joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a77a5
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0xc6
cmp dword [eax + 0x54], eax
lea ebx, [esi + 0x38]
cmp dword [0x8783f07f], eax
xor byte [ebx + 0x1d], al
jp 0x5a7811
sbb dword [edi*4 - 0x7912bb47], edx
mov ds, word [eax + edx - 0xd]
dec ebx
adc al, 0xca
push esp
sar dword [edx], 1
outsd dx, dword [esi]
dec ecx
mov byte [ebp - 0x41a8271], bl
test ebp, ebp
imul eax, dword [esp + ecx + 0x4d], 0xffffff8f
pop eax
inc ecx
dec edx
sbb ch, al
or edi, dword [esi]
push ecx
cmp dword [ebp + 0x4d028185], esi
mov esi, 0x9965d95b
stosb byte es:[edi], al
jl 0x5a7806
js 0x5a780a
mov edi, 0x88cd15c0
invalid
mov edx, 0xfa3c342a
cli
and eax, 0x3d0f69fa
or ecx, edx
sbb eax, dword [0xf9c23c55]
rcr dword [ebx], 1
add eax, 0xf9c23c55
sub al, 0x67
inc eax
cmp al, 0xbc
in eax, dx
aam 0xf9
popal
test edx, ebx
mov cl, 0x87
xor byte [ecx + 0xd], cl
jo 0x5a7834
or eax, 0x9097067
push cs
or dword [esi], ecx
xor dword [edi + 0x4a], eax
xor byte [ecx + 0x3405f0a7], bl
sbb byte [eax - 0x2a], 0xb5
cdq
add eax, 0xd6588034
mov ch, 0x99
pop esi
or eax, 0x9d6eca0e
test eax, 0x43b4b307
jbe 0x5a7827
aas
jge 0x5a78a2
ljmp 0xe56e:0xf68819cd
movsd dword es:[edi], dword [esi]
push ebp
lds edx, [edi - 0x3358f688]
retf 0x8a26
Function at 0x5b9d8d
Capabilities:
Encode data using xor

Disassembly:
and ecx, dword [edx + 0x79]
cwde
daa
or eax, 0x887bf893
jns 0x5b9dbc
cmpsb byte [esi], byte es:[edi]
test dword [ebx + 5], ecx
ljmp 0xc67b
fmul qword [edx - 0x350ae495]
test al, 0x15
sub cl, byte [edx - 0x39]
push ds
rol dword [ebp + eax*2 + 0x2a17c2a7], cl
xchg edx, edi
add byte [ebx + 0x69], ah
and al, 0xa7
dec ebp
outsb dx, byte [esi]
dec eax
inc esi
and bh, byte [eax - 0x65]
js 0x5b9d4a
mov byte [edi + 0x6b82d3b6], dh
push esi
and al, 0x8f
outsd dx, dword [esi]
fimul word [eax - 0x78]
mov esp, dword [ebp + 0x4c94e885]
xor eax, 0x9a2a43ae
enter 0x35e3, 0xffffffffffffffc5
dec ebp
jne 0x5b9da9
xchg ebx, eax
pop es
mov bp, 0x652b
mov es, word [ecx - 0x60]
loope 0x5b9e16
sbb byte [eax - 0x52], 0xfe
xchg bl, ch
loope 0x5b9df2
sub bl, cl
xor al, byte [ebx - 0x24]
xchg esi, eax
salc
mov esp, 0x3a599d58
retf
out dx, eax
add eax, 0x78c9ba96
push edx
mov byte [ebx], bl
cmp esi, dword [edx]
loope 0x5b9e78
mov al, 0x2f
cmpsb byte [esi], byte es:[edi]
or bl, byte [eax]
scasb al, byte es:[edi]
jns 0x5b9e7c
not cl
xchg dword [0x9a79fe72], edx
dec ecx
jae 0x5b9dad
in al, 0x7b
fisttp qword [edx + 0x4c2b5bff]
call [ebx + 0x2b]
dec esp
stosd dword es:[edi], eax
push ss
invalid
dec ebp
pushfd
aad 0xb
sbb dword [edx + 0x42441204], ecx
mov bh, ch
xor esp, dword [esp + ebx - 0x34]
mov ebx, 0x3882d7b5
push 0x36
pushfd
xlatb
cmp byte [eax], 0x6a
pushfd
movsd dword es:[edi], dword [esi]
xchg byte [edx + 0x10], al
pop ds
clc
cld
jb 0x5b9ee5
pop ds
xchg ebp, eax
dec esi
inc ebx
dec edx
jbe 0x5b9e66
test byte [ecx - 0x4c], bl
inc esp
lodsd eax, dword [esi]
ret 0x850d
jl 0x5b9f13
pop esi
cdq
js 0x5b9f2d
sti
and al, 0x1d
sbb cl, byte [edi - 3]
push cs
cmpsb byte [esi], byte es:[edi]
jg 0x5b9ee1
lcall 0xc415, 0xa6936e8a
dec edx
sub byte [0x49885fe], ah
lodsb al, byte [esi]
int 0x1c
pop ebx
fild dword [esi]
sub cl, byte [0x6c259222]
ror byte [0x6b318c5], 1
invalid
lodsd eax, dword [esi]
push ds
pop eax
push ebp
mov ecx, dword [edi + edx]
push edi
test al, 0xe9
clc
aad 0xed
stosb byte es:[edi], al
int 0x47
or byte [ebp + 0x5fadf6cf], dl
cdq
mov esp, 0x5864f531
cmp byte [ebx - 0x77af15b1], ch
lodsb al, byte [esi]
adc eax, dword [esp + 0x38]
dec ebx
dec al
pop esi
add ch, al
out 0xa9, al
inc bl
and eax, 0xf6e94034
sbb byte [edi + 0x554df257], cl
invalid
Function at 0x61723c
Capabilities:
Encode data using xor

Disassembly:
jg 0x617208
xor ecx, eax
and eax, 0xcdcecdf7
cld
mov byte [eax - 0x51], 0xb3
sbb ecx, dword [ecx]
insd dword es:[edi], dx
pop eax
stc
sbb cl, dl
mov edi, 0x9011e6b9
push esp
int3
loope 0x61719b
jp 0x6171fa
test byte ds:[ebx + ebp*2], 0xf7
lcall 0x1917, 0x63ff9b81
in eax, dx
mov ecx, 0xb764711
sbb dword [ebx + 0x191763ff], 0x4711b9ed
jbe 0x617211
ret
inc eax
add dword [ecx + 0x17], 0xc
push ecx
mov ebx, dword [esi - 0x50]
fistp dword [edi - 0x4c753f86]
nop
scasb al, byte es:[edi]
aam 0x61
mov dh, byte [ebx + 0x61d4ae90]
cmp dword [eax], eax
cmp esp, ebx
xchg edx, eax
jp 0x617290
sar dword [edi - 0x42], 1
invalid
lcall 0xcf4e, 0xba4a5708
in al, dx
mov dl, 0xd5
je 0x617232
pushal
loope 0x617215
and ebp, 0xfb71e933
mov edi, 0x7f8a7175
cmp eax, 0xacefe63
mov dword [eax + eax*4 - 0x64], ecx
or dword [edx + 0x5f1c6e1c], ebx
mov edi, edi
jecxz 0x6171ee
leave
lsl ecx, word [ebx - 0x90b19a2]
sub al, 0x3f
por mm0, qword [esi + 0x2c]
fnsave dword [edi - 0x79cd15c1]
mov dl, 0x5b
invalid
push edx
or dword [ecx - 0x5d7c973a], ebx
sub bl, byte [ebx]
sbb al, 0xee
sti
mov gs, ecx
iretd

Function at 0x62d641
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cdq
sub byte [esi], bh
fisttp dword [edx]
lcall 0x6de9, 0x5928dfa0
mov eax, dword [ecx - 0x37]
movsd dword es:[edi], dword [esi]
inc edx
adc ebp, dword [ebx - 0x14]
dec ebx
fidivr dword [ecx - 0x12]
add dl, byte [eax - 0x11]
and esp, dword [edx]
pop edi
sub ah, dh
xor eax, 0x3cc0e75a
aas
cld
invalid
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x403203
pop dword [ebp - 0xc]
mov eax, 0x40fc6041
add eax, 0xbf43d1c2
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xec0fe6d0
add dword [ebp - 0x1c], 0x62425e7b
mov dword [ebp - 0x18], 0x5241d0c6
add dword [ebp - 0x18], 0xdff17b7f
mov dword [ebp - 0x14], 0x80899cc1
add dword [ebp - 0x14], 0xcbc2a76d
mov dword [ebp - 0x10], 0xa6718079
add dword [ebp - 0x10], 0x598e7f87
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xeee22ebc
sub eax, 0xeea1ae30
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x3ecd926c
add dword [ebp - 0x1c], 0x35a4d6ea
mov dword [ebp - 0x18], 0xa78cb54
add dword [ebp - 0x18], 0x36f39621
mov dword [ebp - 0x14], 0x8457cabd
add dword [ebp - 0x14], 0xdf17a1af
mov dword [ebp - 0x10], 0x7d52a413
sub dword [ebp - 0x10], 0x7d52a413
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x33e59
push 0
call eax
mov ecx, 0x4d56d9ec
sub ecx, 0x4d569cb6
mov edi, eax
mov esi, 0x411000
add esi, dword [ebp - 0xc]
mov ebx, 0xec87207e
add ebx, 0x71d16c25
xor dword [ebp - 8], 0x645064d0
mov edx, dword [esi]
xor dword [ebp - 4], edx
sub edx, ebx
xor dword [ebp - 4], eax
mov dword [edi], edx
mov dword [ebp - 4], 0xa5b741db
add edi, 0x676f0d3b
add edi, 0x9890f2c9
add esi, 0xa6ad44ed
sub esi, 0xa6ad44e9
loop 0x40331a
add eax, 0x11a3ad06
sub eax, 0x11a2c55b
mov ebx, eax
add eax, 0x27ed96e2
sub eax, 0x27ed96dd
mov ecx, 0x56dc11d2
add ecx, 0xa963ee2e
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x41df40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
jmp 0x41df5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41df61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41df50
mov eax, 1
add ebx, ebx
jne 0x41df73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41df68
jne 0x41df84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41df68
xor ecx, ecx
sub eax, 3
jb 0x41df98
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41e00a
mov ebp, eax
add ebx, ebx
jne 0x41dfa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41dfb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41dfd4
inc ecx
add ebx, ebx
jne 0x41dfc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41dfb5
jne 0x41dfd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41dfb5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41dff4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41dfe5
jmp 0x41df56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41dff4
add edi, ecx
jmp 0x41df56
pop esi
mov edi, esi
mov ecx, 0x32
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41e012
cmp byte [edi], 2
jne 0x41e012
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41e017
lea edi, [esi + 0x1b000]
mov eax, dword [edi]
or eax, eax
je 0x41e08f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e934]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e998]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41e044
mov ecx, edi
jns 0x41e073
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e9a0]
or eax, eax
je 0x41e089
mov dword [ebx], eax
add ebx, 4
jmp 0x41e061
call dword [esi + 0x1e99c]
mov ebp, dword [esi + 0x1e9a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41e0c3
sub esp, 0xffffff80
jmp 0x4017a0
Function at 0x42c0f0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x42c115
xor eax, eax
jmp 0x42c16c
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
jne 0x42c12a
xor eax, eax
jmp 0x42c16c
push ebp
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
call fcn.0042bb60
mov esp, ebp
pop ebp
ret

Function at 0x42c1e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x3000
mov dword [ebp - 4], 0x40
mov dword [ebp - 8], 0
push str.VirtualAlloc
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42e0fc], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [0x42e0fc]
mov esp, ebp
pop ebp
ret

Function at 0x40ed62
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x40eae0
call fcn.0040ed77
xor dword [esi], eax
inc esi
inc edx
add ebx, edx
cmp esi, edi
jne fcn.0040ed62
ret
Function at 0x8ccbbf
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x8cc92e
dec ebx
and ebx, ebx
sub esi, 0x6a39e93
call fcn.008ccbf5
sub esp, 4
mov dword [esp], ebx
pop esi
inc esi
push esi
pop ebx
xor dword [eax], ecx
mov esi, 0x151acf9d
or ebx, ebx
inc eax
mov ebx, ebx
add esi, esi
dec esi
cmp eax, edi
jne fcn.008ccbbf
or esi, esi
add esi, esi
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42a509
Capabilities:
Terminate process

Disassembly:
jmp 0x45c841
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45c852
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.0042b927
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x42a59f
Capabilities:
Query environment variable

Disassembly:
jmp 0x45fc8a
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x45fc9e
xor edi, edi
jmp 0x45fcd5
push ebx
push esi
call fcn.0045fb94
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0042aad1
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45fcc5
push ebx
push esi
push edi
call fcn.0042b7c9
add esp, 0xc
push 0
call fcn.0042be22
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x42b850
Capabilities:
Parse pe header

Disassembly:
jmp 0x430f18
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x430f58
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x430f58
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x430f58
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x430f58
cmp dword [ecx + 0x74], 0xe
jbe 0x430f58
cmp dword [ecx + 0xe8], 0
je 0x430f58
mov al, 1
ret
xor al, al
ret

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x23f532f5
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1fed34db
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x439af0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cda0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004c2967
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x439b72
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004c0879
mov eax, dword [eax]
push 0x4f4c80
push eax
call fcn.004af8e4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004c2bf2
test bl, bl
je 0x439b72
push 0x4f4c80
lea ecx, [esp + 0xc]
call fcn.004c2f82
push 0x4f4c8c
lea ecx, [esp + 0xc]
call fcn.004c2f82
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x439bae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004c2bf2
jmp 0x439c79
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x439c32
lea edx, [esp + 0x7c]
push 0x4f4c88
push edx
call fcn.004af8e4
add esp, 8
test eax, eax
je 0x439c32
lea eax, [esp + 0x7c]
push 0x4f4c84
push eax
call fcn.004af8e4
add esp, 8
test eax, eax
je 0x439c32
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x439bc2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004c2bf2
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x43a480
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x43a4e2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x43a4f0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cda8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5061e8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x43a628
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x43a556
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004c2bf2
xor eax, eax
jmp 0x43a69f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004c2d2f
push esi
lea ecx, [esp + 0xc]
call fcn.004c2fbe
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x43a67d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0043a480
test eax, eax
jne 0x43a67d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0043a480
test eax, eax
jne 0x43a67d
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.004b0ae0
mov esi, eax
add esp, 8
test esi, esi
jne 0x43a65c
lea ecx, [esp + 0x14]
push 0x4f4c98
push ecx
call fcn.004b0a60
mov esi, eax
add esp, 8
test esi, esi
jne 0x43a65c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x43a65f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004c2cdf
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x43a56e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004c2bf2
xor eax, eax
jmp 0x43a69f
mov byte [esi], 0
push 0x4f4c94
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004c2bf2
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x4499c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x449a2e
cmp si, 0x69
ja 0x449a2e
add esi, 0xffd0
cmp si, 0x11
je 0x4499fe
push 0x11
call edi
test ax, ax
jge 0x4499fe
or esi, 0x2000
cmp si, 0x10
je 0x449a13
push 0x10
call edi
test ax, ax
jge 0x449a13
or esi, 0x4000
cmp si, 0x12
je 0x449a28
push 0x12
call edi
test ax, ax
jge 0x449a28
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x449a3b
mov esi, 0xbd
jmp 0x4499ef
cmp si, 0x6e
jne 0x449a48
mov esi, 0xbe
jmp 0x4499ef
cmp si, 0x6f
jne 0x4499e9
mov esi, 0xbf
jmp 0x4499ef

Function at 0x44b2d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5172a0]
xor edx, edx
cmp eax, edx
jne 0x44b2f6
xor eax, eax
mov byte [eax + 0x5171a0], al
inc eax
cmp eax, 0x100
jl 0x44b2de
mov dword [0x5172a0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5171a0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x44b387
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x44b35a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x44b328
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x44b390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x44b3e3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x44b3ca
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret