joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e4f
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [0x40d014]
test ecx, ecx
je 0x401e05
push eax
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
test byte [eax + 0x502740d2], al
push es
dec edi
add cl, 0x40
add byte [ebx + 0xeeb0cc4], al
push 0x40d296
mov edx, 0x74c16415
add byte [esi + 0x5a104c4], bh
add al, byte [ecx]
test eax, eax
je 0x401e28
fist word [ebx]
pop ebp
add byte [edi + 0x5e], bl
pop ebx
mov esp, ebp
pop ebp
cmpsd dword [esi], dword es:[edi]
push 0
call fcn.00402060
add esp, 4
daa
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movsb byte es:[edi], byte [esi]
mov ebp, esp
sub esp, 0x78
push esi
mov esi, dword [ebp + 0xc]
push esi
lea eax, [ebp - 0x78]
add eax, 0xe8035078
js 0x401ea1
add ebp, eax
mov dword [eax], ebp
add byte [ebx + 0x158b084d], cl
enter 0xfffffffffffff2c0, 0xffffffffffffff9f
push eax
push ecx
add edx, 0x40
push 0x14d4ac
push edx
call 0x5a019e85
add byte [esi - 0x2e], dl
add al, byte [ecx]
add esp, 0x14
or eax, eax
je 0x401e8c
push eax
push 0x9cd254
lds edx, [0x2217c164]
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
nop
test al, 0x90
nop
nop
stosb byte es:[edi], al
nop
nop
nop
nop
push ebp
mov ebp, esp
xlatb
in al, dx
adc al, 0x53
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x14]
mov dword [eax + ecx], ebx
call 0xf3404c00
mov dword [0xf7410be5], eax
jb 0x401ed3
movsb byte es:[edi], byte [esi]
lodsb al, byte [esi]
lodsb al, byte [esi]
add byte [ebx + 0x14468bd8], cl
test dword [ecx - 0x75], ecx
cli
jne 0x401f0d
mov ecx, dword [esi + 4]
push 0
push 0
push ecx
xchg edi, eax
add byte [ecx - 0x69], dl
xchg esi, eax
insd dword es:[edi], dx
add byte [eax], al
sahf
cmp byte [eax], cl
int 0xb0
mov dword [esi - 0x7fff4c4], edi
mov dword [esi + 0x18], 0x2e0d00
mov edx, dword [0xda17ec]
mov edx, esp
adc al, 0xa1
rol dword [edx], cl
inc ecx
add byte [ebp - 0x5ec48b40], al
jo 0x401f04
inc ecx
add byte [ebx - 0x76375f84], cl
dec esi
adc al, 0xeb
cli
mov edi, dword [eax - 0x38]
mov dword [esi + 0x14], ecx
enter 0x4e89, 0x14
jmp 0x401f07
mov edi, ebx
cmp byte [eax], cl
add byte [eax], al
inc eax
sub al, dl
push ds
add byte [ebx + 0x40082c47], cl
cmp al, 3
jbe 0x401f8c
xchg ah, bh
sub al, byte [eax]
dec eax
adc edx, dword [ebx + 0x76]
and edx, ecx
invalid
or byte [eax], ch
movsd dword es:[edi], dword [esi]
loopne 0x401f93
inc ecx
add byte [edi + 0x4141a49a], cl
add byte [ebx], al
fadd dword [ebx + 0x1d894fd7]
mov al, byte [0x89004102]
cmp eax, 0x4102a4
mov edx, dword [esi - 0x58]
mov ecx, dword [esi + 0x14]
add edx, eax
add eax, 0x393eb5c8
mov dword [esi + 6], ecx
jne 0x401de1
invalid
imul eax, dword [esi + 8], 0x370000a7
call 0xfdd600
mov dword [0xad15b1a0], eax
dec esi
adc eax, 0x410ba4
rcr dword [ebx], 1
add al, 0x89
xchg byte [eax + 8], al
add byte [eax], al
in eax, dx
cmc
sbb ecx, dword [ebx]
inc ecx
add byte [eax + 0xd10001], bh
xor al, 0xa2
invalid
Function at 0x403860
Capabilities:
Packed with generic packer

Disassembly:
push edx
push ebx
push edi
push edi
push eax
push str._tr__s__th__s_Total:__th__td__s__5I64d__td__td__s__5I64d__td__td__s__5I64d__td___tr__n
call esi
add esp, 0x30
push 0xeedfb8
call esi
jo 0x403872
add al, 0x5f
pop esi
pop ebx
mov esp, ebp
pop ebp
not byte [eax - 0x74aa6f70]
in al, dx
fsub st(4), st(0)
adc al, 0x6b
test al, 2
fld dword [eax]
mov ecx, dword [0x40d010]
push ebx
cmp edi, dword [ebx]
sar esi, 0x78
invalid

Function at 0x40a340
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x13]
push esi
in al, dx
inc ecx
add al, 0x85
sal byte [ebp + 0x11], 0x83
ror dword [ecx + edx*2], 0x3d
adc eax, 0xbf7c02c
xor eax, eax
ja 0x40a3b9
ret 0x8e
nop
nop
nop
nop
nop
nop
salc
xor eax, eax
dec edi
add al, 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ecx

Function at 0x40b080
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
nop
nop
push ebp
mov ebp, esp
push esi
add byte [ebx + 8], cl
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov esi, 0x102e75c1
add byte [edx], dl
add dh, ch
mov esi, 0x84a9071
test al, al
je 0x40b10d
mov edx, dword [esi + 4]
ror byte [ebp + 8], cl
sub al, 0
push ecx
push 0
push 0xffffffffffffffb6
push 0xffffffffffffff86
push edx
call dword [0x62c00c]
test dword [edi + 0x5f], esi
xor eax, 0xc0981c8b
inc eax
add byte [0x75c026d6], dl
