joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468560
Capabilities:
Get disk information

Disassembly:
sub esp, 0x218
push esi
mov esi, dword [esp + 0x224]
push edi
push 2
push 0x497c00
push esi
call fcn.00470230
add esp, 0xc
test eax, eax
je 0x468597
push 2
push 0x494da4
push esi
call fcn.00470230
add esp, 0xc
test eax, eax
jne 0x4685b1
mov al, byte [esi + 2]
test al, al
je 0x4685b1
cmp al, 0x2f
je 0x4685b1
cmp al, 0x5c
je 0x4685b1
pop edi
xor eax, eax
pop esi
add esp, 0x218
ret
cmp dword [0x49821c], 1
jle 0x4685ce
xor eax, eax
push 0x103
mov al, byte [esi]
push eax
call fcn.0047229e
add esp, 8
jmp 0x4685e1
mov edx, dword [str.________________________________H]
xor ecx, ecx
mov cl, byte [esi]
mov ax, word [edx + ecx*2]
and eax, 0x103
test eax, eax
je 0x4685ef
cmp byte [esi + 1], 0x3a
jne 0x4685ef
mov eax, esi
jmp 0x46861c
lea eax, [esp + 8]
lea ecx, [esp + 0x11c]
push eax
push ecx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x468615
pop edi
pop esi
add esp, 0x218
ret
lea eax, [esp + 0x11c]
mov edi, dword [esp + 0x224]
push 2
push eax
mov dword [esp + 0x10], eax
lea esi, [edi + 0xcb44]
push esi
call fcn.00470230
add esp, 0xc
test eax, eax
je 0x468721
mov edx, dword [esp + 8]
push 2
push edx
push esi
call fcn.00470e40
add esp, 0xc
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push 0x104
push eax
push ecx
lea eax, [esp + 0x20]
push edx
push eax
lea ecx, [esp + 0x130]
push 0x104
push ecx
push esi
mov byte [edi + 0xcb46], 0x2f
mov byte [edi + 0xcb47], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x46869b
mov byte [esi], al
pop edi
pop esi
add esp, 0x218
ret
mov esi, dword [esp + 0xc]
mov edx, 0xc
cmp edx, esi
push 4
sbb eax, eax
lea ecx, [esp + 0x1c]
inc eax
push str.VFAT
push ecx
mov dword [edi + 0xcb48], eax
call fcn.0047c214
add esp, 4
push eax
call fcn.00470230
add esp, 0xc
test eax, eax
je 0x468716
push 4
lea edx, [esp + 0x1c]
push str.HPFS
push edx
call fcn.00470230
add esp, 0xc
test eax, eax
je 0x468716
push 3
lea eax, [esp + 0x1c]
push 0x497bec
push eax
call fcn.00470230
add esp, 0xc
test eax, eax
je 0x468716
xor eax, eax
mov dword [edi + 0xcb4c], eax
pop edi
mov eax, 1
pop esi
add esp, 0x218
ret
mov eax, 1
mov dword [edi + 0xcb4c], eax
pop edi
mov eax, 1
pop esi
add esp, 0x218
ret
Function at 0x469a70
Capabilities:
Get disk information

Disassembly:
mov al, byte [esp + 4]
lea ecx, [esp + 4]
add al, 0x40
push ecx
mov byte [esp + 8], al
mov byte [esp + 9], 0x3a
mov byte [esp + 0xa], 0x2f
mov byte [esp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor edx, edx
cmp eax, 2
sete dl
mov eax, edx
ret

Function at 0x469c70
Capabilities:
Get geographical location

Disassembly:
push ecx
lea eax, [esp + 2]
push 2
push eax
push 0x21
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x469ca7
movsx eax, byte [esp + 2]
sub eax, 0x30
je 0x469ca7
dec eax
je 0x469ca0
dec eax
jne 0x469ca7
mov eax, 2
pop ecx
ret
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x469cb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x2c]
push esi
push edi
call fcn.0047c42c
add esp, 8
test eax, eax
jne 0x469e0d
mov eax, dword [esp + 0x28]
push ebp
push edi
push eax
call fcn.00468300
add esp, 8
mov ebp, eax
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x469e03
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x469e03
lea edi, [esi + 0x1c]
lea ecx, [esp + 0x20]
test ebp, ebp
push edi
push ecx
jne 0x469da3
call fcn.00469e70
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
jne 0x469d58
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x469d58
mov edx, dword [edi]
mov dword [esi + 0x18], edx
jmp 0x469d69
lea eax, [esi + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00469e70
add esp, 8
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x469d88
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x469d88
mov edx, dword [edi]
pop ebp
mov dword [esi + 0x20], edx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
add esi, 0x20
lea eax, [esp + 0x18]
push esi
push eax
call fcn.00469e70
add esp, 8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
call fcn.00469ef0
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
jne 0x469dc2
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x469dc2
mov edx, dword [edi]
mov dword [esi + 0x18], edx
jmp 0x469dd3
lea eax, [esi + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00469ef0
add esp, 8
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x469df2
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x469df2
mov edx, dword [edi]
pop ebp
mov dword [esi + 0x20], edx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
add esi, 0x20
lea eax, [esp + 0x18]
push esi
push eax
call fcn.00469ef0
add esp, 8
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x469e59
test bl, 0x10
je 0x469e59
mov ecx, 9
xor eax, eax
mov edi, esi
push 0x210000
rep stosd dword es:[edi], eax
call fcn.004675b0
not bl
and ebx, 1
add esp, 4
or bl, 0x82
mov dword [esi + 0x1c], eax
shl ebx, 7
mov dword [esi + 0x20], eax
mov dword [esi + 0x18], eax
mov word [esi + 6], bx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret
Function at 0x46d1a0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x4a33f4
mov eax, edx
mov esi, 8
test al, 1
je 0x46d1bc
shr eax, 1
xor eax, 0xedb88320
jmp 0x46d1be
shr eax, 1
dec esi
jne 0x46d1af
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x4a37f4
jl 0x46d1a8
mov dword [0x497c14], 0
pop esi
ret

Function at 0x46d200
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [edx + 0xcae8]
push edi
mov edi, dword [edx + 0xc8d8]
mov ecx, esi
xor ecx, eax
and ecx, 0xff
shr esi, 8
mov ecx, dword [edi + ecx*4]
xor ecx, esi
mov esi, dword [edx + 0xcaec]
mov dword [edx + 0xcae8], ecx
and ecx, 0xff
add ecx, esi
mov esi, dword [edx + 0xcaf0]
imul ecx, ecx, 0x8088405
inc ecx
mov ebx, esi
mov dword [edx + 0xcaec], ecx
and ebx, 0xff
shr ecx, 0x18
xor ecx, ebx
shr esi, 8
mov ecx, dword [edi + ecx*4]
pop edi
xor ecx, esi
pop esi
mov dword [edx + 0xcaf0], ecx
pop ebx
ret

Function at 0x46d560
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
push eax
push esi
call fcn.0046d270
mov ecx, dword [esp + 0x28]
add esp, 8
xor edi, edi
mov edx, dword [ecx]
mov dword [esp + 0xc], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [ecx + 8]
mov dword [esp + 0x14], ecx
push esi
call fcn.0046d1e0
mov bl, byte [esp + edi + 0x10]
xor bl, al
mov al, bl
mov byte [esp + edi + 0x10], bl
and eax, 0xff
push eax
push esi
call fcn.0046d200
add esp, 0xc
inc edi
cmp edi, 0xc
jl 0x46d592
mov edx, dword [esi + 0x8d4]
movzx cx, byte [esp + 0x17]
test byte [edx + 0x1c], 2
je 0x46d5d9
xor eax, eax
mov ax, word [esi + 0xc924]
shr eax, 8
jmp 0x46d5e2
mov eax, dword [esi + 0xc928]
shr eax, 0x18
and ecx, 0xffff
cmp ecx, eax
je 0x46d5f6
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
mov eax, dword [esi + 0xc8e8]
mov ecx, dword [esi + 0x88]
cmp eax, ecx
jle 0x46d608
mov eax, ecx
mov edi, dword [esi + 0xc8e4]
mov ecx, eax
dec eax
test ecx, ecx
je 0x46d639
lea ebx, [eax + 1]
push esi
call fcn.0046d1e0
mov cl, byte [edi]
xor cl, al
mov al, cl
mov byte [edi], cl
and eax, 0xff
push eax
push esi
call fcn.0046d200
add esp, 0xc
inc edi
dec ebx
jne 0x46d618
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x46d650
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x46d65d
xor eax, eax
pop esi
ret
push ebx
push edi
call fcn.0046d180
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
cmp edi, 8
not ecx
jb 0x46d748
push ebp
mov ebp, edi
shr ebp, 3
mov edx, ecx
xor ebx, ebx
mov bl, byte [esi]
and edx, 0xff
xor edx, ebx
mov ebx, ecx
shr ebx, 8
mov ecx, dword [eax + edx*4]
sub edi, 8
xor ecx, ebx
inc esi
mov edx, ecx
xor ebx, ebx
mov bl, byte [esi]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov edx, dword [eax + edx*4]
shr ecx, 8
xor edx, ecx
inc esi
mov ecx, edx
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [eax + ecx*4]
shr edx, 8
xor ecx, edx
inc esi
mov edx, ecx
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov edx, dword [eax + edx*4]
shr ecx, 8
xor edx, ecx
inc esi
mov ecx, edx
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [eax + ecx*4]
shr edx, 8
xor ecx, edx
inc esi
mov edx, ecx
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov edx, dword [eax + edx*4]
shr ecx, 8
xor edx, ecx
inc esi
mov ecx, edx
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [eax + ecx*4]
shr edx, 8
xor ecx, edx
inc esi
mov edx, ecx
and edx, 0xff
xor edx, ebx
shr ecx, 8
mov edx, dword [eax + edx*4]
xor ecx, edx
inc esi
dec ebp
jne 0x46d67d
pop ebp
test edi, edi
je 0x46d766
mov edx, ecx
xor ebx, ebx
mov bl, byte [esi]
and edx, 0xff
xor edx, ebx
shr ecx, 8
mov edx, dword [eax + edx*4]
xor ecx, edx
inc esi
dec edi
jne 0x46d74c
mov eax, ecx
pop edi
pop ebx
pop esi
not eax
ret

Function at 0x47c1d5
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x47c200
test byte [esp + 8], 0x80
je 0x47c1ef
and al, 0xfe
jmp 0x47c1f1
or al, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x47c211
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047a4ed
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x40575c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00402d70
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
je 0x4057f7
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x409398]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4057f7
cmp eax, 1
je 0x405818
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
je 0x4057f7
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4057c4
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4057f3
xor eax, eax
inc eax
jmp 0x405837
cmp edi, eax
jae 0x4057fb
xor eax, eax
jmp 0x405837
cmp eax, esi
jae 0x405802
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov eax, dword [0x409398]
jmp 0x40581b
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x402fc9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x402fd8
pop dword [ebp - 0x40]
mov eax, 0x3a91f95b
sub eax, 0x3a51c983
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x43e591cf
add dword [ebp - 0x50], 0xa6cb37c
mov dword [ebp - 0x4c], 0x9bfefb60
add dword [ebp - 0x4c], 0x963450e5
mov dword [ebp - 0x48], 0x50e88b0b
sub dword [ebp - 0x48], 0x49c46dd
mov dword [ebp - 0x44], 0xc2e3a9c0
add dword [ebp - 0x44], 0x3d1c5640
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x94efef13
sub dword [ebp - 0x50], 0x207d85bd
mov dword [ebp - 0x4c], 0x20890c94
add dword [ebp - 0x4c], 0x20e354e1
mov dword [ebp - 0x48], 0x4cb4c59a
sub dword [ebp - 0x48], 0xe945592e
mov dword [ebp - 0x44], 0xa7c43e80
add dword [ebp - 0x44], 0x583bc180
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3762f
push 0
call eax
mov ecx, 0xf5521e57
sub ecx, 0xf551dee0
mov esi, eax
mov edi, 0xb08c245a
add edi, 0x4fb58ba6
add edi, dword [ebp - 0x40]
mov edx, 0x87a2f478
add dword [ebp - 0x18], edx
mov ebx, dword [edi]
mov dword [ebp - 0x14], 0x78cd167d
xor ebx, edx
xor dword [ebp - 0x30], esi
mov dword [esi], ebx
mov dword [ebp - 0x28], 0x65f7ae6c
add esi, 0x8bcdff39
sub esi, 0x8bcdff35
add edi, 4
loop 0x4030ea
add eax, 0x242a7f9c
add eax, 0xdbd67113
xor ebx, ebx
add ebx, eax
add eax, 0xdcb77f46
sub eax, 0xdcb77f41
mov ecx, 0xd032e56c
add ecx, 0x300d1a94
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x412de0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49c75b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048f16b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x412e62
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048c8fb
mov eax, dword [eax]
push 0x727cb8
push eax
call fcn.0047f2b4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0048f3f6
test bl, bl
je 0x412e62
push 0x727cb8
lea ecx, [esp + 0xc]
call fcn.0048f7d2
push 0x727cc4
lea ecx, [esp + 0xc]
call fcn.0048f7d2
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x412e9e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0048f3f6
jmp 0x412f69
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x412f22
lea edx, [esp + 0x7c]
push 0x727cc0
push edx
call fcn.0047f2b4
add esp, 8
test eax, eax
je 0x412f22
lea eax, [esp + 0x7c]
push 0x727cbc
push eax
call fcn.0047f2b4
add esp, 8
test eax, eax
je 0x412f22
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x412eb2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0048f3f6
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x413770
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4137d2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4137e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49c7db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x7328f0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x413918
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x413846
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048f3f6
xor eax, eax
jmp 0x41398f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0048f57f
push esi
lea ecx, [esp + 0xc]
call fcn.0048f80e
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41396d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocStringLen
call fcn.00413770
test eax, eax
jne 0x41396d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocStringLen
mov ecx, edi
call fcn.00413770
test eax, eax
jne 0x41396d
lea eax, [esp + 0x14]
push 0x727cd4
push eax
call fcn.004804a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41394c
lea ecx, [esp + 0x14]
push 0x727cd0
push ecx
call fcn.00480420
mov esi, eax
add esp, 8
test esi, esi
jne 0x41394c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41394f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0048f52f
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41385e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048f3f6
xor eax, eax
jmp 0x41398f
mov byte [esi], 0
push 0x727ccc
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0048f3f6
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x425450
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x4254be
cmp si, 0x69
ja 0x4254be
add esi, 0xffd0
cmp si, 0x11
je 0x42548e
push 0x11
call edi
test ax, ax
jge 0x42548e
or esi, 0x2000
cmp si, 0x10
je 0x4254a3
push 0x10
call edi
test ax, ax
jge 0x4254a3
or esi, 0x4000
cmp si, 0x12
je 0x4254b8
push 0x12
call edi
test ax, ax
jge 0x4254b8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x4254cb
mov esi, 0xbd
jmp 0x42547f
cmp si, 0x6e
jne 0x4254d8
mov esi, 0xbe
jmp 0x42547f
cmp si, 0x6f
jne 0x425479
mov esi, 0xbf
jmp 0x42547f

Function at 0x426dc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x7437d0]
xor edx, edx
cmp eax, edx
jne 0x426de6
xor eax, eax
mov byte [eax + 0x7436d0], al
inc eax
cmp eax, 0x100
jl 0x426dce
mov dword [0x7437d0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x7436d0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x426e77
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x426e4a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x426e18
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x426ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x426f43
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x426f2a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret