joyce8/EMBER2024-capa huggingface dataset:
Function at 0x732ba6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x732b88

Function at 0x732bc5
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00732ba6
aaa
mov ebp, 0x1c7342d
pop es
mov ds, word [ebx + edi*2]
xchg esi, eax
and dword [edi + reloc.KERNEL32.dll_GetACP], ebx
lea edx, [edx + ebx]
mov cx, word [esp]
or edx, 0xa7ea1314
jne 0x732b61
je 0x732b61
sub ebp, 0x244c6682
xchg ch, cl
rdtsc
mov cl, 0x11
shl al, cl
jmp 0x732bda
mov ebx, ebp
lea edx, [esi*4]
sete ah
mov cx, word [esp]
mov ah, byte [esp]
jmp 0x732b77
jns 0x732bf0
shr dh, cl
jmp 0x732bf2
shr dh, cl
ror ebp, 0
bswap ecx
jmp 0x732cc8
sub esp, 0x12
and ax, ax
jmp 0x732c8c
pop dword [esp + 0xf]
jmp 0x732c65
pushal
mov byte [esp + 0x10], bl
push dword [esp + 0x1e]
jae 0x732c24
pop dword [esp + 0xf]
bsf eax, edx
jmp 0x732c70
mov dh, 0xa5
lea edx, reloc.KERNEL32.dll_GetACP
mov eax, ebx
lea ecx, reloc.KERNEL32.dll_GetACP
inc ebp
jmp 0x732c3a
bsf eax, edx
xchg ecx, edx
jmp 0x732c9c
xchg ecx, edx
jmp 0x732c9c
add ebp, dword [edi]
bts eax, ecx
jo 0x732cb0
mov ch, 0x6c
lea ecx, [ecx + edi]
bswap edx
jmp fcn.00732cf3
lea esp, [esp + 2]
lea esp, [esp + 0x10]
inc ebp
mov edx, 0x48ca1b24
jmp 0x732c52
lea esp, [esp + 0x20]
neg ebp
setbe dh
xchg edx, ecx
lea eax, [ebp*4]
jmp 0x732c74
mov ch, 0x6c
jmp 0x732d0c
btc eax, ecx
jp 0x732bfc
sub esp, 0x12
and ax, ax
lea esp, [esp + 2]
jmp 0x732c90
lea ecx, [ecx + edi]
bswap edx
jmp fcn.00732cf3

Function at 0x739752
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0723d64
jmp 0x739787
pop dword [esp]
mov word [esp + 1], si
jmp 0x739749
mov dword [esp + 0x14], esi
call fcn.007398b4
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x739874
rdtsc
jmp 0x739826
dec edx
je 0x739771
rdtsc
rdtsc
not ebp
jmp 0x73982a
lea esp, [esp + 2]
jmp 0x7397b2
mov ax, word [esp + 1]
jmp 0x739795
lea edi, [esp]
push si
sbb bh, bh
jo 0x7397f4
jno 0x7397de
jmp [ebp - 3]
push sp
lea ecx, [esp + eax]
neg ecx
jp 0x7397ab
mov ax, word [esp + 1]
lea esp, [esp + 2]
jmp 0x7397b2
mov word [esp], ax
lea esp, [esp + 2]
call fcn.00739846
inc edx
aam 0x4a
sub eax, 0x80c11edc
inc ebx
mov word [esp], ax
lea esp, [esp + 2]
sub esp, 0xc0
mov esi, esp
xchg ecx, edx
dec ebx
jmp 0x7398ed
or bh, 0x8f
mov ax, si
rdtsc
not ebp
mov ebp, dword [esp + 0x2c]
jmp 0x7397ca
pushfd
jmp 0x7389ce
ja 0x73980d
or bh, 0x8f
mov ax, si
jmp 0x739813

Function at 0x739846
Capabilities:
Execute anti-debugging instructions

Disassembly:
setb bl
rdtsc
rdtsc
xchg dword [esp], edi
bswap esi
mov esi, ecx
jmp 0x73984f
rcl cx, 0xd
mov bl, byte [esp]
jmp 0x739830
bswap eax
mov bh, byte [esp]
lea ebx, reloc.KERNEL32.dll_GetACP
lea edi, [edi + 0x11]
xchg si, dx
cpuid
jmp 0x739890
bswap ebx
lea edx, [eax*4]
xchg dword [esp], edi
call fcn.0073987a
jbe 0x739896
add byte [eax], al
add byte [edi - 0x2617dbc4], al
invalid
arpl word [esi], ax
cmc
insb byte es:[edi], dx
hlt

