push 0x74fd28
push eax
call fcn.0063e8b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x422f8c
lea ecx, [esp + 0x14]
push 0x74fd24
push ecx
call fcn.0063e830
mov esi, eax
add esp, 8
test esi, esi
jne 0x422f8c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA_1]
lea esi, [esp + eax + 0x13]
jmp 0x422f8f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0064ff41
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x422e9e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0064fe54
xor eax, eax
jmp 0x422fcf
mov byte [esi], 0
push 0x74fd20
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0064fe54
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4