or dword [ebx + 0x5e5f144d], ecx
mov dword [ecx + 0x79], eax
idiv edi
sub byte [0xafc80], al
cmp eax, 0xafced
jne 0x40b0ae
mov eax, 0x1117e
mov ecx, dword [ebp + 0x14]
pop edi
pop esi
mov dword [ecx], 0
xchg ebx, eax
jnp 0x40b07e
inc ebp
sub cl, byte [edi + 0x15]
jne 0x40b107
mov edx, dword [ebp + 0x14]
aas
pop esi
mov dword [eax - 0x48], ebx
or eax, dword [eax]
add byte [eax], al
pop ebp
ret
cmp esp, dword [esi + esi*2 - 0x7407e2fe]
loopne 0x40b11c
mov esp, eax
or al, 0x85
sal byte [ebx - 0x76], 0x4e
or byte [eax - 0x9e38a09], dl
test eax, eax
je 0x40b137
mov cl, byte [esi + 8]
nop
div dword [ebp + 0x1c]
imul byte [eax + edx*2]
sub al, 0x50
mov dword [eax + 8], ecx
or al, byte [esi + 0x50]
mov esi, dword [edi + 0x20b954]
add byte [eax], al
call 0x98411f75
mov edx, dword [esi + 0xc]
mov dword [esp + ecx - 0x74f3b975], esi
push ebp
or al, 0x53
mov eax, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
push ebx
lea ecx, [ebp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
push edi
mov byte [0x1074ff50], al
outsd dx, dword [esi]
inc eax
add byte [ecx - 0x40], dl
mov cl, 7
xor edi, ebx
jmp 0x40b2ca
nop
nop
add al, 0x90
and cl, byte [0x51e28bd1]
ror dword [ebx - 0x4e00ae1e], 1
jne 0x40b2e0
mov al, byte [esi + 0x2c]
test al, al
je 0xe740b3a1
invalid
Function at 0x407d5d
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x41ae86
call fcn.0040e769
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
mov edi, ecx
cmp ebx, esi
jne 0x407d7f
xor eax, eax
call fcn.0040e7b3
ret 4
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x407da5
mov eax, dword [edi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x407da5
dec dword [eax]
mov edi, dword [edi + 0x24]
mov eax, dword [edi]
lea ecx, [eax + 1]
mov dword [edi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x407d77
cmp dword [edi + 0x54], 0
jne 0x407daf
mov eax, esi
jmp 0x407d77
mov eax, edi
call fcn.004085b3
cmp dword [edi + 0x44], 0
jne 0x407dd2
push dword [edi + 0x54]
movsx eax, bl
push eax
call fcn.0040cf20
pop ecx
cmp eax, esi
pop ecx
mov eax, ebx
jne 0x407d77
jmp 0x407dab
lea esi, [ebp - 0x2c]
mov byte [ebp - 0x2d], bl
call fcn.004083b9
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x407e80
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
mov ebx, dword [ebp - 0x1c]
add ebx, eax
push ebx
push edx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x2d]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x14]
test eax, eax
js 0x407ea8
cmp eax, 1
jg 0x407e88
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x407e2f
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
sub esi, eax
je 0x407e55
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x407e42
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0040dbe4
add esp, 0x10
cmp esi, eax
jne 0x407ea8
lea eax, [ebp - 0x2d]
mov byte [edi + 0x49], 1
cmp dword [ebp - 0x38], eax
jne 0x407ea3
test esi, esi
jne 0x407de1
cmp dword [ebp - 0x1c], 0x20
jae 0x407ea8
push esi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.00401567
jmp 0x407de1
mov edx, dword [ebp - 0x2c]
jmp 0x407df3
cmp eax, 3
jne 0x407ea8
movsx eax, byte [ebp - 0x2d]
push dword [edi + 0x54]
push eax
call fcn.0040cf20
or esi, 0xffffffff
pop ecx
pop ecx
cmp eax, esi
je 0x407eab
mov esi, dword [ebp + 8]
jmp 0x407eab
or esi, 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004015bb
jmp 0x407dab
Function at 0x4084ca
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x41afa1
call fcn.0040e769
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x4085ab
cmp byte [edi + 0x49], bl
je 0x4085ab
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4084ff
xor al, al
jmp 0x4085ad
lea esi, [ebp - 0x2c]
call fcn.004083b9
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40854d
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x408552
dec eax
je 0x408556
dec eax
dec eax
je 0x4085a7
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004015bb
mov al, bl
jmp 0x4085ad
mov edx, dword [ebp - 0x2c]
jmp 0x408518
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x408562
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x408588
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x408575
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0040dbe4
add esp, 0x10
cmp esi, eax
jne 0x40853b
cmp byte [edi + 0x49], 0
je 0x4085a7
test esi, esi
jne 0x40850a
push esi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.00401567
jmp 0x40850a
mov bl, 1
jmp 0x40853d
mov al, 1
call fcn.0040e7b3
ret
Function at 0x409370
Capabilities:
Accept command line arguments

Disassembly:
push 0x2b0
mov eax, 0x41b1e4
call fcn.0040e769
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2ac], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x238]
call fcn.004014cb
xor esi, esi
xor eax, eax
mov dword [ebp - 4], esi
mov word [ebp - 0x21c], ax
push 0x104
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [ebp - 0x21c], si
je 0x40942b
lea eax, [ebp - 0x21c]
push eax
call fcn.0040cbb7
pop ecx
push eax
lea eax, [ebp - 0x21c]
push eax
xor eax, eax
lea ecx, [ebp - 0x238]
call fcn.00401745
cmp eax, 0xffffffff
je 0x40942b
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x238]
push eax
lea esi, [ebp - 0x270]
call fcn.0040995d
mov ebx, eax
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 1
call fcn.004015fd
push 1
xor edi, edi
mov byte [ebp - 4], 0
call fcn.004017e3
mov edi, 0x4211cc
push edi
call fcn.0040cbb7
pop ecx
push eax
push edi
xor eax, eax
lea ecx, [ebp - 0x238]
call fcn.00401745
mov esi, eax
cmp esi, 0xffffffff
je 0x4095d9
mov dword [ebp - 0x2b4], 0x3d
jmp 0x409468
mov esi, dword [ebp - 0x2b0]
mov edi, 0x4211cc
push 1
lea eax, [ebp - 0x2b4]
add esi, 2
push eax
mov eax, esi
lea ecx, [ebp - 0x238]
call fcn.00401745
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4095d9
sub eax, esi
push eax
push esi
lea eax, [ebp - 0x238]
push eax
lea esi, [ebp - 0x270]
call fcn.0040995d
push edi
inc ebx
call fcn.0040cbb7
pop ecx
push eax
push edi
mov eax, ebx
lea ecx, [ebp - 0x238]
call fcn.00401745
and dword [ebp - 0x244], 0
xor ecx, ecx
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], cx
mov byte [ebp - 4], 3
lea esi, [ebp - 0x28c]
cmp eax, 0xffffffff
je 0x4094fe
sub eax, ebx
push eax
push ebx
lea eax, [ebp - 0x238]
push eax
call fcn.0040995d
mov byte [ebp - 4], 4
jmp 0x409511
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x238]
push eax
call fcn.0040995d
mov byte [ebp - 4], 5
mov ebx, eax
lea eax, [ebp - 0x254]
call fcn.004015fd
push 1
xor edi, edi
lea esi, [ebp - 0x28c]
mov byte [ebp - 4], 3
call fcn.004017e3
lea esi, [ebp - 0x254]
call fcn.00408e89
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.004016ab
lea eax, [ebp - 0x270]
push eax
lea esi, [ebp - 0x2a8]
call fcn.004098f2
lea eax, [ebp - 0x254]
push eax
lea esi, [ebp - 0x28c]
mov byte [ebp - 4], 6
call fcn.004098f2
mov edx, dword [ebp - 0x2ac]
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 7
call fcn.00409cbc
push eax
push dword [ebp - 0x2ac]
lea esi, [ebp - 0x2bc]
call fcn.00409a5b
xor ebx, ebx
inc ebx
push ebx
lea esi, [ebp - 0x28c]
call fcn.004017e3
push ebx
lea esi, [ebp - 0x2a8]
call fcn.004017e3
push ebx
lea esi, [ebp - 0x254]
call fcn.004017e3
push ebx
lea esi, [ebp - 0x270]
mov byte [ebp - 4], 0
call fcn.004017e3
cmp dword [ebp - 0x2b0], 0xffffffff
jne 0x40945d
push 1
xor edi, edi
lea esi, [ebp - 0x238]
call fcn.004017e3
call fcn.0040e7b3
ret 4

Function at 0x40aa32
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425494]
jne 0x40aa3c
repz ret
jmp fcn.00410b72
Function at 0x41950d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x425494]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00411807
and dword [ebp - 0x14], 0
cmp dword [0x427224], 0
mov dword [ebp - 0x18], eax
jne 0x4195c0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x419668
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x419668
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x427224], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x427228], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42722c], eax
call edi
push eax
call esi
mov dword [0x427234], eax
test eax, eax
je 0x4195c0
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x427230], eax
mov eax, dword [0x427230]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x419619
cmp dword [0x427234], ecx
je 0x419619
push eax
call esi
push dword [0x427234]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x419619
test ebx, ebx
je 0x419619
call edi
test eax, eax
je 0x419610
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x419610
test byte [ebp - 8], 1
jne 0x419619
or dword [ebp + 0x10], 0x200000
