joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451cdc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x451e60
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x451df8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x451d8f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x451d70
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x451d8d
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x34]
call fcn.00434a1c
mov dword [eax], 0xfffffffe
jmp 0x451d65
jmp 0x451df6
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x451df6
push 0x202d
push 0x41a6
push 0x7d84
push 0x7cc1
push 0x6fd7
push 0xfc9
push 0x1755
push 0
push 0
push 0x27aa
push 1
push 1
push 0x7452
push 0x20fa
push 0x3fc8
push 0x5f16
push 0x2194
call fcn.004422cf
add esp, 0x44
jmp 0x451e5e
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x451e51
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x451e4f
push 0x77c6
push 0x61d8
push 0x6d0d
push 0x4630
push 0x7bb
push 0x509c
push 0x1e36
push 0x1ae0
push 0x588d
push 1
push 1
push 0
call fcn.00449ca9
add esp, 0x30
jmp 0x451e5e
push 0x20a
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x451e8e
lea eax, [ebp + 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
push eax
push 0x2d57
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0
call fcn.004522a3
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x452c52
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x452d0a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x452ce4
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x452cdc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x452cda
push 0
push 0x76e7
push 0x666c
push 0x3307
push 0x6aad
push 0x506a
push 0x71f6
call fcn.0045f276
add esp, 0x1c
jmp 0x452ce2
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x452d08
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 1
push 1
push dword [ebp - 0x24]
push 0x460d
push 0x12df
push 0x307b
call fcn.0044005c
add esp, 0x18
jmp 0x452d62
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x452d3a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 0x5133
push dword [ebp - 0x30]
push 1
call fcn.0044f9a5
add esp, 0xc
jmp 0x452d62
push 0
push 0x3e91
push 0x12ea
push 0x573c
push 0x62da
push 0x4efb
push 0x48da
call fcn.0045f276
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x45326e
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x453297
push 0x7df6
push 0x865
push 0x3a
push 1
call fcn.0045331c
add esp, 0x10
jmp 0x453318
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4532d3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0
push 0x57f3
call fcn.0044d115
add esp, 0xc
jmp 0x453318
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x453302
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x453318
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x453318
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret
Function at 0x4550ad
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4550e2
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
call fcn.00455146
add esp, 0x10
jmp 0x455142
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x455108
push 1
call fcn.0044e594
pop ecx
jmp 0x455142
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x455135
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [eax], 0x442f2aa7
jmp 0x455142
push 0x149a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esp, ebp
pop ebp
ret

Function at 0x455699
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x455746
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45571e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4556fc
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
push 0x2237
call fcn.0045703c
add esp, 0xc
jmp 0x45571c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x45571c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x455744
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x62fe
push 1
push dword [ebp - 0x28]
push 0x4a04
push 1
push 0x40f5
push 0
call fcn.0044debe
add esp, 0x1c
jmp 0x455784
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x38], eax
push 1
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0x4392
push 1
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
push eax
push 0x5777
call fcn.00441c93
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x45ae3e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x45af0b
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45aecd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x45aebe
mov byte [ebp - 1], 0
push 1
push 0x6588
push 1
push 0x48d7
push 0x36e7
push 1
lea eax, [ebp - 1]
push eax
push 0x3d8
push 1
push 0
call fcn.00451cdc
add esp, 0x28
jmp 0x45aecb
push 0xa47
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x45af09
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 1
push 0x521c
push 0x634e
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 1
push 0
call fcn.0045387b
add esp, 0x24
jmp 0x45af4f
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x48]
call fcn.004471a9
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x45b6d7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x45b761
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x3c]
mov dword [ebp - 0x20], eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x524e
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x6257
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x24]
push 0x11bc
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0045b80c
add esp, 0x38
jmp 0x45b808
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x45b799
push 0
push 0x5013
push 0x4a46
call fcn.0043a77a
add esp, 0xc
jmp 0x45b808
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x45b802
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x45b7e3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x45b800
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.00434a1c
mov dword [eax], 0x81438367
jmp 0x45b7d8
jmp 0x45b808
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esp, ebp
pop ebp
ret
Function at 0x48d065
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x49b03f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ae484]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0048aed4
mov dword [ebp - 0x14], eax
cmp dword [0xaa7c90], esi
jne 0x49b132
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x49b0bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x49b212
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x49b212
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49b212
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xaa7c90], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xaa7c94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xaa7c98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaa7ca0], eax
test eax, eax
je 0x49b12f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaa7c9c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x49b157
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x49b14a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x49b16c
push 4
pop eax
jmp 0x49b214
cmp dword [ebp - 0x14], esi
je 0x49b16c
push dword [0xaa7c90]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x49b151
mov eax, dword [0xaa7c9c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x49b1ca
cmp dword [0xaa7ca0], edi
je 0x49b1ca
push eax
call ebx
push dword [0xaa7ca0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x49b1ca
test eax, eax
je 0x49b1ca
call ecx
test eax, eax
je 0x49b1bf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x49b1bf
test byte [ebp - 8], 1
jne 0x49b1ca
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x49b1fa
mov eax, dword [0xaa7c94]
cmp eax, edi
je 0x49b1f7
push eax
call ebx
test eax, eax
je 0x49b1f7
call eax
mov esi, eax
test esi, esi
je 0x49b1f7
mov eax, dword [0xaa7c98]
cmp eax, edi
je 0x49b1f7
push eax
call ebx
test eax, eax
je 0x49b1f7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xaa7c90]
call ebx
test eax, eax
je 0x49b212
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x49b214
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048a37b
mov esp, ebp
pop ebp
ret
Function at 0x40ca40
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x493fbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00488d3e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40cac2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00486727
mov eax, dword [eax]
push 0x6d2c98
push eax
call fcn.004791d4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00488fc9
test bl, bl
je 0x40cac2
push 0x6d2c98
lea ecx, [esp + 0xc]
call fcn.00489359
push 0x6d2ca4
lea ecx, [esp + 0xc]
call fcn.00489359
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40cafe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00488fc9
jmp 0x40cbc9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40cb82
lea edx, [esp + 0x7c]
push 0x6d2ca0
push edx
call fcn.004791d4
add esp, 8
test eax, eax
je 0x40cb82
lea eax, [esp + 0x7c]
push 0x6d2c9c
push eax
call fcn.004791d4
add esp, 8
test eax, eax
je 0x40cb82
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40cb12
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00488fc9
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40d3d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40d432
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40d440
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49403b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x6e2390]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40d578
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40d4a6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00488fc9
xor eax, eax
jmp 0x40d5ef
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00489106
push esi
lea ecx, [esp + 0xc]
call fcn.00489395
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x6d2cd8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40d5cd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.0040d3d0
test eax, eax
jne 0x40d5cd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.0040d3d0
test eax, eax
jne 0x40d5cd
lea eax, [esp + 0x14]
push 0x6d2cb4
push eax
call fcn.0047a250
mov esi, eax
add esp, 8
test esi, esi
jne 0x40d5ac
lea ecx, [esp + 0x14]
push 0x6d2cb0
push ecx
call fcn.0047a1d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40d5ac
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40d5af
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004890b6
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40d4be
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00488fc9
xor eax, eax
jmp 0x40d5ef
mov byte [esi], 0
push 0x6d2cac
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00488fc9
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41e1e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41e24e
cmp si, 0x69
ja 0x41e24e
add esi, 0xffd0
cmp si, 0x11
je 0x41e21e
push 0x11
call edi
test ax, ax
jge 0x41e21e
or esi, 0x2000
cmp si, 0x10
je 0x41e233
push 0x10
call edi
test ax, ax
jge 0x41e233
or esi, 0x4000
cmp si, 0x12
je 0x41e248
push 0x12
call edi
test ax, ax
jge 0x41e248
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41e25b
mov esi, 0xbd
jmp 0x41e20f
cmp si, 0x6e
jne 0x41e268
mov esi, 0xbe
jmp 0x41e20f
cmp si, 0x6f
jne 0x41e209
mov esi, 0xbf
jmp 0x41e20f

Function at 0x41fa50
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x6f2ba8]
xor edx, edx
cmp eax, edx
jne 0x41fa76
xor eax, eax
mov byte [eax + 0x6f2aa8], al
inc eax
cmp eax, 0x100
jl 0x41fa5e
mov dword [0x6f2ba8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x6f2aa8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41fb07
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41fada
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41faa8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41fb80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41fbd3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41fbba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret