joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6170e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
setae dh
xchg edx, ecx
xchg cx, ax
xchg word [esp + 9], dx
mov dh, byte [esp + 0x1b]
jmp 0x617216
lea ebx, [esi*4]
mov esi, dword [esp + 0x14]
neg dh
mov bl, 0xb0
push word [esp + 4]
mov ecx, dword [esp + 0x1a]
jmp 0x617106
neg eax
push dword [esp]
mov ebp, 0xe821c58a
add al, dh
bswap esi
mov ecx, 0x4fd4379c
jmp 0x617122
mov si, word [esp + 1]
bsr ax, bp
pop edi
xchg dword [esp], edx
cmc
xchg edi, ebx
jmp 0x617199

Function at 0x6177ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [esi + 0x3d]
neg edi
inc dl
xchg byte [esp], bl
xchg byte [esp], cl
xchg bp, cx
jmp 0x6176e8
neg si
add esp, 7
mov cx, word [esp + 0x16]
lea esp, [esp + 0x23]
bsf bp, si
add esp, 0xc
jmp 0x617695
mov dl, 0x14
rdtsc
mov dl, 0xa4
bswap ecx
push dword [esp + 0x18]
rdtsc
jmp 0x6176b4
push edx
mov al, ah
not ecx
mov byte [esp + 3], ah
cpuid
rdtsc
jmp 0x617767
lea esi, [eax*4]
pop dword [esp]
mov ebp, eax
lea edi, [ebx*4]
jmp 0x617746
cpuid
cpuid
bsf bx, ax
mov ebp, esi
xchg dh, al
neg si
jmp 0x6176d8
xchg byte [esp + 0xc], al
neg si
mov byte [esp + 1], dh
not bp
push esp
cld
jmp 0x617710
mov eax, 0xd5e20bf0
mov al, ah
mov esi, 0x70afd156
mov bl, bh
shl bx, cl
btr edx, edx
jmp 0x61777e
mov ah, byte [esp]
mov edx, dword [esp + 3]
push dword [esp + 2]
lea ecx, [ecx - 0x53]
not edx
mov bl, 0x98
jmp 0x6176f7
xchg bx, ax
push dword [esp + 4]
inc eax
rdtsc
add esp, 2
mov bl, bh
jmp 0x6177fd
pop word [esp + 0x2a]
xchg ch, dl
xchg dword [esp + 0x2a], esi
mov bp, word [esp + 0x13]
mov edi, ecx
xchg ch, dl
jmp 0x617734
lea ebx, [ecx + edx]
pop esi
xchg word [esp + 0x24], di
xchg dword [esp + 0x23], ebx
mov ax, word [esp + 6]
push word [esp]
jmp 0x61779c
sub esp, 0xe
mov esi, dword [esp + 0x16]
lea edx, [eax + edx]
pop dword [esp + 1]
sub esp, 0x1e
jmp 0x6177c4
rdtsc
bsr si, cx
mov cl, 0x2a
add ebp, ebp
mov eax, 0x5d42b132
mov ebx, ebp
jmp 0x617bfb
mov edx, dword [esp + 0xc]
mov edx, dword [esp + 8]
btr ebp, esp
call fcn.0061782b
sete ah
xchg bx, si
bsr si, bp
neg di
xchg ch, dl
lea eax, [edx*4]
jmp 0x61784a
sub esp, 0
mov bx, sp
sub esp, 0xc
pop dword [esp + 6]
inc bl
lea edx, [esp + esi]
jmp 0x61787f

Function at 0x61c477
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
pushal
lea esp, [esp + 0x4b]
push edx
mov byte [esp + 2], dh
pushal
jmp 0x61c436

Function at 0x54fe50
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xfccfb53d
jns 0x54fe79
or dword [esi], ebp
or dword [ebp + 0x6f], ebx
aaa
test dword [edi + eax*8], esi
push cs
leave
wait
call dword [esi]
aaa
mov dl, 0x77
xor bl, 0x46
invalid
sbb esi, eax
or ah, byte [ebx - 0x2f1c87f2]
neg bl
mov edi, 0xd7505a4d
xchg ecx, eax
cmp al, 0x8e
sub ecx, dword [edx]
mov dword [0xd659c457], eax
popfd
inc edi
xchg ebp, eax
pop esi
mov ds, edi
dec byte [esi]
mov dh, 0x41
adc ch, dl
clc
insb byte es:[edi], dx
sbb dword [ecx], 0x79
mov ebp, 0x1a582378
or eax, 0xf6459790
xor ch, byte [ecx + 0x44]
inc esi
push edi
invalid
Function at 0x4057c3
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00405973
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x4058c1
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x405864
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4058a7
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x40587b
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x405896
test al, 0x40
je 0x40588d
mov ecx, dword [edi + 0x20]
jmp 0x405894
test al, 0x80
je 0x4058a7
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4058a7
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x405833
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x40d7a0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + 0x47182c]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x4717bc]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x40d7b3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x40d7f4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x471864]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x40d826
mov bl, byte [esp + ecx + 0x4c]
jmp 0x40d82a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x40d81b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x40d848
mov bl, byte [esp + ecx + 0x4c]
jmp 0x40d84c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x40d83d
xor ecx, ecx
call fcn.005b3934
xor ebx, ebx
mov bl, byte [ecx + 0x471874]
cmp byte [esp + ebx + 0x14], 0
je 0x40d877
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x47188c]
cmp byte [esp + ebx + 0x14], 0
je 0x40d88e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
call fcn.005b3da5
jl 0x40d85e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x40d7e7
lea edx, [esp + 0x84]
push edx
call fcn.0040d8d0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4a467a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esi + 0x50]
mov ecx, esp
neg edx
jo 0x4a465c
bts ecx, esp
mov cx, word [esp]
jmp 0x4a46bd
jmp 0x4a463b

Function at 0x567651
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x43]
call 0x567651
sahf
lea esp, [esp + 4]
push 0
jmp 0x5676b7
xchg edi, eax
pop ecx
mov dword [esp + 0x10], ebp
mov edi, 0x4c619a2a
push dword [esp + 0xa]
mov bl, 0xf8
jmp 0x5676c2
pushal
pop esi
lea esp, [esp + 1]
xchg dword [esp + 0x10], edx
lea ebp, [eax + edi]
mov dword [esp + 0x15], ebp
jmp 0x56767f
pushfd
pushal
rdtsc
mov eax, dword [esp]
rdtsc
jmp 0x56769e
pop ebx
xchg dx, si
lea edi, [edx*4]
pop di
mov dword [esp + 0xc], esi
not ah
jmp 0x56771a
jmp 0x567850
rdtsc
mov di, dx
mov bl, byte [esp]
mov edi, dword [esp]
mov ebx, 0xb93f7b54
mov eax, esi
jmp 0x56775d
mov ax, word [esp + 6]
pushal
mov byte [esp + 0x13], ah
mov dx, 0x6b85
pushal
lea esp, [esp + 0x55]
jmp 0x5676f2
mov ecx, 0x7e8105f6
lea ebp, [ebp + 0x58667e3f]
lea edi, [edx + ebp]
popal
call fcn.00567743
jne 0x5676dc
je 0x5677cf
lodsb al, byte [esi]
movsb byte es:[edi], byte ss:[esi]
ret
call 0x5677c4
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
or al, 0x9c
add dl, byte [eax + 0x438502f7]
cli
aad 0x60
pushal
jmp 0x5677b4
inc dword [esp + 8]
popfd
ret

Function at 0x56d0ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, 0x159b1af0
xchg bx, ax
mov ebx, 0x5c5783fa
mov si, word [esp]
mov cl, 2
lea edx, [edx + edi]
jmp 0x56d03a
mov dword [esp], esi
xchg ch, dl
pop edi
sete ah
rdtsc
mov cx, 0x857f
jmp 0x56cfee
mov ebx, dword [esp]
lea ecx, [esi*4]
pushal
mov esi, ecx
jmp 0x56d091
mov ebp, 0xe4b9eeee
xchg esi, ecx
xchg dx, di
bswap esi
mov dx, sp
jmp 0x56d024
cpuid
lea ebp, [esp + ebp]
xchg dh, al
mov bl, bh
mov word [esp], sp
mov ebp, 0x6e87b9d0
jmp 0x56d013
mov eax, ebp
mov bx, word [esp]
mov dl, 0x7c
not ah
rdtsc
mov dl, 0xc4
jmp 0x56d07a
mov bx, 0x5ca9
popal
call 0x56d0cc
call 0x56d089
pop ecx
jmp 0x56d4a6
mov ebp, 0xecf77884
mov cx, sp
xchg word [esp + 0x11], si
popal
rdtsc
mov si, dx
jmp 0x56d065
mov cl, 0xa2
mov ax, dx
mov dl, 0x74
xchg dword [esp], ebp
jmp 0x56d051
sub ecx, 0x56d089
lea eax, [ecx + 0x56d407]
mov dword [ecx + 0x56d18a], eax
popal
jmp 0x56d161

Function at 0x5b409b
Capabilities:
Encrypt data using des

Disassembly:
xchg dword [esp], ebx
pushfd
add ebx, 0x246bd774
jmp 0x5b3ede
mov byte [esp + 0x15], ah
push dword [esp + 0xe]
push dword [esp + 0x1a]
lea esp, [esp + 3]
lea esp, [esp + 0x28]
jmp 0x5b3f07
lea esp, [esp + 0x15]
push dword [esp + 0xb]
mov byte [esp + 0xd], dh
push word [esp + 0xa]
pop word [esp + 9]
mov word [esp + 0x1f], sp
jmp 0x5b3f2a
pop word [esp + 0xd]
push dword [esp + 6]
pop word [esp + 7]
mov dword [esp + 3], eax
pushal
jmp 0x5b3fab
Function at 0x5d8471
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edx + ebx]
mov ax, 0xbf21
mov ax, 0x5257
mov word [esp], dx
pop esi
mov ax, 0x3ef3
jmp 0x5d84d2
rdtsc
mov edi, dword [esp + 3]
mov dword [esp], esi
jmp 0x5d8454
mov eax, ebp
mov edx, ebp
mov edi, dword [esp]
xchg dx, ax
rdtsc
mov edx, 0xd23c06d4
jmp 0x5d85c5
mov cl, ch
popal
call 0x5d8539
js 0x5d84f0
bound eax, qword [0xf96e42f4]
imul ecx, dword [eax], 0xbb5850fb
xchg edx, eax
mov bp, word [esp + 0x1c]
mov dl, dh
mov bp, sp
popal
mov dl, 0x54
rdtsc
jmp 0x5d84fa
xchg bx, bp
xchg si, bx
mov edx, ecx
setle ch
not ah
pushal
jmp 0x5d8511
xchg edi, eax
mov bl, byte [esp]
setns ch
mov bl, byte [esp]
mov ax, 0x21e5
xchg dh, al
jmp 0x5d8551
mov edx, dword [esp]
lea edx, [edx + edx]
mov dx, 0x3f8b
mov bx, word [esp]
mov al, byte [esp]
lea ebp, [edi*4]
jmp 0x5d85a7

Function at 0x621f8b
Capabilities:
Packed with generic packer

Disassembly:
push esp
pop word [esp + 4]
mov dword [esp + 3], esi
pop word [esp + 4]
jmp 0x621f8d
jmp 0x621f74
push dword [esp]
mov dword [esp + 3], esi
lea esp, [esp]
lea esp, [esp + 3]
lea esp, [esp + 8]
jmp 0x621fd2
lea ecx, [edx + edx]
xchg ah, bl
lea ebx, [esi*4]
mov dl, byte [esp]
cpuid
bswap edx
jmp 0x621ffb
pushal
mov bp, 0xde2f
mov cx, bx
mov edi, dword [esp]
mov eax, dword [esp]
bswap edi
jmp 0x621fb6
mov al, ah
popal
pushal
push dword [esp + 4]
mov word [esp + 8], di
lea esp, [esp + 0x13]
jmp 0x622069
lea ebx, [esi + 0x7e6df5a5]
lea edx, [ebp - 0x6f]
mov al, ah
mov ax, word [esp]
bswap ecx
jmp 0x621fe4
pop dword [esp + 2]
push edx

Function at 0x622200
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 5], ecx
pop dword [esp]
jmp 0x62222c

Function at 0x632800
Capabilities:
Packed with generic packer

Disassembly:
popal
call fcn.0063280a
mov word [esp + 2], sp
mov dword [esp], esi
lea esp, [esp + 3]
lea esp, [esp + 3]
jmp fcn.00427bf4
lea esp, [esp + 4]
pushal
mov bp, dx
jmp 0x6327e4

Function at 0x64fde5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x1e]
push dword [esp + 0xc]
mov byte [esp + 9], dh
pop word [esp + 5]
jmp 0x64fc5b
Function at 0x65f479
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 1], ch
jmp 0x65f3c5
mov ax, 0xe795
popal
pushal
mov word [esp + 2], dx
mov byte [esp + 8], dh
push word [esp + 0x1f]
call fcn.0065f1ea
pushal
lea esp, [esp + 0x23]
pushal
mov word [esp + 9], dx
mov byte [esp + 0x1d], bh
push word [esp + 5]
jmp 0x65f284
push word [esp + 0x18]
pop dword [esp + 0xe]
lea esp, [esp + 0xf]
pop word [esp + 1]
push dword [esp]
mov dword [esp + 9], ebp
jmp 0x65f2bd
lea esp, [esp + 7]
pushal
push esp
mov byte [esp + 0x25], bh
lea esp, [esp + 1]
jmp 0x65f38a
lea esp, [esp + 0x30]
jmp fcn.00434390
mov byte [esp + 1], dh
call fcn.0065f2d4
push edx
mov dword [esp + 0xb], ecx
pop dword [esp + 0x26]
mov byte [esp + 2], dh
mov word [esp + 0xa], sp
push edx
jmp 0x65f449
push esp
mov dword [esp + 9], esi
lea esp, [esp + 2]
lea esp, [esp + 0x3c]
call fcn.0065f415
mov word [esp + 4], di
mov byte [esp + 1], ch
call fcn.0065fb61
dec eax
fdiv qword [edx + 0x15]
in al, 0x52
mov esi, 0x2bd8b929
or al, 0x6b
cmp byte [0x424648d], 0x60
lea esp, [esp + 4]
pushal
jmp 0x65f24d

Function at 0x66672d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x27]
call fcn.0066668a
push edx
lea edx, [ebx + edi]
lea edx, [ecx + 0x3461157b]
mov ax, dx
lea ecx, [edi*4]
xchg ch, dl
jmp 0x6667e8
xchg dword [esp], ecx
mov edx, 0xc51c41c2
push word [esp + 1]
lea esp, [esp + 2]
mov edx, dword [esp + 4]
lea ecx, [ebp + 7]
jmp 0x6667d1
mov al, ah
mov edx, dword [esp]
mov cx, word [esp]
lea eax, [edx + ebp]
push esp
rdtsc
jmp 0x666782
xchg ah, ch
not ax
mov ecx, dword [esp]
mov ecx, dword [esp + 8]
mov ax, 0x9239
jmp 0x666849
xchg cl, ch
mov eax, edx
lea ecx, [eax*4]
not ecx
mov cx, word [esp]
jmp 0x6667ba
rdtsc
mov cl, ch
xchg dh, al
mov ch, bh
mov dl, dh
bswap ecx
jmp 0x6667a9
lea esp, [esp + 0x13]
mov dword [esp + 1], ebp
call fcn.006667f6
mov edx, 0x35c6a333
lcall 0x525a, 0x23e0a1b6
push edx
mov byte [esp], ah
mov eax, dword [esp + 0x10]
lea esp, [esp + 0x14]
pushal
pop dword [esp + 0xc]
jmp 0x666812
mov al, 0x5a
mov al, 0x70
mov al, ah
lea eax, [edi*4]
bswap eax
lea eax, [eax + ebx]
jmp 0x66682a

Function at 0x667011
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, 0x48
mov ebx, dword [esp]
not ah
mov ax, word [esp]
rdtsc
mov esi, dword [esp]
jmp 0x66703c
pop dword [esp + 0xc]
lea esp, [esp + 1]
lea esp, [esp + 0x14]
pushal
jmp 0x666ffb

Function at 0x6b49dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 6], ebp
mov edx, dword [esp + 9]
jmp 0x6b49eb
btc edx, ebx
mov bp, 0x2851
add esp, 6
pop word [esp]
push edx
mov word [esp + 1], di
jmp 0x6b4a1c
mov dword [esp], ebp
push dword [esp + 2]
pop si
sub esp, 0xc
pushal
mov ax, word [esp + 0xa]
jmp 0x6b4a63
lea edi, [edi*4]
xchg byte [esp + 0x28], cl
neg ch
xchg word [esp + 0x2c], bx
xchg dword [esp + 0x1c], ebx
mov ecx, 0xb65aff8c
jmp 0x6b4a42

Function at 0x6b4d1c
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 1
lea eax, [ecx + 0x5b]
not edi
setge ah
xor dl, ch
jmp 0x6b4ca8
Function at 0x6b510b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edi
cmc
cpuid
sub esp, 0x12
mov byte [esp + 0x10], ch
pop edi
jmp 0x6b50d9
mov esi, dword [esp + 1]
add esp, 1
jmp 0x6b50ef

Function at 0x6b780b
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x6b7882
mov dword [esp + 0xb8], edi
lea esp, [esp + 0xb8]
mov eax, dword fs:[0x30]
jmp 0x6b77c9
push word [esp + 5]
lea esp, [esp + 5]
mov byte [esp + 1], ah
lea esp, [esp + 3]
jmp 0x6b77e3
Function at 0x426c70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49445b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00488655
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x426cf2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00486160
mov eax, dword [eax]
push 0x648288
push eax
call fcn.004782a4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004888e0
test bl, bl
je 0x426cf2
push 0x648288
lea ecx, [esp + 0xc]
call fcn.00488c70
push 0x64be18
lea ecx, [esp + 0xc]
call fcn.00488c70
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x426d2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004888e0
jmp 0x426df9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x426db2
lea edx, [esp + 0x7c]
push 0x64be14
push edx
call fcn.004782a4
add esp, 8
test eax, eax
je 0x426db2
lea eax, [esp + 0x7c]
push 0x64be10
push eax
call fcn.004782a4
add esp, 8
test eax, eax
je 0x426db2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x426d42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004888e0
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4275f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x427652
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x427660
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4944db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x65317c]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x427798
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4276c6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004888e0
xor eax, eax
jmp 0x42780f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00488a1d
push esi
lea ecx, [esp + 0xc]
call fcn.00488cac
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4277ed
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.004275f0
test eax, eax
jne 0x4277ed
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.004275f0
test eax, eax
jne 0x4277ed
lea eax, [esp + 0x14]
push 0x64be2c
push eax
call fcn.004793b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4277cc
lea ecx, [esp + 0x14]
push 0x64be28
push ecx
call fcn.00479330
mov esi, eax
add esp, 8
test esi, esi
jne 0x4277cc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4277cf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004889cd
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4276de
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004888e0
xor eax, eax
jmp 0x42780f
mov byte [esi], 0
push 0x64be24
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004888e0
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x4393a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x43940e
cmp si, 0x69
ja 0x43940e
add esi, 0xffd0
cmp si, 0x11
je 0x4393de
push 0x11
call edi
test ax, ax
jge 0x4393de
or esi, 0x2000
cmp si, 0x10
je 0x4393f3
push 0x10
call edi
test ax, ax
jge 0x4393f3
or esi, 0x4000
cmp si, 0x12
je 0x439408
push 0x12
call edi
test ax, ax
jge 0x439408
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x43941b
mov esi, 0xbd
jmp 0x4393cf
cmp si, 0x6e
jne 0x439428
mov esi, 0xbe
jmp 0x4393cf
cmp si, 0x6f
jne 0x4393c9
mov esi, 0xbf
jmp 0x4393cf

Function at 0x43abd0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x664360]
xor edx, edx
cmp eax, edx
jne 0x43abf6
xor eax, eax
mov byte [eax + 0x664260], al
inc eax
cmp eax, 0x100
jl 0x43abde
mov dword [0x664360], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x664260
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x43ac87
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x43ac5a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x43ac28
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x43ad00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x43ad53
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x43ad3a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret