joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b0dc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x41b042
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x41b049
cmp ebx, dword [eax + 4]
jae 0x41b049
xor eax, eax
jmp 0x41b239
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x41b05a
xor eax, eax
inc eax
jmp 0x41b238
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x41b070
cmp ecx, edx
jae 0x41b1b5
cmp dword [eax + 4], 0
je 0x41b079
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x41b061
cmp dword [ebp + 8], 0
je 0x41b09b
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x41b1b5
cmp eax, esi
jae 0x41b1b5
mov eax, dword [0x44ec68]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x41b0c0
cmp dword [esi*4 + 0x44ec70], edi
je 0x41b1b9
inc esi
cmp esi, eax
jl 0x41b0ae
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.0053a2cd
imul eax, dword [ebp + 0x60840fc0], 0x81000001
jge 0x41b0d0
test byte [eax + 1], ah
add byte [eax], al
cmp dword [ebp - 8], 0x1000000
add byte [eax], al
add byte [ecx], al
jne 0x41b235
test byte [ebp - 0xc], 0xcc
je 0x41b13e
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x41b235
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x41b235
cmp word [eax + 0x18], 0x10b
jne 0x41b235
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x41b235
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x41b13e
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x41b13e
test byte [ecx + 0x27], 0x80
jne 0x41b1b5
push 1
push 0x44ecb0
call fcn.004780d2
pop ecx
test eax, eax
jne 0x41b052
mov ecx, dword [0x44ec68]
test ecx, ecx
mov edx, ecx
jle 0x41b172
lea eax, [ecx*4 + 0x44ec6c]
cmp dword [eax], edi
je 0x41b172
dec edx
sub eax, 4
test edx, edx
jg 0x41b166
test edx, edx
jne 0x41b1a3
push 0xf
pop ebx
cmp ecx, ebx
jg 0x41b17f
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x41b197
lea eax, [edx*4 + 0x44ec70]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x41b185
cmp ecx, 0x10
jge 0x41b1a3
inc ecx
mov dword [0x44ec68], ecx
push 0
push 0x44ecb0
push eax
call fcn.004f527d
jmp 0x41b052
xor eax, eax
jmp 0x41b238
test esi, esi
jle 0x41b052
call fcn.00490e79
push 1
push 0x44ecb0
call ebx
test eax, eax
jne 0x41b052
cmp dword [esi*4 + 0x44ec70], edi
je 0x41b20f
mov eax, dword [0x44ec68]
lea esi, [eax - 1]
test esi, esi
jl 0x41b1fd
cmp dword [esi*4 + 0x44ec70], edi
je 0x41b1f9
dec esi
jns 0x41b1ed
test esi, esi
jge 0x41b20d
cmp eax, 0x10
jge 0x41b208
inc eax
mov dword [0x44ec68], eax
lea esi, [eax - 1]
jmp 0x41b20f
je 0x41b227
xor ecx, ecx
test esi, esi
jl 0x41b227
lea eax, [ecx*4 + 0x44ec70]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x41b215
push 0
push 0x44ecb0
call ebx
jmp 0x41b052
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43231d
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x4376da
call fcn.00416b20
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00429d59
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
xor edi, edi
mov ecx, ebx
mov dword [ebp - 4], edi
mov dword [esi], vtable.CInternetFile.0
mov dword [esi + 0x1c], eax
call fcn.00404240
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call fcn.00401be0
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.00401be0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x18], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x47976f
Capabilities:
Encode data using xor

Disassembly:
push 0x8ff42da0
mov eax, dword [eax + 0x138c25]
call fcn.00534c28
and byte [esi - 0xb], dh
xor al, 0xc6
mov bh, 0x7d
inc edx
jbe 0x4797cc
js 0x4797d6
jp 0x4797d2
inc eax
pop es
cmp eax, 0x1f4d6988
out 0xda, al
or dword [ebx], esp
mov esp, dword [eax - 0x7c1422eb]
mov ebx, 0xb5557480
ja 0x4797e9
jbe 0x4797ed
je 0x4797d1
or bh, bh
leave
mov ebp, 0xb7242f5f
lahf
and cl, dl
mov esi, 0x4a78c789
out 0x13, eax
daa
and bl, cl
sti
cli
mov al, byte [0xa614d7c3]
call 0x39159506
add ecx, dword [edx]
daa
mov byte [0xce8f15b], al
xchg edi, eax
daa
int1
call 0x436f2ee3
inc ebx
push ecx
dec esp
mov al, byte [0x5ad9d894]
or dword [ecx + 0x5e8da8a], edi
sub dword [eax - 0x45aeb98c], eax
lea ebp, [ebp + 0x44]
mov edx, 0xb8446d8d
mov ebx, es
cmc
inc esp
mov eax, 0x44f5c38c
push ss
and bh, byte [eax - 0x37e5099b]
test eax, 0xfd2c8681
inc edx
jg 0x479863
xor dword [esi - 0x12b0474c], ebx
xchg ebp, eax
stc
and al, 0xc6
ljmp 0x7146
jmp 0x2cdf816f
or esp, dword [ebx + 0x1a2f6c51]
xchg esi, eax
xor byte [eax + eax*2 - 0x26], 0xfd
shl dword [0x6c45b910], 1
scasd eax, dword es:[edi]
mov dl, 0xbe
xchg ebp, eax
movsd dword es:[edi], dword [esi]
mov dword [0xe9d3609c], eax
wait
cmp al, 0xfd
stosb byte es:[edi], al
salc
cmp bh, ah
xchg ecx, eax
push cs
sti
and edi, dword [ecx]
mov ebx, 0x6d9a3302
pop edx
ficomp word [ebp + 0x7c1386aa]
stosd dword es:[edi], eax
out dx, eax
add ch, 0x67
out 0xc3, eax
push edi
sub ebx, dword [esi]
dec edx
imul edx, dword [0x55d86d5a], 0xe6b49970
adc eax, 0x55d86d5a
jo 0x479843
mov ah, 0xe6
sub ch, dl
cmc
sti
xchg edx, eax
xor al, 0xca
jne 0x4798a3
fcomp dword [ebx - 0x49]
clc
not dword [ebp - 0x52]
dec ecx
pop ecx
sub bh, byte [edx]
invalid
Function at 0x484f41
Capabilities:
Encode data using xor

Disassembly:
mov word [esp], bp
mov dword [esp + 0x4c], ebp
movzx bp, bl
push eax
movsx bp, al
lea ebp, [edi - 0x5477f98e]
mov ebp, 0x407ace
call fcn.004eac18
xor al, 0x56
aad 0x7c
lds esi, [edi - 0x63ae5262]
lodsd eax, dword [esi]
cdq
test eax, 0xa49ba197
popfd
cmpsd dword [esi], dword es:[edi]
cdq
sub al, 0x98
daa
nop
and al, 0x7e
sbb edi, edi
push 0xe3aaf8f6
mov edx, 0xb245d2d4
mov edi, 0xe3596652
or byte [0x29edda3a], ah
xor eax, 0xbc8d15c4
xchg edi, eax
mov al, byte [eax + 0x35]
aam 0xf4
mov bl, byte [edi + 0x184c6581]
dec edx
push edi
xor bl, byte [edi]
or dword [eax - 0x3a2e0300], esi
cmp byte [0x6095859], dl
sub byte [edi + ebp], al
xor al, 0xa
cmp dword [ebx + 0x64466b5c], ecx
pop esp
push cs
lock or ecx, dword [esi]
aaa
jns 0x485012
rcl dh, 0xf4
pop ss
test al, 0xe9
dec esp
pop ss
mov eax, dword [0xe80c7849]
aad 2
imul esp, edi, 0x6703877a
pop ecx
stosd dword es:[edi], eax
rcl dword [ebp - 0x68], cl
mov ch, 0x35
cmpsd dword [esi], dword es:[edi]
cmp ah, dl
in eax, 0x31
push es
out dx, al
fisub dword [edi - 0x26]
invalid
ljmp 0x37c1:0xd559921e

Function at 0x491b0b
Capabilities:
Encode data using xor

Disassembly:
push eax
lea eax, [edx*2 + 0x2b6733fb]
cwde
setne ah
mov eax, dword [esp + 4]
push 0x5b0395c6
pushal
xchg dword [esp + 0x2c], eax
call fcn.004d8902
pushal
nop
lea esp, [esp + 0x24]
ja 0x484f16
pushal
mov eax, dword [esp + 0x20]
call fcn.0047ce62

Function at 0x493de3
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x34], ebp
pushfd
not ebp
not bp
mov ebp, 0x420269
pushfd
mov byte [esp], bl
mov ebp, dword [ebp + 0x5a802]
pushfd
push dword [esp]
lea esp, [esp + 0x40]
jge 0x52d544
lea ebp, [ebp - 0x3b8ee4c3]
pushfd
pushal
call fcn.004d7bbe
lea ebp, [ebp - 0x3b8ee4c3]
push edi
pushal
xchg dword [esp + 0x24], ebp
mov byte [esp], bh
push dword [esp + 0x24]
ret 0x28
jmp 0x4ddb1e
Function at 0x4f9610
Capabilities:
Encode data using xor

Disassembly:
call fcn.0045e365
and dh, byte [edi + esi*8 - 0x3f]
lds esi, [edi + 0x517c4774]
jl 0x480ad6
jbe 0x480ad7
je 0x480acd
jp 0x480adb
jne fcn.00480a1e
invalid
ret 0xc373
or al, 0x4f
inc esp
jo 0x480b0f
jge 0x480b09
xchg byte [eax + 0x3e], cl
mov dl, 0xad
invalid
push ecx
in eax, 0x60
inc edx
jne 0x480ac0
push esp
mov byte [eax + 0x22], dh
jo 0x480afa
and ch, byte [esi]
vmread dword [esi + edi*8], eax
vmread dword cs:[esi + edi*8], eax
add al, 0xfe
push 0x72310f7
cmp al, bl
and byte [ecx - 0x73], dh
jne 0x480a73
popal
push eax
add dl, byte [ecx - 0xeb081e7]
or ecx, dword [ebx - 9]
stosb byte es:[edi], al
xchg dword [0xb5416e83], esi
invalid
mov ch, 0x8c
mov ch, 0xef
xchg byte [edx + 0x55555e33], ah
xchg ebp, eax
stosd dword es:[edi], eax
call 0xe0a9f1ec
test bl, dh
shr byte [ebp - 0x67], 0xae
popal
loopne 0x480a90
shr byte [ebp - 0x67], 0xae
cdq
scasb al, byte es:[edi]
mov ecx, 0x4073d451
xor cl, byte [ebx + 0x3490ad7c]
xchg ebp, eax
add byte [ebx + 0x2177fc9a], ah
xchg esi, eax
aas
js 0x480b11
jne 0x480ac2
popal
mov ecx, 0xdee6073b
and eax, dword [esi]
mov esp, 0xdfc4ef02
and ecx, dword [edx + ecx*2]
xchg byte [esi - 0x70], dl
and al, 0xf0
dec ebp
shl byte [eax - 0x48], cl
in eax, dx
or esp, edx
popfd
aam 0x1f
xchg byte [edx + 0x1fe3b24a], bh
sub ch, byte [0xafaaf8cd]
fsubr qword [esi + 0x67]
les esi, [0xfa0252ee]
mov eax, 0x82adbc4c
mov ch, 0xe3
retf 0x3c2d
mov ebp, dword [ebp + 0xcb7f8]
push 0xf9091745
lea ebp, [ebp - 0x1bace705]
pushfd
push 0x65fc85f0
xchg dword [esp + 0xc], ebp
push eax
pushfd
mov byte [esp], ch
mov word [esp + 4], ax
push dword [esp + 0x14]
ret 0x18
push eax
mov dword [esp + 8], ebp
pop ebp
mov bp, ax
pushfd
pushfd
mov ebp, 0x42250c
pushfd
jmp 0x480a78
lea esp, [esp + 0x2c]
ja 0x4a3d23
mov dword [esp + 4], ebp
movzx ebp, cl
movsx bp, cl
mov ebp, 0x42250c
jmp 0x48cd0c
Function at 0x549ea4
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push dword [esp]
push dword [esp]
call fcn.004741cc
out dx, eax
aaa
mov edx, 0xb0b7b92d
test dword [edi - 0x457a4571], edi
test byte [eax + 0x7181b48e], dh
jno 0x549f0d
cmp dl, cl
inc edx
mov ebp, 0xe9fa0012
xor eax, 0x433eedba
loopne 0x549f4c
xor eax, 0x2e3a1e0d
shr edx, cl
dec eax
or cl, byte [ebx - 0x3704f851]
retf
add ah, dh
push ds
cmp dword [edi - 0x38cf6760], 0x3b
sar byte [ebx], 1
add ebp, edi
pop ss
or edi, dword [ebx - 0x37d66edf]
in eax, dx
pop ebp
in eax, 0xf2
invalid
cmp dword [edx - 0x4586951a], ecx
mov ebp, esp
add ebp, dword [ecx + 0x5d6b9581]
jns 0x549fae
mov fs, word [esi + 0x37cb3c90]
invalid
jle 0x549fe6
mov ebp, 0x732d9ed
neg byte [ebp + 0x6d25cdaf]
jmp 0xea239c78
lodsb al, byte [esi]
in al, dx
adc eax, 0x47bf5ac
adc al, 0xe2
fild word [ebp - 0x64]
inc ebp
pushfd
mov bh, 0x61
inc esp
in al, dx
sbb al, ah
outsb dx, byte gs:[esi]
push edi
and dword [edi - 0x216400a7], ebx
fsub qword [ebp + ebx*4 - 0x566b1f84]
or eax, 0x7105722e
stc
movsb byte es:[edi], byte [esi]
popfd
jl 0x549fdc
xchg esp, eax
test eax, 0x5722e0d
jno 0x549ffd
imul esi, dword [edi - 0x305f17ec], 0x73
adc al, 0xe8
inc edx
jbe 0x54a059
inc esi
sub dword [edx], ebp
mov eax, 0xed51bc80
invalid
mov ebx, 0x25b7704a
out dx, eax
inc edi
jle 0x549fe8
adc eax, 0xaed89f0b
xchg ebx, eax
cmp ecx, esp
stc
mov word [edi + 0x5cd2e4b5], es
add byte [edx + 0x1e], al
jae 0x549ff8
adc eax, 0x3542022e
inc ebx
adc al, 0x12
xor bl, al
fiadd dword [ebp - 0x17]
pop ecx
jae 0x54a068
pushfd
cld
push ebx
invalid

Function at 0x54e916
Capabilities:
Encode data using xor

Disassembly:
out 0xb, al
xor ebp, 0x98c73a51
call fcn.00475add
pop ebx
pushal
mov dword [esp + 0x48], ebp
lea ebp, [ecx - 0x55421193]
not bp
pushfd
mov ebp, 0x41436d
lea ebx, [ecx - 0x6232f84d]
mov ebp, dword [ebp + 0x94add]
call fcn.00547cbd
mov cl, byte [esi - 0x1f]
dec ebx
mov edx, 0x88b98ab7
mov dl, 0x84
mov ah, 0x8b
ja 0x5380a5
xchg byte [ebx - 0x20764173], dh
add eax, 0xdf04737f
lea edx, [esi + 0x52]
popal
pushal
sub dword [esi - 0x20c66c92], esi
mov al, 0xf1
pushal
inc esi
ror bl, 1
das
sbb al, 0x38
inc ebp
push ebp
dec ecx
push 0x47
in eax, 5
cmp dword [ebp - 0x5f], eax
xchg edx, eax
invalid
lea ebp, [ebp + 1]
movzx bx, cl
jmp 0x5380b2
Function at 0x40ca50
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48aa9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047eeee
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40cad2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047c750
mov eax, dword [eax]
push 0x57a234
push eax
call fcn.0045c5a4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047f179
test bl, bl
je 0x40cad2
push 0x57a234
lea ecx, [esp + 0xc]
call fcn.0047f509
push 0x57ddac
lea ecx, [esp + 0xc]
call fcn.0047f509
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40cb0e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047f179
jmp 0x40cbd9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40cb92
lea edx, [esp + 0x7c]
push 0x57dda8
push edx
call fcn.0045c5a4
add esp, 8
test eax, eax
je 0x40cb92
lea eax, [esp + 0x7c]
push 0x57dda4
push eax
call fcn.0045c5a4
add esp, 8
test eax, eax
je 0x40cb92
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40cb22
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047f179
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40de30
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40de92
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40dea0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48abfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5846cc]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40dfd8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40df06
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047f179
xor eax, eax
jmp 0x40e04f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0047f2b6
push esi
lea ecx, [esp + 0xc]
call fcn.0047f545
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x57dde4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40e02d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040de30
test eax, eax
jne 0x40e02d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040de30
test eax, eax
jne 0x40e02d
lea eax, [esp + 0x14]
push 0x57ddc0
push eax
call fcn.0045d5f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e00c
lea ecx, [esp + 0x14]
push 0x57ddbc
push ecx
call fcn.0045d570
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e00c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40e00f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047f266
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40df1e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047f179
xor eax, eax
jmp 0x40e04f
mov byte [esi], 0
push 0x57ddb8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047f179
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41ea80
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41eaee
cmp si, 0x69
ja 0x41eaee
add esi, 0xffd0
cmp si, 0x11
je 0x41eabe
push 0x11
call edi
test ax, ax
jge 0x41eabe
or esi, 0x2000
cmp si, 0x10
je 0x41ead3
push 0x10
call edi
test ax, ax
jge 0x41ead3
or esi, 0x4000
cmp si, 0x12
je 0x41eae8
push 0x12
call edi
test ax, ax
jge 0x41eae8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41eafb
mov esi, 0xbd
jmp 0x41eaaf
cmp si, 0x6e
jne 0x41eb08
mov esi, 0xbe
jmp 0x41eaaf
cmp si, 0x6f
jne 0x41eaa9
mov esi, 0xbf
jmp 0x41eaaf

Function at 0x4201a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x595c08]
xor edx, edx
cmp eax, edx
jne 0x4201c6
xor eax, eax
mov byte [eax + 0x595b08], al
inc eax
cmp eax, 0x100
jl 0x4201ae
mov dword [0x595c08], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x595b08
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x420257
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x42022a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4201f8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4202d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x420323
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x42030a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426d60
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x426ef8
cmp ebp, ebx
jle 0x426ef8
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x426dbe
dec eax
or eax, 0xfffffff8
inc eax
je 0x426dc5
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, reloc.WS2_32.dll_accept
jns 0x426dd4
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x426ddb
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.0047eeba
add esp, 4
cmp eax, ebx
je 0x426dfc
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.0047eeba
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x426eee
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x426ed5
mov al, byte [edx]
cmp al, 0xc0
jbe 0x426ec1
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x426eb6
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x426ec4
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x426ec4
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x426e60
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x426e51
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x429f00
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48c108
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
test edi, edi
jne 0x429f39
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
push 0x400
lea ecx, [esp + 0xc]
call fcn.0048686d
mov eax, dword [esp + 0x40]
push 0
push edi
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call fcn.004868b9
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.00429fc0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.004868f6
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24