Function at 0x80c151
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
xchg di, si
xchg dword [esp + 7], esi
mov ebx, dword [esp + 0xa]
jmp 0x80c171
Function at 0x80d3fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr esi, ebx
mov dx, word [esp + 0xc]
mov ebp, dword [esp + 3]
btc edi, edi
mov byte [esp + 2], dh
jmp 0x80d451
or esi, edi
bsf ax, di
mov bx, 0xe79d
cld
push eax
mov bx, 0xc92e
jmp 0x80d47e
bsf esi, esp
setbe bl
push dword [esp + 0xd]
push word [esp + 0x10]
rdtsc
mov si, 0x1580
jmp 0x80d435
push word [esp + 8]
xchg esi, eax
dec bh
neg ax
xchg dword [esp + 4], eax
jmp 0x80d5f8
add esp, 0xf
sbb esi, 0xb80c238f
mov byte [esp + 4], dl
xchg byte [esp + 3], dh
mov ah, 0xb3
jmp 0x80d468
rdtsc
mov eax, 0xc06631ae
xchg word [esp + 5], cx
add esp, 7
xor cl, bh
call fcn.0080d52d
mov word [edx], cs
cwde
dec dword [edx]
jecxz 0x80d4fb
scasd eax, dword es:[edi]
aas
pop edx
test eax, 0xccfd4257
pop edi
cmpsb byte [esi], byte es:[edi]
pop word [esp + 0x10]
mov cx, word [esp + 3]
xchg cl, dl
rol bl, 4
cpuid
mov bx, 0xb7d8
jmp 0x80d4b0
sar byte [ebx], cl
fist dword [edi - 0x39]
mov byte [0xfe4abd51], al
retf
not esi
mov ecx, dword [esp]
xchg byte [esp + 3], ch
sub esp, 0x11
xchg edi, ecx
mov bp, 0xc48e
jmp 0x80d4d7
pop si
pop word [esp + 1]
xchg byte [esp + 4], dl
push word [esp + 6]
btc eax, esp
pop dword [esp]
jmp 0x80d56b

Function at 0x80d8ff
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb edx, 0xa2eb8a12
clc
mov eax, esp
jmp 0x80d922

Function at 0x80dc05
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebx*4]
lea eax, reloc.KERNEL32.dll_GetACP
jmp 0x80dc10
rdtsc
mov ax, word [esp]
shr esi, 0xe
clc
pop ebx
lea edi, [ecx*4]
jmp 0x80dbd5
neg esi
xchg dword [esp + 1], edx
pop ebx
bswap eax
jmp 0x80dbeb
mov word [esp], ax
lea esi, [edi + edi]
stc
xchg dx, di
rcl bp, 0xf
mov word [esp], di
jmp 0x80dce0
rcr bp, cl
neg dh
setne ch
mov dx, 0xbff7
neg ah
dec bp
jmp 0x80dc97
xchg word [esp], bp
mov al, bh
mov word [esp], sp
bsr ecx, edx
dec edi
mov word [esp], bp
jmp 0x80dc4d
lea eax, [edx + ebx]
mov bx, word [esp + 1]
rcr ebx, cl
rol ch, 2
mov ebp, 0x67effd72
lea ecx, [esp + ebx]
jmp 0x80dcc0
xchg byte [esp], ch
mov ecx, esp
mov byte [esp], dh
mov word [esp], bp
add ch, 0x7d
bswap edx
jmp 0x80dc77
bt ecx, ecx
xchg dh, al
lea ebp, [ecx + 0x44]
not edx
rdtsc
xchg word [esp], di
jmp 0x80dd0b
mov byte [esp], dh
mov ecx, esi
xchg cx, di
mov ebp, 0xa0700042
not edi
rdtsc
jmp 0x80dcaa
lea ebp, reloc.KERNEL32.dll_GetACP
adc ebp, ebx
bswap ebp
xchg edx, eax
rdtsc
xchg byte [esp], dl
jmp 0x80dc63
btr edi, edx
not si
rdtsc
neg ebx
mov ebp, dword [esp]
jmp 0x80dd37
neg esi
lea esp, [esp + 1]
cpuid
mov ecx, 0x7f8f9b6f
mov ecx, dword [esp]
mov si, word [esp]
jmp 0x80dcf5
mov bx, 0xcf2f
mov byte [esp], bl
bswap ebp
lea esp, [esp + 1]
popal
call fcn.0080dd21
push ebx
mov dword [esp], eax
call fcn.0080dd74
inc edi
lds edx, [ebp + 0x3c]
iretd

Function at 0x80de2a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
call fcn.0080be20
mov byte [esp + 1], cl
pushfd
push cx
pop dword [esp]
jmp 0x80df44
mov eax, dword [eax + 8]
jmp 0x80deb6
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x80de46
push eax
jmp 0x80be1b
lea esp, [esp + 2]
mov dword [esp + 4], edi
lea esp, [esp + 4]
mov eax, dword fs:[0x30]
jmp 0x80de5c
Function at 0x41ba58
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41ba5e
ret

Function at 0x426bac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x426d5d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004044fc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x426d74
call fcn.00404158
mov eax, ebx
call fcn.004199fc
mov edi, eax
dec edi
test edi, edi
jl 0x426c64
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004199d0
mov edx, dword [0x42b70c]
call fcn.00403288
test al, al
je 0x426c60
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.004199d0
lea edx, [ebp - 0x14]
call fcn.00433a80
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004044fc
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041cc
inc esi
dec edi
jne 0x426c12
mov al, byte [0x426d78]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x426d84
mov eax, dword [ebp - 0xc]
call fcn.0040c780
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00403ee4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00433a80
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x426d74
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + reloc.kernel32.dll_DeleteCriticalSection]
call fcn.00433a80
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x426d74
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x426d74
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x426d90
call fcn.00408af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426d64
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00403e70
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403e70
lea eax, [ebp - 0x14]
call fcn.00403e4c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403e70
ret
Function at 0x455b34
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
xor eax, eax
mov edx, 0x45dc44
mov dword [esp], eax
mov eax, 0x45add0
xor ecx, ecx
mov cl, byte [eax]
inc eax
mov cl, byte [ecx + 0x45dc04]
mov byte [edx], cl
inc edx
inc dword [esp]
cmp dword [esp], 0x38
jl 0x455b49
xor eax, eax
mov esi, 0x45adc0
mov dword [esp], eax
mov dword [esp + 0xc], 0x45dcfc
xor eax, eax
xor edx, edx
mov al, byte [0x45dc44]
mov dl, byte [0x45dc45]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov edx, 0x45dc44
xor eax, eax
mov ecx, esi
jmp 0x455b9b
mov bl, byte [edx + edi]
inc eax
mov byte [edx], bl
inc edx
movzx edi, byte [ecx]
mov ebx, 0x1c
sub ebx, edi
cmp eax, ebx
jl 0x455b94
cmp byte [esi], 2
jne 0x455bc3
mov al, byte [esp + 4]
mov byte [0x45dc5e], al
mov dl, byte [esp + 8]
mov byte [0x45dc5f], dl
jmp 0x455bcd
mov cl, byte [esp + 4]
mov byte [0x45dc5f], cl
xor eax, eax
xor edx, edx
mov al, byte [0x45dc60]
mov dl, byte [0x45dc61]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov edx, 0x45dc60
mov eax, 0x1c
mov ecx, esi
jmp 0x455bf9
mov bl, byte [edx + edi]
inc eax
mov byte [edx], bl
inc edx
movzx edi, byte [ecx]
mov ebx, 0x38
sub ebx, edi
cmp eax, ebx
jl 0x455bf2
cmp byte [esi], 2
jne 0x455c21
mov al, byte [esp + 4]
mov byte [0x45dc7a], al
mov dl, byte [esp + 8]
mov byte [0x45dc7b], dl
jmp 0x455c2b
mov cl, byte [esp + 4]
mov byte [0x45dc7b], cl
xor eax, eax
mov edx, dword [esp + 0xc]
mov ecx, edx
mov edx, 0x45ae08
xor ebx, ebx
inc eax
mov bl, byte [edx]
inc edx
mov bl, byte [ebx + 0x45dc44]
mov byte [ecx], bl
inc ecx
cmp eax, 0x30
jl 0x455c38
inc dword [esp]
add dword [esp + 0xc], 0x30
inc esi
cmp dword [esp], 0x10
jl 0x455b72
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x690d8d
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0068f4cc
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x68f4c7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x690c72
lea esp, [esp + 3]
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
jmp 0x690c98

Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x518
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x514], eax
push ebp
mov ebp, dword [esp + 0x520]
push esi
push edi
mov ecx, 5
mov esi, str.SOFTWARETencentQDesk
lea edi, [esp + 0x120]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x3e9
lea eax, [esp + 0x13b]
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.004016aa
push 0x104
lea ecx, [esp + 0x29]
push 0
push ecx
mov byte [esp + 0x30], 0
call fcn.004016aa
add esp, 0x18
lea edx, [esp + 0xc]
push edx
push 1
push 0
lea eax, [esp + 0x12c]
push eax
push 0x80000002
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x104
call dword [0x402004]
test eax, eax
jne 0x4010c5
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push str.InstallDir
push ecx
call dword [section..rdata]
mov edx, dword [esp + 0xc]
push edx
call dword [0x402008]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4010d0
sub eax, edx
add eax, 1
push eax
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [0x40204c]
push 2
push 0x4020a8
push ebp
call dword [0x402050]
mov ecx, dword [esp + 0x538]
add esp, 0x18
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00401590
add esp, 0x518
ret
Function at 0x41bd10
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47a0db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046e964
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41bd92
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046c6da
mov eax, dword [eax]
push 0x4921e4
push eax
call fcn.0045f3b4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046ebef
test bl, bl
je 0x41bd92
push 0x4921e4
lea ecx, [esp + 0xc]
call fcn.0046ef7f
push 0x495d5c
lea ecx, [esp + 0xc]
call fcn.0046ef7f
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41bdce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046ebef
jmp 0x41be99
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41be52
lea edx, [esp + 0x7c]
push 0x495d58
push edx
call fcn.0045f3b4
add esp, 8
test eax, eax
je 0x41be52
lea eax, [esp + 0x7c]
push 0x495d54
push eax
call fcn.0045f3b4
add esp, 8
test eax, eax
je 0x41be52
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41bde2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046ebef
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41c6b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41c712
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x41c720
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47a15b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x49c574]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x41c858
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x41c786
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046ebef
xor eax, eax
jmp 0x41c8cf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046ed2c
push esi
lea ecx, [esp + 0xc]
call fcn.0046efbb
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41c8ad
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.0041c6b0
test eax, eax
jne 0x41c8ad
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.0041c6b0
test eax, eax
jne 0x41c8ad
lea eax, [esp + 0x14]
push 0x495d70
push eax
call fcn.004604c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41c88c
lea ecx, [esp + 0x14]
push 0x495d6c
push ecx
call fcn.00460440
mov esi, eax
add esp, 8
test esi, esi
jne 0x41c88c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41c88f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046ecdc
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41c79e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046ebef
xor eax, eax
jmp 0x41c8cf
mov byte [esi], 0
push 0x495d68
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046ebef
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x42f760
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x42f7ce
cmp si, 0x69
ja 0x42f7ce
add esi, 0xffd0
cmp si, 0x11
je 0x42f79e
push 0x11
call edi
test ax, ax
jge 0x42f79e
or esi, 0x2000
cmp si, 0x10
je 0x42f7b3
push 0x10
call edi
test ax, ax
jge 0x42f7b3
or esi, 0x4000
cmp si, 0x12
je 0x42f7c8
push 0x12
call edi
test ax, ax
jge 0x42f7c8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x42f7db
mov esi, 0xbd
jmp 0x42f78f
cmp si, 0x6e
jne 0x42f7e8
mov esi, 0xbe
jmp 0x42f78f
cmp si, 0x6f
jne 0x42f789
mov esi, 0xbf
jmp 0x42f78f

Function at 0x431020
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4acc10]
xor edx, edx
cmp eax, edx
jne 0x431046
xor eax, eax
mov byte [eax + 0x4acb10], al
inc eax
cmp eax, 0x100
jl 0x43102e
mov dword [0x4acc10], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4acb10
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4310d7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4310aa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x431078
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x431150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4311a3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x43118a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437be0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x437d78
cmp ebp, ebx
jle 0x437d78
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x437c3e
dec eax
or eax, 0xfffffff8
inc eax
je 0x437c45
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, reloc.WS2_32.dll_accept
jns 0x437c54
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x437c5b
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.0046e930
add esp, 4
cmp eax, ebx
je 0x437c7c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.0046e930
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x437d6e
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x437d55
mov al, byte [edx]
cmp al, 0xc0
jbe 0x437d41
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x437d36
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x437d44
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x437d44
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x437ce0
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x437cd1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x43adb0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47b9c8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
test edi, edi
jne 0x43ade9
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
push 0x400
lea ecx, [esp + 0xc]
call fcn.00476307
mov eax, dword [esp + 0x40]
push 0
push edi
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call fcn.00476353
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.0043ae70
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.00476390
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24