joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb888ab
Capabilities:
Encode data using base64

Disassembly:
call fcn.00b886cd
jmp 0xb888c7
lea esp, [esp + 4]
jmp 0xb88a87
jmp 0xb888ff
jmp 0xb8891b
push ebp
jmp 0xb88937
jmp 0xb88953
mov ebp, esp
jmp 0xb8896f
jmp 0xb8898b
movzx eax, byte [ecx]
jmp 0xb889a7
jmp 0xb889c3
shl eax, 0x10
jmp 0xb889df
jmp 0xb889fb
cmp dword [ebp + 0xc], 2
jmp 0xb88a33
jmp 0xbd2573
jmp 0xb88a4f
jb 0xb88a17
jae 0xb88a6b
push ecx
add dword [ecx], esp
xor ch, byte [ebx + 0x41ad5e3b]
ret 0xc456
jmp 0xbd2595
jmp 0xb888e3
jmp 0xb888a6
push ebx
push esi
jmp 0xbd25e3
cmp dword [ebp + 0xc], 3
jne 0xbd2556
movzx ecx, byte [ecx + 2]
jmp 0xbd2661
movzx edx, byte [ecx + 1]
shl edx, 8
or eax, edx
jmp 0xb88a17
mov edi, dword [ebp + 0xc]
jmp 0xbd2625
mov ebx, dword [ebp + 0xc]
jmp 0xbd2668
cmp ecx, 0x34
jae 0xbd283d
jb 0xbd26fe
int 0x5a
enter 0x5aaf, 0xffffffffffffffb0
dec esi
fimul dword [eax + 0x2f]
fidiv dword [edx]
xor dword [edi + 0x5705ccf4], 0x3f6ac88b
push edi
mov ecx, eax
push 0x3f
mov esi, eax
shr ecx, 0x12
pop edx
shr esi, 0xc
and ecx, edx
and esi, edx
cmp dword [ebp + 0xc], 2
jb 0xbd25b4
mov edi, eax
shr edi, 6
and edi, edx
jmp 0xbd2625
cmp dword [ebp + 0xc], 3
jne 0xbd25b9
and eax, edx
mov ebx, eax
jmp 0xbd2668
or eax, ecx
jmp 0xbd2556
push 0x3e
pop eax
cmp ecx, 0x1a
jae 0xbd25c3
lea edx, [ecx + 0x41]
jmp 0xbd29a5
xor edx, edx
cmp ecx, eax
jmp 0xbd2719
lea edx, [ecx + 0x47]
jmp 0xbd29a5
setne dl
lea edx, [edx*4 + 0x2b]
jmp 0xbd29a5
cmp dword [ebp + 0xc], 2
mov edx, dword [ebp + 8]
mov byte [edx + 1], cl
jmp 0xbd285f
cmp esi, 0x34
jmp 0xbd281e
cmp esi, eax
jae 0xbd27ed
lea ecx, [esi - 4]
jmp 0xbd2731
lea ecx, [esi + 0x47]
jmp 0xbd2731
xor ecx, ecx
cmp esi, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0xbd2731
mov byte [edx + 2], 0x3d
jmp fcn.00bd2a3d
jae 0xbd2770
jb 0xbd27cf
xchg ebx, eax
or ebx, dword [ebx - 0x6916f202]
pop es
xchg edi, eax
add ebp, esp
inc ebx
aad 0x45
sub al, 0xdf
xor eax, 0xb2cb543f
leave
cmp ecx, eax
jae 0xbd269d
lea edx, [ecx - 4]
jmp 0xbd29a5
jb 0xbd2800
cmp edi, 0x1a
jae 0xbd28b2
lea ecx, [edi + 0x41]
jmp 0xbd2958
cmp edi, 0x34
jae 0xbd292f
lea ecx, [edi + 0x47]
jmp 0xbd2958
xor ecx, ecx
cmp edi, eax
jmp 0xbd297f
cmp edi, eax
jae 0xbd28ef
lea ecx, [edi - 4]
jmp 0xbd2958
mov byte [edx + 2], cl
jmp fcn.00bd2a3d
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0xbd2958
mov ecx, dword [ebp + 8]
mov byte [ecx], dl
cmp esi, 0x1a
jae 0xbd2754
lea ecx, [esi + 0x41]
jmp 0xbd2731

Function at 0xb896ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0xbd3aad
lea esp, [esp + 4]
jmp fcn.00bd3a51
Function at 0xbbfecd
Capabilities:
Encode data using base64

Disassembly:
call fcn.00b886cd
jmp 0xb888c7
lea esp, [esp + 4]
jmp 0xb88a87
jmp 0xb888ff
jmp 0xb8891b
push ebp
jmp 0xb88937
jmp 0xb88953
mov ebp, esp
jmp 0xb8896f
jmp 0xb8898b
movzx eax, byte [ecx]
jmp 0xb889a7
jmp 0xb889c3
shl eax, 0x10
jmp 0xb889df
jmp 0xb889fb
cmp dword [ebp + 0xc], 2
jmp 0xb88a33
jmp 0xbd2573
jmp 0xb88a4f
jb 0xb88a17
jae 0xb88a6b
push ecx
add dword [ecx], esp
xor ch, byte [ebx + 0x41ad5e3b]
ret 0xc456
jmp 0xbd2595
jmp 0xb888e3
jmp 0xb888a6
push ebx
push esi
jmp 0xbd25e3
cmp dword [ebp + 0xc], 3
jne 0xbd2556
movzx ecx, byte [ecx + 2]
jmp 0xbd2661
movzx edx, byte [ecx + 1]
shl edx, 8
or eax, edx
jmp 0xb88a17
mov edi, dword [ebp + 0xc]
jmp 0xbd2625
mov ebx, dword [ebp + 0xc]
jmp 0xbd2668
cmp ecx, 0x34
jae 0xbd283d
jb 0xbd26fe
int 0x5a
enter 0x5aaf, 0xffffffffffffffb0
dec esi
fimul dword [eax + 0x2f]
fidiv dword [edx]
xor dword [edi + 0x5705ccf4], 0x3f6ac88b
push edi
mov ecx, eax
push 0x3f
mov esi, eax
shr ecx, 0x12
pop edx
shr esi, 0xc
and ecx, edx
and esi, edx
cmp dword [ebp + 0xc], 2
jb 0xbd25b4
mov edi, eax
shr edi, 6
and edi, edx
jmp 0xbd2625
cmp dword [ebp + 0xc], 3
jne 0xbd25b9
and eax, edx
mov ebx, eax
jmp 0xbd2668
or eax, ecx
jmp 0xbd2556
push 0x3e
pop eax
cmp ecx, 0x1a
jae 0xbd25c3
lea edx, [ecx + 0x41]
jmp 0xbd29a5
xor edx, edx
cmp ecx, eax
jmp 0xbd2719
lea edx, [ecx + 0x47]
jmp 0xbd29a5
setne dl
lea edx, [edx*4 + 0x2b]
jmp 0xbd29a5
cmp dword [ebp + 0xc], 2
mov edx, dword [ebp + 8]
mov byte [edx + 1], cl
jmp 0xbd285f
cmp esi, 0x34
jmp 0xbd281e
cmp esi, eax
jae 0xbd27ed
lea ecx, [esi - 4]
jmp 0xbd2731
lea ecx, [esi + 0x47]
jmp 0xbd2731
xor ecx, ecx
cmp esi, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0xbd2731
mov byte [edx + 2], 0x3d
jmp fcn.00bd2a3d
jae 0xbd2770
jb 0xbd27cf
xchg ebx, eax
or ebx, dword [ebx - 0x6916f202]
pop es
xchg edi, eax
add ebp, esp
inc ebx
aad 0x45
sub al, 0xdf
xor eax, 0xb2cb543f
leave
cmp ecx, eax
jae 0xbd269d
lea edx, [ecx - 4]
jmp 0xbd29a5
jb 0xbd2800
cmp edi, 0x1a
jae 0xbd28b2
lea ecx, [edi + 0x41]
jmp 0xbd2958
cmp edi, 0x34
jae 0xbd292f
lea ecx, [edi + 0x47]
jmp 0xbd2958
xor ecx, ecx
cmp edi, eax
jmp 0xbd297f
cmp edi, eax
jae 0xbd28ef
lea ecx, [edi - 4]
jmp 0xbd2958
mov byte [edx + 2], cl
jmp fcn.00bd2a3d
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0xbd2958
mov ecx, dword [ebp + 8]
mov byte [ecx], dl
cmp esi, 0x1a
jae 0xbd2754
lea ecx, [esi + 0x41]
jmp 0xbd2731

Function at 0xbc0581
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0xb89668
jmp 0xb896e7

Function at 0xbc0681
Capabilities:
Enumerate pe sections

Disassembly:
call fcn.00b8c4f5
jmp 0xb8c57d
Function at 0xbc0913
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00b8a7d6
jmp 0xb8a995
lea esp, [esp + 4]
jmp 0xbd5f92
jmp 0xb8a9cd
jmp fcn.00bd6b5f
jmp 0xb8a974
jmp 0xb8a9b1

Function at 0xbcc22a
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
jmp 0xbcc278
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
jmp 0xbcc20a
cmp word [ecx], ax
je 0xbcc2bd
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0xbcc27d
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret
Function at 0xbe88b0
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x4d
cmp dl, bl
push esi
or ah, byte [edi - 0xe]
imul esi, dword [0xccb00b55], 0xffffffd7
lahf
mov edi, ebx
or esi, dword [eax - 0x74602834]
sti
xchg ebp, eax
or dword [esi], 0xcfc567e0
xor byte [ecx - 0x28440a94], cl
bound edi, qword [esi + 0x57]
cmc
mov bl, 0xe6
jle 0xbe88bb
push ecx
imul ebx, ecx, 0xffffffd1
lds ebp, [edi + 0x614942f9]
cmc
sbb eax, 0xaef52f76
pop ebx
rcl cl, cl
aad 0xbb
inc ebx
retf

Function at 0xbf57fb
Capabilities:
Encode data using xor

Disassembly:
pop esi
inc edi
invalid
popfd
push 0xffffffffffffffba
mov dword [esi - 0x1deef95d], ebp
psubsw mm0, qword [eax]
lea ecx, [edx + ebp]
in al, 0xaa
fisubr dword [esi]
aam 3
push edx
mov dword [ecx + esi*4], 0xbe3053c6
aad 0xc0
lahf
outsd dx, dword [esi]
dec ebx
sal byte [edx], 1
xchg edx, eax
or dword [ecx + 0x1d], edi
xor byte [0x553b31d7], cl
cmp al, 0x54
mov bh, 0x1d
out dx, al
insb byte es:[edi], dx
outsd dx, dword [esi]
cwde
sub al, byte [esi + ebx*8 - 0x5656b210]
adc eax, 0xb2c3e0a4
xor al, 0x4b
fild qword [ebx]
xor byte [edi - 0x7a], 0x1a
leave
test dword [esi], edi
sti
pop esp
pushfd
cmp eax, edx
pop ds
rep insb byte es:[edi], dx
dec dx
je 0xbf57f6
test byte [esi + 0x64ff5271], cl
mov dword [edi - 0x41], 0x1ed2b888
mov bl, 0xdc
out dx, al
out 0x48, al
mov cl, 0x21
shl byte [ebp + 0x66], cl
dec edx
mov bh, 8
xor byte [ecx + ebx*4 - 0x7f], 0xc1
dec ebp
lodsd eax, dword [esi]
dec ecx
pop esi
sub dword [eax + 0x73e82be], edx
dec eax
in al, dx
pushal
invalid

Function at 0xbf8c43
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
bound eax, qword [edx + 0x69]
pop ebp
fst dword [esi - 0x3b57a672]
stosd dword es:[edi], eax
pop ebx
lodsb al, byte [esi]
clc
ljmp 0x56a1
out dx, al
push 0xffffffffffffff9e
int1
xchg byte [eax], dl
push edx
arpl word [ecx + 0x1c], cx
shl al, 1
xchg edx, eax
jne 0xbf8c9c
not dword fs:[edx]
xchg ecx, eax
jle 0xbf8c53
pop ebp
sub eax, dword [ebp + 0x48]
or ah, byte [esi + 0x287a4302]
cmpsb byte [esi], byte es:[edi]
add al, byte [ebx + 0x7a]
sub byte [eax], bh
mov dl, 0x12
push edx
invalid
mov dl, 0xe1
invalid
cmpsb byte [esi], byte es:[edi]
add al, byte [ebx + 0x7a]
sub byte [eax], bh
mov dl, 0x12
push edx
mov al, byte [0x6b18e1b2]
inc ebx
dec ecx
imul eax, dword [ebx + 0x49], 0x2f
das
mov al, 0x35
movsb byte es:[edi], byte [esi]
js 0xbf8be3
mov al, byte [ebx + ecx*4 - 0x5e]
add esi, ebp
xchg ecx, eax
sbb al, 0x95
rol byte [ebp + 0x32], cl
jae 0xbf8c28
xor dh, byte [ebx - 0x3f]
mov eax, dword [0xb46a24ae]
mov al, 0x1f
scasb al, byte es:[edi]
and al, 0x6a
mov ah, 0xb0
pop ds
jecxz 0xbf8c64
push eax
push ss
invalid
insd dword es:[edi], dx
ret 0x5cbe
Function at 0xbff1fe
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
test byte [edx], 4
add bl, byte [edx]
out dx, eax
add esi, ebx
je 0xbfdfbc
invalid
cmp al, 5
adc dword [ebx + 0x41], 0xf53eb187
push cs
stc
push ds
shr dl, cl
fisttp word [ebx + 0x22]
push ecx
wait
sub dword [edx + 0x6137c8a8], 0xffffffa6
and edx, eax
in al, dx
add ecx, dword [ecx + 0x3b867630]
sub edx, edx
mov dword [0xbc8fa4], eax
sbb cl, byte [eax - 0x4b]
enter 0x7132, 0xffffffffffffffb0
pop edi
sbb dword [esi + esi*4 + 0x65b08b90], ebx
or byte [ebp + 0x4c], al
push ecx
xor bh, byte [esi + 0x4de6bee4]
ja 0xbfe045
test eax, 0xc02fa157
dec esp
mov esi, 0xf448785
inc ebx
cli
jo 0xbfe046
mov ebx, 0x3206c1f0
sti
and edx, dword [ebx + 0xc1d9a71]
repne cmpsb byte es:[esi], byte es:[edi]
push eax
fidiv word [edi - 0x4b]
xor cl, dh
sub byte [eax + 0x35905012], bh
shr dword [ecx + 0x5a], cl
inc edi
xchg esp, eax
mov ah, 0x3d
fisubr word [ebp - 0x5d]
scasd eax, dword es:[edi]
pop esp
or edi, eax
invalid
stosd dword es:[edi], eax
imul esi, dword [eax + 0x11], 0x78ba51f7
xor esi, edi
inc edi
and dword [ebx + 0x5ea9950a], esp
daa
aaa
push cs
in al, dx
fimul word [edx + esi*8]
in al, dx
mov byte [0xcdef1bd1], al
pushal
rol byte [eax], 0x2a
test byte [ebp + edi + 0x31c00d60], bl
adc bh, byte [ecx]
sub ch, byte [eax - 0x40]
mov ebp, 0xfb84cf67
mov al, byte [0x60e8c075]
inc edi
test al, 0x66
adc dword [eax + 0x57fe26f0], ebp
mov al, byte [0x477518fa]
stosd dword es:[edi], eax
mov dh, 0xa6
xchg ecx, eax
int3
call 0xbff1fe
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x63694c20
outsb dx, byte gs:[esi]
jae 0xbff25d
jb 0xbff210
inc esp
insd dword es:[edi], dx
outsd dx, dword [esi]
and byte [esi + 0x31], dh
cmp byte cs:[esi], ch
xor byte [esi], ch
xor byte [eax], al
jmp 0xbff285
call 0xbff211
pop eax
sub eax, 0xbff211
add byte [eax - 0x7f], bl
call 0x17fe429
cmp dword [eax + 0xb80d45], 0
je 0xbff2d0
lea esp, [esp + 8]
popal
jmp 0xbfdf68
call 0xbff23d
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0xbff268
sub eax, 0x10000
jmp 0xbff241
ret 0x3750
movzx ebx, word [eax + 0x3c]
jmp 0xbff2a8
lea esp, [esp + 4]
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xbff238
add ebx, eax
cmp word [ebx], 0x4550
je 0xbff54a
jmp 0xbff248
inc dword [eax + 0xb80d45]
push 0xc48ec653
add dword [esp], 0x3c286217
push 0
push 0
push 0xc2e416f4
add dword [esp], 0x3dd30938
call fcn.00b8e2e2
call fcn.00b8d6b3
popal
jmp 0xbfdf68
push eax
jmp 0xbff20c
Function at 0x4015ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x401631
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x401637
add eax, 4
pop esi
dec esi
push esi
jne 0x401619
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8

Function at 0x40f54d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x40f585
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x40f573
mov al, 1
jmp 0x40f5d6
cmp dword [ebx + 0x54], ecx
jne 0x40f57c
mov al, 2
jmp 0x40f5d6
cmp dword [ebx + 0x7c], ecx
jne 0x40f5d6
mov al, 3
jmp 0x40f5d6
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x40f59a
mov al, 4
jmp 0x40f5d6
cmp ecx, 5
jne 0x40f5ba
cmp ebx, 0
jne 0x40f5a8
mov al, 5
jmp 0x40f5d6
cmp ebx, 1
jne 0x40f5b1
mov al, 6
jmp 0x40f5d6
cmp ebx, 2
jne 0x40f5ba
mov al, 7
jmp 0x40f5d6
cmp ecx, 6
jne 0x40f5c6
cmp ebx, 0
jne 0x40f5c8
mov al, 8
jmp 0x40f5d6
cmp ebx, 1
jne 0x40f5cf
mov al, 9
cmp ebx, 2
jne 0x40f5d6
mov al, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421060
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x18]
push eax
mov eax, 0x57
call fcn.004cba1d
cmp dword [ebp - 0x2c], esp
je 0x4210ee
push 6
call fcn.004cba17
add esp, 4
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x20]
push eax
mov eax, 0x58
call fcn.004cba1d
cmp dword [ebp - 0x2c], esp
je 0x421119
push 6
call fcn.004cba17
add esp, 4
fild qword [ebp - 0x20]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fild qword [ebp - 0x18]
fstp qword [ebp - 0x38]
fadd qword [ebp - 0x38]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
call fcn.00401b2a
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x28]
push eax
mov eax, 0x58
call fcn.004cba1d
cmp dword [ebp - 0x2c], esp
je 0x42115f
push 6
call fcn.004cba17
add esp, 4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp dword [ebp - 0x24], edx
jg 0x421174
jl 0x421173
cmp dword [ebp - 0x28], eax
jae 0x421174
inc ecx
mov eax, ecx
test eax, eax
jne 0x42113c
rdtsc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
fild qword [ebp - 0x10]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fild qword [ebp - 8]
fstp qword [ebp - 0x38]
fsub qword [ebp - 0x38]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
fdiv qword [0x6653f4]
fstp qword [ebp - 0x48]
fld qword [ebp - 0x48]
call fcn.00401b2a
jmp 0x4211b0
mov esp, ebp
pop ebp
ret

Function at 0x461f22
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, ecx
test ecx, ecx
je 0x461f7f
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x461f4e
cmp word [ecx], ax
je 0x461f53
jmp 0x461f42
add ecx, 2
inc eax
cmp word [ecx], 0
jne 0x461f42
jmp 0x461f53
mov eax, edx
lea ecx, [ecx + edx*2]
cdq
sub eax, edx
sar eax, 1
sub ecx, 2
test eax, eax
jle 0x461f7f
lea ecx, [ecx]
mov dx, word [esi]
xor word [ecx], dx
movzx edx, word [ecx]
xor word [esi], dx
movzx edx, word [esi]
xor word [ecx], dx
dec eax
sub ecx, 2
add esi, 2
test eax, eax
jg 0x461f62
pop esi
pop ebp
ret 8
Function at 0x4dbcc0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a66db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.005966c1
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4dbd42
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00593e50
mov eax, dword [eax]
push 0x6a2284
push eax
call fcn.00571e64
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0059694c
test bl, bl
je 0x4dbd42
push 0x6a2284
lea ecx, [esp + 0xc]
call fcn.00596d28
push 0x6a5e3c
lea ecx, [esp + 0xc]
call fcn.00596d28
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4dbd7e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0059694c
jmp 0x4dbe49
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4dbe02
lea edx, [esp + 0x7c]
push 0x6a5e38
push edx
call fcn.00571e64
add esp, 8
test eax, eax
je 0x4dbe02
lea eax, [esp + 0x7c]
push 0x6a5e34
push eax
call fcn.00571e64
add esp, 8
test eax, eax
je 0x4dbe02
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4dbd92
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0059694c
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4dc640
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4dc6a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4dc6b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a675b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x6bd408]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4dc7e8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4dc716
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0059694c
xor eax, eax
jmp 0x4dc85f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00596ad5
push esi
lea ecx, [esp + 0xc]
call fcn.00596d64
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x6a5e74
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4dc83d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.004dc640
test eax, eax
jne 0x4dc83d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.004dc640
test eax, eax
jne 0x4dc83d
lea eax, [esp + 0x14]
push 0x6a5e50
push eax
call fcn.005731c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4dc81c
lea ecx, [esp + 0x14]
push 0x6a5e4c
push ecx
call fcn.00573140
mov esi, eax
add esp, 8
test esi, esi
jne 0x4dc81c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4dc81f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00596a85
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4dc72e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0059694c
xor eax, eax
jmp 0x4dc85f
mov byte [esi], 0
push 0x6a5e48
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0059694c
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x4ef370
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x4ef3de
cmp si, 0x69
ja 0x4ef3de
add esi, 0xffd0
cmp si, 0x11
je 0x4ef3ae
push 0x11
call edi
test ax, ax
jge 0x4ef3ae
or esi, 0x2000
cmp si, 0x10
je 0x4ef3c3
push 0x10
call edi
test ax, ax
jge 0x4ef3c3
or esi, 0x4000
cmp si, 0x12
je 0x4ef3d8
push 0x12
call edi
test ax, ax
jge 0x4ef3d8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x4ef3eb
mov esi, 0xbd
jmp 0x4ef39f
cmp si, 0x6e
jne 0x4ef3f8
mov esi, 0xbe
jmp 0x4ef39f
cmp si, 0x6f
jne 0x4ef399
mov esi, 0xbf
jmp 0x4ef39f

Function at 0x4f1770
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x6d84a8]
xor edx, edx
cmp eax, edx
jne 0x4f1796
xor eax, eax
mov byte [eax + 0x6d83a8], al
inc eax
cmp eax, 0x100
jl 0x4f177e
mov dword [0x6d84a8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x6d83a8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4f1827
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4f17fa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4f17c8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4f18a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4f18f3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4f18da
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f4e30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a7c28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x20]
call fcn.0059d760
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub eax, esi
sub ecx, edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
call fcn.004f4d00
add esp, 0x14
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.0059d7d2
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret