joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41493e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add edi, 0x8944
call 0x414554
add byte [ecx + 0x49], cl
xor eax, 0x3f473d39
dec esp
add esp, 4
jmp 0x41455c
sub edi, 0xf79b
pop edi
push ecx
jmp 0x41456c
pop ecx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push ebx
push edi
add esp, 4
sub ebx, 0x4125
add ebx, 0x42a4
or ebx, 0xd804
pop ebx
push esi
add esi, 0x160c8
add esi, 0x10af8
and esi, 0xe168
xor esi, 0x67eb
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push ecx
add ecx, 0x8bc
xor ecx, 0x7373
call 0x41464b
add byte [0x464d4136], bh
dec edx
cmp cl, byte [edx + 0x3f]
add esp, 4
call 0x41465d
add byte [edx + 0x43], al
cmp eax, 0x42393247
dec esi
xor eax, 0x5904c483
cmp dword [ebp - 0x1614], 0
jne 0x414679
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push edi
push edx
add esp, 4
or edi, 0x124a5
add edi, 0x72fe
pop edi
push edi
push ecx
add esp, 4
or edi, 0x5b9d
jmp 0x4146b0
or edi, 0x3f9c
add edi, 0x105e0
pop edi
cmp dword [ebp - 0xcc4], 0
jne 0x4146d5
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
sub edi, 0x16ddf
add edi, 0x16b67
add edi, 0x138e0
pop edi
push eax
push edi
add esp, 4
or eax, 0x41f7
add eax, 0x9bc9
xor eax, 0xc596
xor eax, 0xe18f
pop eax
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
sub ebx, 0x6c96
jmp 0x41474a
pop ebx
push edi
xor edi, 0xdc80
or edi, 0x17c1b
call 0x414765
add byte [ecx + 0x50], cl
xor bh, byte [esi]
cmp eax, 0xc483414c
add al, 0x81
iretd
push edi
push edx
add esp, 4
sub edi, 0x9c8d
and edi, 0xa450
call 0x41493e
add byte [ebx + 0x33], al
dec ecx
inc eax
dec edx
inc ecx
cmp eax, dword [ebx + 0x8e804c4]
add byte [eax], al
add byte [eax], al
cmp ecx, dword [ecx + 0x4e]
inc ecx
dec ecx
cmp esi, dword [esi]
add esp, 4
add al, 0x5f
cmp dword [ebp - 0x2fc], 0
jne 0x415257
mov eax, 0x6b
mov word [ebp - 0x1790], ax
mov ecx, 0x65
mov word [ebp - 0x178e], cx
mov edx, 0x72
mov word [ebp - 0x178c], dx
mov eax, 0x6e
mov word [ebp - 0x178a], ax
mov ecx, 0x65
mov word [ebp - 0x1788], cx
mov edx, 0x6c
mov word [ebp - 0x1786], dx
mov eax, 0x33
mov word [ebp - 0x1784], ax
mov ecx, 0x32
mov word [ebp - 0x1782], cx
mov edx, 0x2e
mov word [ebp - 0x1780], dx
mov eax, 0x64
mov word [ebp - 0x177e], ax
mov ecx, 0x6c
invalid
invalid
invalid
invalid
Function at 0x41494e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add edi, 0x8944
call 0x414554
add byte [ecx + 0x49], cl
xor eax, 0x3f473d39
dec esp
add esp, 4
jmp 0x41455c
sub edi, 0xf79b
pop edi
push ecx
jmp 0x41456c
pop ecx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push ebx
push edi
add esp, 4
sub ebx, 0x4125
add ebx, 0x42a4
or ebx, 0xd804
pop ebx
push esi
add esi, 0x160c8
add esi, 0x10af8
and esi, 0xe168
xor esi, 0x67eb
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push ecx
add ecx, 0x8bc
xor ecx, 0x7373
call 0x41464b
add byte [0x464d4136], bh
dec edx
cmp cl, byte [edx + 0x3f]
add esp, 4
call 0x41465d
add byte [edx + 0x43], al
cmp eax, 0x42393247
dec esi
xor eax, 0x5904c483
cmp dword [ebp - 0x1614], 0
jne 0x414679
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push edi
push edx
add esp, 4
or edi, 0x124a5
add edi, 0x72fe
pop edi
push edi
push ecx
add esp, 4
or edi, 0x5b9d
jmp 0x4146b0
or edi, 0x3f9c
add edi, 0x105e0
pop edi
cmp dword [ebp - 0xcc4], 0
jne 0x4146d5
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
sub edi, 0x16ddf
add edi, 0x16b67
add edi, 0x138e0
pop edi
push eax
push edi
add esp, 4
or eax, 0x41f7
add eax, 0x9bc9
xor eax, 0xc596
xor eax, 0xe18f
pop eax
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
sub ebx, 0x6c96
jmp 0x41474a
pop ebx
push edi
xor edi, 0xdc80
or edi, 0x17c1b
call 0x414765
add byte [ecx + 0x50], cl
xor bh, byte [esi]
cmp eax, 0xc483414c
add al, 0x81
iretd
push edi
push edx
add esp, 4
sub edi, 0x9c8d
and edi, 0xa450
call 0x41493e
add byte [ebx + 0x33], al
dec ecx
inc eax
dec edx
inc ecx
cmp eax, dword [ebx + 0x8e804c4]
add byte [eax], al
add byte [eax], al
cmp ecx, dword [ecx + 0x4e]
inc ecx
dec ecx
cmp esi, dword [esi]
add esp, 4
add al, 0x5f
cmp dword [ebp - 0x2fc], 0
jne 0x415257
mov eax, 0x6b
mov word [ebp - 0x1790], ax
mov ecx, 0x65
mov word [ebp - 0x178e], cx
mov edx, 0x72
mov word [ebp - 0x178c], dx
mov eax, 0x6e
mov word [ebp - 0x178a], ax
mov ecx, 0x65
mov word [ebp - 0x1788], cx
mov edx, 0x6c
mov word [ebp - 0x1786], dx
mov eax, 0x33
mov word [ebp - 0x1784], ax
mov ecx, 0x32
mov word [ebp - 0x1782], cx
mov edx, 0x2e
mov word [ebp - 0x1780], dx
mov eax, 0x64
mov word [ebp - 0x177e], ax
mov ecx, 0x6c
invalid
invalid
invalid
invalid
Function at 0x414950
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add edi, 0x8944
call 0x414554
add byte [ecx + 0x49], cl
xor eax, 0x3f473d39
dec esp
add esp, 4
jmp 0x41455c
sub edi, 0xf79b
pop edi
push ecx
jmp 0x41456c
pop ecx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push ebx
push edi
add esp, 4
sub ebx, 0x4125
add ebx, 0x42a4
or ebx, 0xd804
pop ebx
push esi
add esi, 0x160c8
add esi, 0x10af8
and esi, 0xe168
xor esi, 0x67eb
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push ecx
add ecx, 0x8bc
xor ecx, 0x7373
call 0x41464b
add byte [0x464d4136], bh
dec edx
cmp cl, byte [edx + 0x3f]
add esp, 4
call 0x41465d
add byte [edx + 0x43], al
cmp eax, 0x42393247
dec esi
xor eax, 0x5904c483
cmp dword [ebp - 0x1614], 0
jne 0x414679
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push edi
push edx
add esp, 4
or edi, 0x124a5
add edi, 0x72fe
pop edi
push edi
push ecx
add esp, 4
or edi, 0x5b9d
jmp 0x4146b0
or edi, 0x3f9c
add edi, 0x105e0
pop edi
cmp dword [ebp - 0xcc4], 0
jne 0x4146d5
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
sub edi, 0x16ddf
add edi, 0x16b67
add edi, 0x138e0
pop edi
push eax
push edi
add esp, 4
or eax, 0x41f7
add eax, 0x9bc9
xor eax, 0xc596
xor eax, 0xe18f
pop eax
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
sub ebx, 0x6c96
jmp 0x41474a
pop ebx
push edi
xor edi, 0xdc80
or edi, 0x17c1b
call 0x414765
add byte [ecx + 0x50], cl
xor bh, byte [esi]
cmp eax, 0xc483414c
add al, 0x81
iretd
push edi
push edx
add esp, 4
sub edi, 0x9c8d
and edi, 0xa450
call 0x41493e
add byte [ebx + 0x33], al
dec ecx
inc eax
dec edx
inc ecx
cmp eax, dword [ebx + 0x8e804c4]
add byte [eax], al
add byte [eax], al
cmp ecx, dword [ecx + 0x4e]
inc ecx
dec ecx
cmp esi, dword [esi]
add esp, 4
add al, 0x5f
cmp dword [ebp - 0x2fc], 0
jne 0x415257
mov eax, 0x6b
mov word [ebp - 0x1790], ax
mov ecx, 0x65
mov word [ebp - 0x178e], cx
mov edx, 0x72
mov word [ebp - 0x178c], dx
mov eax, 0x6e
mov word [ebp - 0x178a], ax
mov ecx, 0x65
mov word [ebp - 0x1788], cx
mov edx, 0x6c
mov word [ebp - 0x1786], dx
mov eax, 0x33
mov word [ebp - 0x1784], ax
mov ecx, 0x32
mov word [ebp - 0x1782], cx
mov edx, 0x2e
mov word [ebp - 0x1780], dx
mov eax, 0x64
mov word [ebp - 0x177e], ax
mov ecx, 0x6c
invalid
invalid
invalid
invalid
Function at 0x4149e0
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x6cfc49e4
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
xchg al, ch
invalid

Function at 0x414aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg ebp, eax
out 0xff, al
dec dword [ebx - 0x7a76cfbe]
pushal
out 0xff, al
dec dword [ebx - 0x199f73]
dec dword [ecx - 0x161f73]
call dword [ebx - 0x7f]
jecxz 0x414a93
invalid
jp 0x414ab3
add byte [ecx + 0x13767e3], al
add byte [ecx + 0x1569ee3], al
add byte [ebx + 0x52], bl
pop ebx
push edx

Function at 0x414ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg ebp, eax
out 0xff, al
dec dword [ebx - 0x7a76cfbe]
pushal
out 0xff, al
dec dword [ebx - 0x199f73]
dec dword [ecx - 0x161f73]
call dword [ebx - 0x7f]
jecxz 0x414a93
invalid
jp 0x414ab3
add byte [ecx + 0x13767e3], al
add byte [ecx + 0x1569ee3], al
add byte [ebx + 0x52], bl
pop ebx
push edx

Function at 0x414ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop ebx
push edx
push edi
add esp, 4
or edx, 0x9339
add edx, 0x262
xor edx, 0x2b3a
xor edx, 0x17b30
pop edx
cmp dword [ebp - 0x1620], 0
jne 0x414af7
mov dword [ebp - 0x774], 0
jmp 0x414d9e
mov edx, dword [ebp - 0x1620]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd0], ecx
push ecx
xor ecx, 0x9bf1

Function at 0x414b10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop ecx
push eax
or eax, 0x4f50
jmp 0x414b1f
and eax, 0x997
pop eax
push eax
push esi
add esp, 4
jmp 0x414b34
add eax, 0x3a10
pop eax
cmp dword [ebp - 0xcd0], 0
jne 0x414b53
mov dword [ebp - 0x774], 0
jmp 0x414d9e
mov edx, dword [ebp - 0xcd0]
mov dword [ebp - 0x518], edx
Function at 0x415265
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 0x5f
push ebx
call 0x415265
add byte [esi], dh
xor ecx, dword [edi + 0x42]
inc edx
dec ebp
inc esi
add esp, 4
and ebx, 0x1337e
pop ebx
push eax
and eax, 0x182b6
or eax, 0x59aa
xor eax, 0x9110
xor eax, 0x165e0
pop eax
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19bc], ecx
mov edx, dword [ebp - 0x19bc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19c0], eax
mov ecx, dword [ebp - 0x19c0]
mov dword [ebp - 0x167c], ecx
push ecx
push edi
add esp, 4
or ecx, 0x429f
add ecx, 0x88
pop ecx
push eax
xor eax, 0x2454
call 0x4152d9
add byte [edx], bh
cmp al, 0x33
xor cl, byte [ecx + 0x35]
cmp dword [ebx - 0x7d], eax
les eax, [ecx + eax*4]
invalid

Function at 0x4152d9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 0x5f
push ebx
call 0x415265
add byte [esi], dh
xor ecx, dword [edi + 0x42]
inc edx
dec ebp
inc esi
add esp, 4
and ebx, 0x1337e
pop ebx
push eax
and eax, 0x182b6
or eax, 0x59aa
xor eax, 0x9110
xor eax, 0x165e0
pop eax
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19bc], ecx
mov edx, dword [ebp - 0x19bc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19c0], eax
mov ecx, dword [ebp - 0x19c0]
mov dword [ebp - 0x167c], ecx
push ecx
push edi
add esp, 4
or ecx, 0x429f
add ecx, 0x88
pop ecx
push eax
xor eax, 0x2454
call 0x4152d9
add byte [edx], bh
cmp al, 0x33
xor cl, byte [ecx + 0x35]
cmp dword [ebx - 0x7d], eax
les eax, [ecx + eax*4]
invalid
Function at 0x426420
Capabilities:
Encode data using xor

Disassembly:
push eax
add al, byte [edx]
and ebx, 0xffffffaa
add eax, dword gs:[edx]
pop ebx
push ebp
add ebp, 0x4f
sbb eax, dword [edx]

Function at 0x433fe0
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x14
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
push esi
mov ebp, dword [esp + 0x20]
xor esi, esi
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x38]
push ecx
mov byte [esp + 0x3c], 0
mov byte [esp + 0x3d], 0
mov byte [esp + 0x3e], 0
mov byte [esp + 0x3f], 0
mov byte [esp + 0x40], 0
mov byte [esp + 0x41], 5
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x43404e
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005308cb
add esp, 0x14
ret
mov eax, dword [esp + 8]
push ebx
push edi
mov dword [esp + 0x14], eax
cmp dword [ebp], esi
jbe 0x434081
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea edi, [ebp + 4]
mov edx, dword [edi]
mov eax, dword [esp + 0x10]
push edx
push eax
call ebx
test eax, eax
jne 0x4340a1
inc esi
add edi, 8
cmp esi, dword [ebp]
jb 0x434066
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43408c
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop edi
pop ebx
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005308cb
add esp, 0x14
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4340b0
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp + 0x20]
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.005308cb
add esp, 0x14
ret
Function at 0x49f040
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5a53f4]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call int.00414070
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004140d0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x49f0ab
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00414080
mov eax, dword [ebp - 0x224]
jmp 0x49f13c
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x49f111
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0049f040
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x49f108
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00414080
mov eax, dword [ebp - 0x228]
jmp 0x49f13c
mov dword [ebp - 4], 0x100
jmp 0x49f0b2
lea ecx, [ebp - 0x14]
call fcn.004140a0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.0049efe0
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00414080
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005308cb
mov esp, ebp
pop ebp
ret 4
Function at 0x4d1620
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 0x18

Function at 0x4d1650
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.004d1510
add esp, 4
test eax, eax
jne 0x4d166a
xor eax, eax
jmp 0x4d1674
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop ebp
ret

Function at 0x4d2300
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.00404d40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 4]
push eax
call fcn.004d2600
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x4d234d
lea ecx, [ebp - 4]
call fcn.00404d60
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 5], 0
lea ecx, [ebp - 4]
call fcn.00404d70
mov al, byte [ebp - 5]
jmp 0x4d235c
mov byte [ebp - 6], 1
lea ecx, [ebp - 4]
call fcn.00404d70
mov al, byte [ebp - 6]
mov esp, ebp
pop ebp
ret

Function at 0x4d2980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
jne 0x4d2989
xor ecx, ecx
jne 0x4d2989
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d29c2
call fcn.0049d070
jmp 0x4d29d8
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
je 0x4d29d6
push 0x26
call fcn.0049cfc0
add esp, 4
jmp 0x4d29d8
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4d5e30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x10
call fcn.0048fd70
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4d5f02
mov byte [ebp - 1], 0
mov ecx, dword [ebp + 8]
add ecx, 0xc
call fcn.004d7620
movzx eax, al
test eax, eax
je 0x4d5e83
cmp dword [ebp + 0xc], 0x102
je 0x4d5e7f
cmp dword [ebp + 0xc], 0x100
je 0x4d5e7f
cmp dword [ebp + 0xc], 0x101
jne 0x4d5e83
mov byte [ebp - 1], 1
movzx ecx, byte [ebp - 1]
test ecx, ecx
jne 0x4d5f02
cmp dword [ebp + 0xc], 0x102
je 0x4d5eb8
cmp dword [ebp + 0xc], 0x100
je 0x4d5eb8
cmp dword [ebp + 0xc], 0x101
je 0x4d5eb8
cmp dword [ebp + 0xc], 0x200
jb 0x4d5f02
cmp dword [ebp + 0xc], 0x20d
ja 0x4d5f02
cmp dword [ebp + 0xc], 0x100
jne 0x4d5eeb
cmp dword [ebp + 0x10], 0x41
jne 0x4d5eeb
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x4d5eeb
push 0
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x10
call fcn.004d6110
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x10
call fcn.004d7240
xor eax, eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp int.00401219