jmp 0x41964c
mov eax, dword [0x427228]
cmp eax, dword [ebp - 0x18]
je 0x41964c
push eax
call esi
test eax, eax
je 0x41964c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41964c
mov eax, dword [0x42722c]
cmp eax, dword [ebp - 0x18]
je 0x41964c
push eax
call esi
test eax, eax
je 0x41964c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x427224]
call esi
test eax, eax
je 0x419668
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41966a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aa32
leave
ret
Function at 0x408840
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47b6ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047031c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4088c2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046e1f6
mov eax, dword [eax]
push 0x497c6c
push eax
call fcn.00460e74
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004705a7
test bl, bl
je 0x4088c2
push 0x497c6c
lea ecx, [esp + 0xc]
call fcn.00470937
push 0x497c78
lea ecx, [esp + 0xc]
call fcn.00470937
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4088fe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004705a7
jmp 0x4089c9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x408982
lea edx, [esp + 0x7c]
push 0x497c74
push edx
call fcn.00460e74
add esp, 8
test eax, eax
je 0x408982
lea eax, [esp + 0x7c]
push 0x497c70
push eax
call fcn.00460e74
add esp, 8
test eax, eax
je 0x408982
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408912
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004705a7
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4091d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x409232
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x409240
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47b72b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4a15ac]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x409378
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4092a6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004705a7
xor eax, eax
jmp 0x4093ef
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004706e4
push esi
lea ecx, [esp + 0xc]
call fcn.00470973
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4093cd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.004091d0
test eax, eax
jne 0x4093cd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.004091d0
test eax, eax
jne 0x4093cd
lea eax, [esp + 0x14]
push 0x497c88
push eax
call fcn.00461ef0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4093ac
lea ecx, [esp + 0x14]
push 0x497c84
push ecx
call fcn.00461e70
mov esi, eax
add esp, 8
test esi, esi
jne 0x4093ac
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4093af
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00470694
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4092be
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004705a7
xor eax, eax
jmp 0x4093ef
mov byte [esi], 0
push 0x497c80
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004705a7
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x419d70
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x419dde
cmp si, 0x69
ja 0x419dde
add esi, 0xffd0
cmp si, 0x11
je 0x419dae
push 0x11
call edi
test ax, ax
jge 0x419dae
or esi, 0x2000
cmp si, 0x10
je 0x419dc3
push 0x10
call edi
test ax, ax
jge 0x419dc3
or esi, 0x4000
cmp si, 0x12
je 0x419dd8
push 0x12
call edi
test ax, ax
jge 0x419dd8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x419deb
mov esi, 0xbd
jmp 0x419d9f
cmp si, 0x6e
jne 0x419df8
mov esi, 0xbe
jmp 0x419d9f
cmp si, 0x6f
jne 0x419d99
mov esi, 0xbf
jmp 0x419d9f

Function at 0x41b630
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4b1d10]
xor edx, edx
cmp eax, edx
jne 0x41b656
xor eax, eax
mov byte [eax + 0x4b1c10], al
inc eax
cmp eax, 0x100
jl 0x41b63e
mov dword [0x4b1d10], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4b1c10
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41b6e7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41b6ba
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41b688
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41b760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41b7b3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41b79a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret