joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103b791
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x1046064]
and dword [ebp - 0x418], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x14]
push 0x10
pop ecx
mov dword [ebp - 0x41c], eax
xor eax, eax
push ebx
lea edi, [ebp - 0x464]
rep stosd dword es:[edi], eax
push 0x102
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x468], 0x44
call fcn.01004cfc
test eax, eax
jl 0x103b867
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push 0x103b87c
mov esi, 0x208
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01008c55
xor edi, edi
cmp eax, edi
jl 0x103b866
push dword [ebp - 0x420]
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.01008c55
cmp eax, edi
jl 0x103b866
push dword [ebp - 0x41c]
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x424]
lea eax, [ebp - 0x414]
push edi
push edi
push edi
push edi
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x418], eax
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
pop edi
pop ebx
call fcn.01001b01
leave
ret 0x10

Function at 0x103caa2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp + 0xc]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x103cb03
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x103cafa
cmp dword [ebp - 0xc], 4
je 0x103cafa
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xc]
push eax
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x103cb46
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x103cb3d
cmp dword [ebp - 0xc], esi
je 0x103cb3d
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x103cb55
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1046064]
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0x10c]
push edx
push 1
xor esi, esi
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x103cbcb
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push edi
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.01001b01
leave
ret 0xc

Function at 0x103cd8f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x100bbe8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103cde1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x101d488
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x103cdeb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10476c8]
cmp eax, 0xffffffff
jne 0x103ce6f
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x103ce80
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x103ce5e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x103ce74
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x103ce55
cmp dword [ebp - 0xc], 4
jne 0x103ce55
cmp dword [ebp - 0x10], eax
je 0x103ce55
mov dword [0x10476c8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10476c8]
cmp eax, 0xffffffff
jne 0x103ce6f
xor eax, eax
mov dword [0x10476c8], eax
leave
ret
Function at 0x103dc85
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push 0x103dea0
push dword [0x1047390]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x100fa48
push 0x1029c60
push dword [0x1047390]
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x103dcc1
call fcn.01036c9b
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push 0x103de40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103de19
push esi
push edi
push 0x1018420
call fcn.0103d804
push 0x101a7c0
mov dword [ebp - 0xc], eax
call fcn.0103d804
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x4c], ebx
lea edi, [ebp - 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1c]
stosd dword es:[edi], eax
call fcn.0103d889
push 3
pop esi
push ebx
push 4
push 0x103de30
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0103d8c4
mov dword [ebp + esi*4 - 0x4c], eax
inc esi
cmp esi, 6
jb 0x103dd17
lea ecx, [ebp - 0x1c]
call fcn.0103d889
xor edi, edi
lea esi, [ebp + edi*4 - 0x4c]
cmp dword [esi], ebx
jne 0x103dd5e
push 1
push 0x10
push 0x103de20
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0103d8c4
mov dword [esi], eax
inc edi
cmp edi, 6
jb 0x103dd3f
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x30], 3
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push ebx
push 0x40000000
lea eax, [ebp - 0x24]
push eax
call fcn.01020b05
push 0x13
xor esi, esi
pop ebx
mov edi, dword [ebp + esi*4 - 0x4c]
test edi, edi
je 0x103dde5
push 0x26
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x103ddac
lea eax, [ebx + 0x28]
mov dword [ebp - 0x2c], eax
jmp 0x103ddaf
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0x100badc
push edi
call fcn.0100dba3
test eax, eax
jl 0x103dde5
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
push 0x12
push 0x1020de0
call fcn.0102b996
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc esi
dec ebx
cmp esi, 6
jb 0x103dd90
xor esi, esi
push dword [ebp + esi*4 - 0x4c]
call dword [sym.imp.SHELL32.dll_ILFree]
inc esi
cmp esi, 6
jb 0x103ddee
push dword [ebp - 0xc]
mov esi, dword [sym.imp.SHELL32.dll_SHFree]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x103e022
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 1
push 0x1018480
push 0x101aa10
mov esi, ecx
xor ebx, ebx
push 0x80000001
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x103e16e
push 4
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x14], 9
call dword [sym.imp.SHLWAPI.dll_IStream_Write]
test eax, eax
jl 0x103e14a
mov dword [ebp - 8], ebx
add esi, 0x38
push edi
push dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.01020a5b
test eax, eax
je 0x103e132
mov eax, dword [ebp - 8]
movzx eax, byte [eax*8 + 0x10209fc]
push eax
push dword [ebp - 4]
call fcn.0103d388
test eax, eax
jl 0x103e149
mov eax, dword [esi]
cmp eax, ebx
je 0x103e122
cmp dword [esi + 8], ebx
je 0x103e122
cmp dword [eax], ebx
mov dword [ebp - 0xc], ebx
jle 0x103e122
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov edi, dword [eax + ecx*4]
mov eax, dword [edi]
cmp ebx, eax
je 0x103e0f8
push 0
push dword [ebp - 4]
mov ebx, eax
call fcn.0103d388
test eax, eax
jl 0x103e149
push dword [ebx + 4]
push dword [esi + 8]
call fcn.0103d3a5
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_IStream_WritePidl]
test eax, eax
jl 0x103e149
push 1
push dword [ebp - 4]
call fcn.0103d388
test eax, eax
jl 0x103e149
push dword [edi + 4]
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_IStream_WritePidl]
test eax, eax
jl 0x103e149
inc dword [ebp - 0xc]
mov eax, dword [esi]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [eax]
jl 0x103e0be
push 2
push dword [ebp - 4]
call fcn.0103d388
test eax, eax
jl 0x103e149
xor ebx, ebx
inc dword [ebp - 8]
add esi, 0x1c
cmp dword [ebp - 8], 6
jb 0x103e07d
mov dword [ebp - 0x10], 1
pop edi
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x10], 0
jne 0x103e16e
push 0x1018480
push 0x101aa10
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
pop esi
pop ebx
leave
ret
Function at 0x103f4f1
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jl 0x103f550
push edi
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x30], 0x10119c4
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ILFree]
pop edi
leave
ret 4
Function at 0x40116c
Capabilities:
Encode data using xor

Disassembly:
adc byte [eax], al
jmp dword [sym.imp.MSVBVM60.DLL___vbaLateIdCall]
push 0x4095d4
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi], cl
add byte [ebx - 0x19], cl
jno 0x401149
push cs
dec eax
scasd eax, dword es:[edi]
stosd dword es:[edi], eax
pop esi
out dx, al
std
xchg dword [ebp + edx], ebx
add byte [eax], al
add dword [eax], eax
add byte [eax], al
xor byte [edx], dh
xor byte [ebx + esi], dh
xor byte [eax + 0x72], dl
outsd dx, dword [esi]
push 0x65
arpl word [ecx + esi], si
xor byte [0x30303043], ch
sub eax, 0
dec esp
xor dword [eax], eax
push es
mov cl, 0xe8
pushal
in al, dx
adc dword [edi + 0x4b], ebp
mov fs, word [ebp - 5]
add al, 0x5a
xchg esi, eax
loopne 0x4011a2
mov dh, 0xe3
pop ebx
mov edi, 0x45e2daed
mov ah, 0x5a
mov edi, 0x7bd1b160
jb 0x40121c
dec edi
lodsd eax, dword [esi]
xor ebx, dword [ecx - 0x48ee309a]
or al, 0
stosb byte es:[edi], al
add byte [eax - 0x2d], ah
xchg ebx, eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
insd dword es:[edi], dx
add dword [eax], 0
lea esi, [edx]
add byte [eax], al
add byte [0x726f4600], al
add byte [eax], al
add eax, 0x726f4600
insd dword es:[edi], dx
xor dword [eax], eax
or eax, 0xba000e01
invalid
Function at 0x40ba00
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x478cfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046b4d9
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40ba82
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00468c40
mov eax, dword [eax]
push 0x4a3200
push eax
call fcn.0045b6b4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046b764
test bl, bl
je 0x40ba82
push 0x4a3200
lea ecx, [esp + 0xc]
call fcn.0046bb40
push 0x4a6d7c
lea ecx, [esp + 0xc]
call fcn.0046bb40
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40babe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046b764
jmp 0x40bb89
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40bb42
lea edx, [esp + 0x7c]
push 0x4a6d78
push edx
call fcn.0045b6b4
add esp, 8
test eax, eax
je 0x40bb42
lea eax, [esp + 0x7c]
push 0x4a6d74
push eax
call fcn.0045b6b4
add esp, 8
test eax, eax
je 0x40bb42
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40bad2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046b764
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40c380
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40c3e2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40c3f0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x478d7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4add28]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40c528
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40c456
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046b764
xor eax, eax
jmp 0x40c59f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046b8ed
push esi
lea ecx, [esp + 0xc]
call fcn.0046bb7c
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x4a6db4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40c57d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040c380
test eax, eax
jne 0x40c57d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040c380
test eax, eax
jne 0x40c57d
lea eax, [esp + 0x14]
push 0x4a6d90
push eax
call fcn.0045c790
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c55c
lea ecx, [esp + 0x14]
push 0x4a6d8c
push ecx
call fcn.0045c710
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c55c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40c55f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046b89d
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40c46e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046b764
xor eax, eax
jmp 0x40c59f
mov byte [esi], 0
push 0x4a6d88
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046b764
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41f460
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41f4ce
cmp si, 0x69
ja 0x41f4ce
add esi, 0xffd0
cmp si, 0x11
je 0x41f49e
push 0x11
call edi
test ax, ax
jge 0x41f49e
or esi, 0x2000
cmp si, 0x10
je 0x41f4b3
push 0x10
call edi
test ax, ax
jge 0x41f4b3
or esi, 0x4000
cmp si, 0x12
je 0x41f4c8
push 0x12
call edi
test ax, ax
jge 0x41f4c8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41f4db
mov esi, 0xbd
jmp 0x41f48f
cmp si, 0x6e
jne 0x41f4e8
mov esi, 0xbe
jmp 0x41f48f
cmp si, 0x6f
jne 0x41f489
mov esi, 0xbf
jmp 0x41f48f

Function at 0x420b80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4beb10]
xor edx, edx
cmp eax, edx
jne 0x420ba6
xor eax, eax
mov byte [eax + 0x4bea10], al
inc eax
cmp eax, 0x100
jl 0x420b8e
mov dword [0x4beb10], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4bea10
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x420c37
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x420c0a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x420bd8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x420cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x420d03
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x420cea
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427740
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x4278d8
cmp ebp, ebx
jle 0x4278d8
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, reloc.OLEAUT32.dll_VariantInit
mov dword [esp + 0x10], edi
jns 0x42779e
dec eax
or eax, 0xfffffff8
inc eax
je 0x4277a5
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, reloc.WS2_32.dll_accept
jns 0x4277b4
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x4277bb
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.0046b4a5
add esp, 4
cmp eax, ebx
je 0x4277dc
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.0046b4a5
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x4278ce
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x4278b5
mov al, byte [edx]
cmp al, 0xc0
jbe 0x4278a1
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x427896
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x4278a4
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x4278a4
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x427840
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x427831
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x42a910
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47a5e8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
test edi, edi
jne 0x42a949
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
push 0x400
lea ecx, [esp + 0xc]
call fcn.00472f78
mov eax, dword [esp + 0x40]
push 0
push edi
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call fcn.00473000
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.0042a9d0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.0047303d
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24