joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460ddf
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x460e17
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045ee96
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045ee6e
jmp 0x460e23
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4624cd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46250f
call fcn.0046804e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46250f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x462506
xor eax, eax
jmp 0x462517
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046251d
pop edi
pop esi
pop ebx
ret 4

Function at 0x46857e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4685ac
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4685ca
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004684e4
jmp 0x4685ca
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4685ca
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004684e4
test edi, edi
mov eax, edi
jne 0x4685b4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x50eb95
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
jmp 0x50eba8
movzx ebx, byte [eax]
movzx edx, byte [eax + 1]
movzx edi, byte [eax + 5]
shl ebx, 8
xor ebx, edx
movzx edx, byte [eax + 2]
shl ebx, 8
xor ebx, edx
movzx edx, byte [eax + 3]
shl ebx, 8
xor ebx, edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 6]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 7]
shl edx, 8
xor edx, edi
xor edx, dword [ecx + 4]
movzx edi, byte [eax + 9]
mov dword [ebp - 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 0xa]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 0xb]
shl edx, 8
xor edx, edi
xor edx, dword [ecx + 8]
movzx edi, byte [eax + 0xd]
mov dword [ebp - 0x10], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
xor ebx, dword [ecx]
shl edx, 8
xor edx, edi
mov edi, dword [ebp - 0x10]
shl edx, 8
xor edx, eax
xor edx, dword [ecx + 0xc]
shr edi, 8
mov dword [ebp - 0x14], edx
shr edx, 0x10
mov eax, 0xff
and edx, eax
mov edx, dword [edx*4 + 0x519bd0]
and edi, eax
xor edx, dword [edi*4 + 0x519fd0]
mov edi, ebx
shr edi, 0x18
xor edx, dword [edi*4 + 0x5197d0]
mov edi, dword [ebp - 4]
and edi, eax
xor edx, dword [edi*4 + 0x51a3d0]
mov edi, ebx
xor edx, dword [ecx + 0x10]
shr edi, 0x10
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x14]
shr edx, 8
and edx, eax
and edi, eax
mov dword [ebp - 8], edi
mov edi, dword [edx*4 + 0x519fd0]
mov edx, dword [ebp - 8]
xor edi, dword [edx*4 + 0x519bd0]
mov edx, dword [ebp - 4]
shr edx, 0x18
xor edi, dword [edx*4 + 0x5197d0]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
and edx, eax
xor edi, dword [edx*4 + 0x51a3d0]
mov edx, dword [ebp - 4]
shr edx, 0x10
shr ebx, 8
and edx, eax
mov edx, dword [edx*4 + 0x519bd0]
and ebx, eax
xor edx, dword [ebx*4 + 0x519fd0]
mov ebx, dword [ebp - 0x10]
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x5197d0]
mov ebx, dword [ebp - 0x14]
and ebx, eax
xor edx, dword [ebx*4 + 0x51a3d0]
mov ebx, dword [ebp - 4]
xor edx, dword [ecx + 0x18]
xor edi, dword [ecx + 0x14]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 0x10]
shr edx, 0x10
shr ebx, 8
and edx, eax
mov edx, dword [edx*4 + 0x519bd0]
and ebx, eax
xor edx, dword [ebx*4 + 0x519fd0]
mov ebx, dword [ebp - 0x14]
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x5197d0]
mov ebx, dword [ebp - 0x18]
and ebx, eax
xor edx, dword [ebx*4 + 0x51a3d0]
mov ebx, dword [ebp + 8]
xor edx, dword [ecx + 0x1c]
sar ebx, 1
add ecx, 0x20
dec ebx
mov dword [ebp + 8], ebx
jmp 0x50ef18

Function at 0x51dd5c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 2]
lea esp, [esp + 7]
jmp 0x51dd33

Function at 0x542e88
Capabilities:
Hash data with md5

Disassembly:
mov ecx, 0x7bbb4829
lea esp, [esp + 4]
mov dword [eax + 8], 0x67452301
call fcn.00542ed7
and byte [edx + edx*2 + 0x1672c435], bh
mov dword [ecx], ebx
js 0x542e2e
mov byte ss:[edx], ch
mov eax, 0xcbad2adf
bound ebx, qword [ebp + 0x424648d]
Function at 0x62de95
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0xf], bl
xchg dx, ax
jmp 0x62decc
mov bx, word [esp + 0xe]
mov dl, dh
xchg ebp, edx
mov cx, 0x9719
bswap ebp
pop dword [esp + 0xa]
jmp 0x62df0b
mov ecx, 0x7b61e016
cpuid
xchg edx, eax
mov edi, dword [esp + 9]
mov cx, word [esp + 0x18]
popal
jmp 0x62df3b

Function at 0x62e05e
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ax, 0xf0bc
mov cx, bx
neg bx
rdtsc
jmp 0x62e0a0
pop dword [esp + 7]
bswap ebp
lea ebx, [edx*4]
setg ah
jmp 0x62e0fe
mov ax, 0xfbdf
lea esp, [esp + 0xe]
lea esi, [esi - 0x4d]
mov al, ah
setae bh
mov dh, byte [esp + 0xa]
jmp 0x62e08a
xchg dword [esp], esi
mov al, 0x76
clc
mov bp, dx
xchg dword [esp + 8], ebx
pushal
jmp 0x62e113
xchg dword [esp + 2], ebp
sub esp, 4
mov byte [esp + 0xb], bh
mov esi, ebp
inc edi
xchg word [esp + 6], cx
jmp 0x62e0d9
setnp ah
popal
mov word [esp + 0xc], bx
mov cl, 0x3a
add cx, 0xc81e
push dword [esp + 0xa]
jmp 0x62e23f
btc ebx, ebx
and di, 0xebd2
mov cx, 0xb3a3
btr eax, esp
jmp 0x62e176
rdtsc
mov bl, 0x78
xchg dword [esp + 0xa], ecx
push esp
sub edi, eax
pop dword [esp]
jmp 0x62e14e
mov ebx, dword [esp + 0xb]
mov bp, word [esp]
mov dword [esp + 5], ebp
pop ecx
lea esp, [esp + 5]
pop ecx
jmp 0x62e1c4
bswap edx
cpuid
mov dl, byte [esp]
btr edi, edx
mov eax, ebp
sub esp, 0x10
jmp 0x62e166
mov bh, byte [esp + 3]
xchg dword [esp], eax
pop ecx
lea ebx, [esp + ebx]
xchg ah, bl
mov bx, word [esp]
jmp 0x62e192
cpuid
bswap ebp
not di
xchg esi, eax
mov esi, dword [esp]
pushal
jmp 0x62e221
mov bx, word [esp + 0xb]
mov si, word [esp + 0xf]
mov word [esp + 0x11], bx
setne bh
lea esp, [esp + 0x2e]
lea esp, [esp + 0xb]
jmp 0x62e1b1
pop dword [esp + 0x30]
rdtsc
lea edx, [edx + ebp]
mov edx, 0xb5d88684
push word [esp + 0x17]
call fcn.0062e26e
lea eax, [edx + ebx*4]
std
or al, 0xe3
cmp eax, 0xb34021b1
pop edi
cmp eax, 0xb24720b2
push eax
xor ecx, dword [edi + 0x2a192444]
fsub qword [esi - 0x79]
ljmp 0x861b
pop dword [esp + 0x19]
sub bl, ah
xchg dx, bp
xchg word [esp + 0x1b], bp
xchg byte [esp + 0xc], al
pushal
jmp 0x62e1f6
sub esp, 0xc
push dword [esp + 8]
pop dx
sub esp, 0x18
rdtsc
neg edi
jmp 0x62e1da

Function at 0x62e326
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 4]
pop word [esp + 2]
mov ebp, dword [esp + 0xe]
xchg word [esp + 0xc], bx
jmp 0x62e46c
pop dword [esp + 6]
sub esp, 0x16
rdtsc
popal
bswap esi
btr eax, edx
jmp 0x62e3a0
neg bx
push word [esp + 1]
xchg ch, dl
push word [esp + 0xe]
bsr cx, cx
xchg di, si
jmp 0x62e371
lea eax, [edx*4]
mov di, sp
pop eax
clc
not ebp
mov esi, eax
jmp 0x62e423
lea ebp, [ecx*4]
cmc
mov dh, byte [esp]
rdtsc
xchg di, ax
xchg ch, dl
jmp 0x62e388
push dword [esp]
mov ax, 0x7153
not si
mov si, word [esp + 1]
lea ecx, [ebx*4]
mov dword [esp + 2], eax
jmp fcn.0062e3fb
mov bl, bh
mov dword [esp + 0xd], ebp
xchg ebx, ebp
add esp, 0
xchg byte [esp + 2], cl
mov dword [esp + 4], ebp
jmp 0x62e3bc
Function at 0x62e535
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, 0x8a
inc eax
mov dl, 0x9c
mov dx, 0x30e1
setae bh
jmp 0x62e591
mov word [esp + 2], bx
sub esp, 0x1e
push word [esp + 0x1a]
xchg dword [esp + 5], esi
bswap ebp
jmp 0x62e5a3
bsr ax, bp
bswap eax
mov dl, dh
rdtsc
mov bh, byte [esp + 1]
xchg ch, dl
jmp 0x62e577
shl bx, cl
lea ebx, [esi + 0x3d40574d]
mov ecx, dword [esp + 4]
xchg ecx, eax
mov edi, dword [esp + 0xb]
rdtsc
jmp 0x62e61e
lea eax, [esp + edi]
pop dword [esp + 0xc]
xchg ecx, eax
push word [esp + 0x13]
mov bp, 0x83f9
jmp 0x62e636
mov si, 0x581d
lea esp, [esp + 0x1f]
xchg word [esp + 3], bp
mov dh, byte [esp + 3]
bswap edi
sub esp, 0x1a
jmp 0x62e605
pop dword [esp + 0x12]
lea esp, [esp + 0xb]
stc
mov bl, 0x68
cpuid
lea eax, [ebp - 0xbf]
jmp 0x62ea1e
cmc
mov cx, word [esp + 0x10]
btr ecx, edx
add esp, 1
mov edx, dword [esp + 0x12]
xchg ch, dl
jmp 0x62e6ce
lea ebp, [ecx + 0xbb]
mov dword [esp + 1], ecx
xchg dword [esp], edx
rdtsc
cpuid
sub esp, 0x10
jmp 0x62e67c
xchg word [esp + 2], bp
add esp, 3
mov dword [esp + 5], ecx
not bx
pop dword [esp]
mov byte [esp + 2], bh
jmp 0x62e694
pop word [esp + 0xb]
mov si, 0x8b07
cmc
setl ah
add esp, 5
lea ecx, [esi*4]
jmp 0x62e742
mov bx, sp
xchg dx, bp
xchg si, di
mov dword [esp + 3], esi
pop ebx
neg bp
jmp 0x62e6b6
cpuid
mov cl, 0x1a
xchg si, dx
sub esp, 6
setbe ah
neg ch
jmp 0x62e784
mov ecx, eax
not ecx
xchg bp, di
inc dl
push dword [esp]
mov byte [esp + 3], bh
jmp 0x62e706
bswap ebx
pop word [esp + 9]
pop edx
neg ah
xchg ecx, edx
pop word [esp + 3]
jmp 0x62e71f
mov cl, 0x6a
pop edi
mov al, 0xd6
cld
mov ch, byte [esp + 5]
bswap ebp
jmp 0x62e841
inc si
sub esp, 0x16
mov byte [esp + 0xe], dh
neg edi
xchg ch, dl
neg bp
jmp 0x62e755
bswap edx
xchg dword [esp + 8], esi
neg bx
rcr ebp, 0xb
bsr cx, bp
mov bx, 0x32d3
jmp 0x62e76d
neg bh
xchg dh, al
push dword [esp + 9]
mov dword [esp + 0xe], ecx
bsr bx, bp
lea esi, [edx*4]
jmp 0x62e6f3
push edx
bswap ecx
mov word [esp], sp
stc
mov bx, word [esp + 2]
mov dl, dh
jmp 0x62e820
pushal
lea esp, [esp + 0x46]
mov si, di
mov dl, byte [esp]
clc
mov ecx, 0x32bbffbc
jmp 0x62e7bd
push dword [esp + 2]
xchg ebp, ecx
xchg edx, ecx
mov esi, eax
pushal
mov dword [esp + 0xb], esi
jmp 0x62e8b8
mov eax, ebp
pop word [esp + 1]
lea ebp, [ebx*4]
lea edx, [ebx + ebp]
xchg bp, ax
jmp 0x62e7e7
mov bl, bh
push word [esp + 3]
lea ebp, [ebx*4]
inc cl
cmc
btr ecx, edx
jmp 0x62e806
xchg esi, edx
add al, dh
push word [esp + 7]
xor si, 0xd09c
shr bh, 3
cpuid
jmp 0x62e7d4
mov edi, 0xd0f70322
call 0x62e879
mov byte [esp + 3], bh
mov edx, dword [esp + 7]
mov word [esp + 0xa], bx
sete bh
bsf cx, ax
not ebx
jmp 0x62e963
add esp, 0
neg ax
call fcn.0062e914
fld dword [ecx - 0x2f]
mov al, 0x43
call [ecx + 0x2f79002]
stosd dword es:[edi], eax
inc ebx
lea esp, [esp + 9]
bsr bx, cx
lea esi, [ecx + 0x3b]
lea esp, [esp + 3]
not ecx
mov eax, 0xb02c7b1a
jmp 0x62e92c
lea ecx, [ebx + ebp]
pop dx
mov dl, 0xfc
bsf bx, ax
mov eax, dword [esp + 1]
mov byte [esp + 5], dh
jmp 0x62e944
xchg bx, dx
mov ax, word [esp + 7]
rdtsc
bsr bp, bp
cld
rcr dh, 7
jmp 0x62e7a1
Function at 0x62e914
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 1]
push word [esp + 2]
push dword [esp + 3]
mov byte [esp + 1], dh
jmp 0x62e999
pop word [esp]
mov esi, 0xe693dca8
mov bh, byte [esp + 1]
inc edi
xchg edi, eax
mov word [esp], di
jmp 0x62ea07
pop edx
push edx
xchg dword [esp + 4], edx
lea esi, [esi + 0xcd]
push word [esp + 3]
add esp, 8
jmp 0x62e978
mov ax, dx
lea edi, [ebx*4]
mov byte [esp], bh
cpuid
jmp 0x62ee15
mov edi, eax
bsf di, ax
mov ax, dx
mov eax, dword [esp]
mov ebp, eax
rdtsc
jmp 0x62e9d9
lea esp, [esp + 1]
add esp, 1
rcr dh, 7
mov bp, 0xc613
xchg ch, dl
jmp 0x62e9f0
mov ebp, dword [esp]
ror ch, 5
sub esp, 4
btc esi, ebx
neg ch
push dword [esp + 4]
jmp 0x62ea88
mov esi, dword [esp + 4]
cpuid
xor ebp, esi
btr ebx, edx
pop word [esp]
ror eax, 0x11
jmp 0x62ea35
sub esp, 2
mov dx, word [esp]
sub esp, 0x18
lea esi, [ebx + edi]
lea edi, [eax + 0xe1]
jmp 0x62eadc
mov byte [esp + 1], ah
shl ax, cl
xchg edx, eax
add esp, 0xa
lea esp, [esp]
not cx
jmp 0x62ea6d
xchg dword [esp], ecx
lea edx, [esp + esi]
xchg byte [esp + 2], dl
ror ebx, 0xb
xchg byte [esp + 2], dl
ror edi, 0x13
jmp 0x62ea59
push word [esp + 0x18]
add esp, 0x18
rdtsc
call fcn.0062eb76
mov bh, 0x27
inc edx
mov cl, 0x5f
sub al, byte [ebp - 0xc]
out 0xe, eax
push word [esp + 0x19]
xchg ecx, eax
xchg bh, cl
xchg bx, cx
mov esi, 0xc09c2478
pop ebx
jmp 0x62eac2
bswap ebx
push esp
xchg word [esp], cx
cpuid
inc ebx
mov byte [esp + 1], bh
jmp 0x62eaac
lea edx, [esi - 0x4ed1f3e3]
xchg dx, ax
add esp, 2
mov ecx, dword [esp]
mov esi, dword [esp]
add esp, 0
jmp 0x62eafe
shr ah, 1
mov ah, byte [esp]
push edx
pop word [esp]
mov edx, 0x3f253524
not eax
jmp 0x62ebcd
Function at 0x62eb76
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc cl
mov byte [esp + 5], bh
setle bh
not edx
lea esi, [ecx - 0x3584661d]
mov bp, 0xc197
jmp 0x62eb5a
sub esp, 0xc
lea ebp, [ecx*4]
xchg edx, eax
mov bx, dx
xchg dword [esp + 0xc], eax
inc di
jmp 0x62eb0e
push dword [esp + 2]
pop word [esp + 3]
pop edx
cpuid
mov esi, eax
clc
jmp 0x62eb2d
xchg ebp, edi
mov cx, word [esp + 6]
mov ebx, dword [esp + 4]
push dword [esp + 0xc]
push esp
bsf cx, ax
jmp 0x62ebab
rdtsc
cld
neg ax
jmp 0x62eb49
xchg dh, al
not bp
pop word [esp + 0xe]
mov esi, ecx
mov dl, 0xc
mov al, ah
jmp 0x62ec36
push word [esp + 0x16]
pop dword [esp + 3]
cmc
mov byte [esp + 0xd], ah
neg bp
jmp 0x62eb7e
mov word [esp + 0x10], di
xor dl, ch
mov dl, 0x14
lea ebp, [edx*4]
lea ecx, [esi + edi]
btc edx, ebx
jmp 0x62eb94
neg edi
cpuid
cpuid
xchg ch, dl
xchg ebx, edi
mov di, 0xb54b
jmp 0x62ec1e
pushal
lea esp, [esp + 0x41]
bsf di, ax
setl ch
mov ebp, dword [esp]
mov cx, 0x1f95
jmp 0x62ebe6
mov esi, 0x48c0206c
btr edi, esp
mov dl, dh
stc
xchg edi, esi
add cx, 0xcade
jmp 0x62ec6f
stc
sub esp, 0xe
xchg byte [esp + 0xc], al
pop dx
inc dl
cmc
jmp 0x62ec09
mov dl, byte [esp]
cmc
inc al
xchg dh, al
mov si, di
mov cx, 0xad37
jmp 0x62ec94
btr edi, esp
add esp, 0xf
sub esp, 0x14
cmc
mov dword [esp + 0xb], eax
bsf bp, si
jmp 0x62ec7e
mov cl, byte [esp]
mov cl, 0xa
bswap ebx
xchg ch, dl
neg ah
xchg bh, cl
jmp 0x62ec45
cpuid
add esp, 0x19
pop word [esp + 3]
sub bl, ah
sub esp, 0x14
stc
jmp 0x62ed8e
pushal
xchg bh, cl
mov ch, byte [esp + 0xd]
pop dword [esp + 0xe]
rdtsc
neg cx
jmp 0x62ec56
xchg word [esp + 0xb], cx

Function at 0x62ef0e
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0062e071
push dword [esp + 0x23]
jmp 0x62ef47
mov word [esp + 0xb], sp
mov word [esp + 0x17], di
lea esp, [esp + 3]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
jmp 0x62ef75
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x62f010
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x62e06c
Function at 0x413070
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47df1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00470a48
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4130f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046e18d
mov eax, dword [eax]
push 0x4c91f0
push eax
call fcn.00460e54
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00470cd3
test bl, bl
je 0x4130f2
push 0x4c91f0
lea ecx, [esp + 0xc]
call fcn.004710af
push 0x4ccd6c
lea ecx, [esp + 0xc]
call fcn.004710af
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41312e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00470cd3
jmp 0x4131f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4131b2
lea edx, [esp + 0x7c]
push 0x4ccd68
push edx
call fcn.00460e54
add esp, 8
test eax, eax
je 0x4131b2
lea eax, [esp + 0x7c]
push 0x4ccd64
push eax
call fcn.00460e54
add esp, 8
test eax, eax
je 0x4131b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x413142
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00470cd3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4139f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x413a52
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x413a60
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47df9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4d3d10]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x413b98
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x413ac6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00470cd3
xor eax, eax
jmp 0x413c0f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00470e5c
push esi
lea ecx, [esp + 0xc]
call fcn.004710eb
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x413bed
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocStringLen
call fcn.004139f0
test eax, eax
jne 0x413bed
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocStringLen
mov ecx, edi
call fcn.004139f0
test eax, eax
jne 0x413bed
lea eax, [esp + 0x14]
push 0x4ccd80
push eax
call fcn.00461f30
mov esi, eax
add esp, 8
test esi, esi
jne 0x413bcc
lea ecx, [esp + 0x14]
push 0x4ccd7c
push ecx
call fcn.00461eb0
mov esi, eax
add esp, 8
test esi, esi
jne 0x413bcc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x413bcf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00470e0c
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x413ade
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00470cd3
xor eax, eax
jmp 0x413c0f
mov byte [esi], 0
push 0x4ccd78
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00470cd3
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x425680
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x4256ee
cmp si, 0x69
ja 0x4256ee
add esi, 0xffd0
cmp si, 0x11
je 0x4256be
push 0x11
call edi
test ax, ax
jge 0x4256be
or esi, 0x2000
cmp si, 0x10
je 0x4256d3
push 0x10
call edi
test ax, ax
jge 0x4256d3
or esi, 0x4000
cmp si, 0x12
je 0x4256e8
push 0x12
call edi
test ax, ax
jge 0x4256e8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x4256fb
mov esi, 0xbd
jmp 0x4256af
cmp si, 0x6e
jne 0x425708
mov esi, 0xbe
jmp 0x4256af
cmp si, 0x6f
jne 0x4256a9
mov esi, 0xbf
jmp 0x4256af

Function at 0x426eb0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4e4ad8]
xor edx, edx
cmp eax, edx
jne 0x426ed6
xor eax, eax
mov byte [eax + 0x4e49d8], al
inc eax
cmp eax, 0x100
jl 0x426ebe
mov dword [0x4e4ad8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4e49d8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x426f67
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x426f3a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x426f08
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x426fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x427033
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x42701a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret