joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40548f
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.00405714
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
test cl, 8
je 0x4054c6
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4243c8], eax
jmp 0x40562c
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
je 0x4054e0
test eax, eax
je 0x40562c
test cl, 2
je 0x4055de
mov esi, 0x421958
push ebx
push esi
call sub.KERNEL32.dll_lstrcpyA
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405502
push str..
push esi
call edi
jmp 0x405508
push ebx
call fcn.0040567b
push 0x40900c
push ebx
call edi
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x144]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4055d4
cmp byte [ebp - 0x118], 0x2e
jne 0x40554e
cmp byte [ebp - 0x117], 0x2e
je 0x4055b7
cmp byte [ebp - 0x117], 0
je 0x4055b7
lea eax, [ebp - 0x118]
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [ebp - 0x144]
test al, 0x10
je 0x40557a
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4055b7
push dword [ebp + 0xc]
push ebx
call fcn.0040548f
jmp 0x4055b7
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4055af
test byte [ebp + 0xc], 4
je 0x4055a7
push ebx
push 0xfffffffffffffff1
call fcn.00404ee5
push 0
push ebx
call fcn.0040586a
jmp 0x4055b7
inc dword [0x4243c8]
jmp 0x4055b7
push ebx
push 0xfffffffffffffff2
call fcn.00404ee5
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405533
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x4055de
and byte [edi - 1], 0
xor esi, esi
cmp dword [ebp - 4], esi
je 0x40562c
cmp dword [ebp + 8], esi
je 0x40562c
push ebx
call fcn.00405e0f
test eax, eax
je 0x40562c
push ebx
call fcn.00405633
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405624
test byte [ebp + 0xc], 4
je 0x40561c
push ebx
push 0xfffffffffffffff1
call fcn.00404ee5
push esi
push ebx
call fcn.0040586a
jmp 0x40562c
inc dword [0x4243c8]
jmp 0x40562c
push ebx
push 0xffffffffffffffe5
call fcn.00404ee5
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x405714
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421d58
push esi
call sub.KERNEL32.dll_lstrcpyA
push esi
call fcn.004056c7
test eax, eax
jne 0x405733
xor eax, eax
jmp 0x405782
test byte [0x424350], 0x80
je 0x405747
mov cl, byte [eax]
test cl, cl
je 0x40572f
cmp cl, 0x5c
je 0x40572f
mov edi, eax
sub edi, esi
jmp 0x405761
call fcn.00405e0f
test eax, eax
je 0x40575b
test byte [eax], 0x10
je 0x40572f
push esi
call fcn.0040567b
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x40574d
call fcn.00405633
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4057f3
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405822
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405866
test edi, edi
jne 0x40582d
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405860
Function at 0x40586a
Capabilities:
Get common file path
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4058a2
push str.MoveFileExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4058a2
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x4059e7
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x422ae0], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422ae0
je 0x4058e6
push 1
push 0
push esi
call fcn.004057f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4059ed
cmp eax, edi
jg 0x4059ed
mov esi, 0x4226e0
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4059ed
cmp eax, edi
jg 0x4059ed
push esi
push ebp
push str._s_s_r_n
push 0x4222e0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4059e7
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x4059cf
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x4059c3
push str._Rename__r_n
push edi
call fcn.00405787
test eax, eax
jne 0x4059f4
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call sub.KERNEL32.dll_lstrcpyA
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x4222e0
push eax
call fcn.004057d3
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x4243d0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409318
push eax
call fcn.00405787
test eax, eax
je 0x4059aa
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x405a1d
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x405a10
sub eax, edi
jmp 0x4059ac
Function at 0x405a21
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405a85
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405a74
cmp dword [ebp + 0x14], 1
je 0x405a76
cmp dword [ebp + 0x14], 2
je 0x405a76
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x405e4d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422ee4], 0
push esi
jne 0x405e84
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405e5e
mov dword [ecx*4 + 0x422ee0], eax
inc ecx
cmp ecx, 0x100
jl 0x405e59
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405eb5
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422ee0]
xor eax, esi
inc ecx
dec edx
jne 0x405e97
pop edi
not eax
pop esi
ret 0xc
Function at 0x4053c6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x4224a8], 0x44
push eax
xor eax, eax
push 0x4224a8
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405401
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40548b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0040573a
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x4054bf
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423f28], eax
jmp 0x405653
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x4054dd
test eax, eax
je 0x4055fe
test byte [ebp + 0xc], 2
je 0x4055fe
mov esi, 0x4214a8
push edi
push esi
call fcn.00405b66
test ebx, ebx
je 0x4054fa
push 0x409348
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405500
push edi
call fcn.004056a0
cmp byte [edi], 0
jne 0x40550e
cmp byte [0x4214a8], 0x5c
jne 0x405519
push 0x409010
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4055f4
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405684
cmp byte [eax], 0
je 0x40555f
cmp byte [ebp - 0x18], 0
je 0x40555f
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405575
mov al, byte [esi + 1]
test al, al
je 0x4055d3
cmp al, 0x2e
jne 0x405575
cmp byte [esi + 2], 0
je 0x4055d3
push esi
push ebx
call fcn.00405b66
test byte [ebp - 0x148], 0x10
je 0x40559a
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4055d3
push dword [ebp + 0xc]
push edi
call fcn.0040548b
jmp 0x4055d3
push edi
call fcn.0040581e
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4055cb
test byte [ebp + 0xc], 4
je 0x4055c3
push edi
push 0xfffffffffffffff1
call fcn.00404f04
push 0
push edi
call fcn.004058b4
jmp 0x4055d3
inc dword [0x423f28]
jmp 0x4055d3
push edi
push 0xfffffffffffffff2
call fcn.00404f04
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40553d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4055fe
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x405653
cmp dword [ebp - 8], esi
jne 0x405613
inc dword [0x423f28]
jmp 0x405653
push edi
call fcn.00405e5d
test eax, eax
je 0x405653
push edi
call fcn.00405659
push edi
call fcn.0040581e
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40564b
test byte [ebp + 0xc], 4
je 0x40560b
push edi
push 0xfffffffffffffff1
call fcn.00404f04
push esi
push edi
call fcn.004058b4
jmp 0x405653
push edi
push 0xffffffffffffffe5
call fcn.00404f04
pop edi
pop esi
leave
ret 8
Function at 0x4058b4
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405e84
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4058d8
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405a11
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x422630], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422630
je 0x40591c
push 1
push 0
push esi
call fcn.0040583d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405a17
cmp eax, edi
jg 0x405a17
mov esi, 0x4220a8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405a17
cmp eax, edi
jg 0x405a17
push esi
push ebp
push 0x409354
push 0x421ca8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x423eb0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405b88
push 4
push 0xc0000000
push esi
call fcn.0040583d
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405a11
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405a0a
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405a0a
cmp edi, dword [esp + 0x18]
jne 0x405a0a
push str._Rename__r_n
push esi
call fcn.004057b2
test eax, eax
jne 0x405a1e
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405b66
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x421ca8
push eax
call fcn.004057fe
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x423f30]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409350
push eax
call fcn.004057b2
test eax, eax
je 0x4059d5
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405a45
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405a3a
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x4059d7
Function at 0xc91c0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, 0x16605b59
jmp 0xc91ccd
mov word [esp], dx
lea esp, [esp + 3]
mov byte [esp], ch
call fcn.00c91a47
mov edx, 0x9b55a67a
mov dl, 0xc
mov ebx, 0x8ac29a90
neg ch
call fcn.00c91d98
xchg cx, ax
adc al, bh
neg ax
bsf cx, ax
mov ebx, edi
shl eax, 3
jmp 0xc91cc6
rdtsc
pushal
bswap eax
jmp 0xc91a1c
bswap eax
jmp 0xc91a1c
jle 0xc91c53
rdtsc
pushal
jmp 0xc91caf
bsr ax, cx
jle 0xc91d2e
mov al, byte [esp]
jmp 0xc91d0c
sub esp, 0x16
sub esp, 0x1e
jmp 0xc91d37
mov al, byte [esp]
sub esp, 0x16
sub esp, 0x1e

Function at 0xc91c1b
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, 0x16605b59
jmp 0xc91ccd
mov word [esp], dx
lea esp, [esp + 3]
mov byte [esp], ch
call fcn.00c91a47
mov edx, 0x9b55a67a
mov dl, 0xc
mov ebx, 0x8ac29a90
neg ch
call fcn.00c91d98
xchg cx, ax
adc al, bh
neg ax
bsf cx, ax
mov ebx, edi
shl eax, 3
jmp 0xc91cc6
rdtsc
pushal
bswap eax
jmp 0xc91a1c
bswap eax
jmp 0xc91a1c
jle 0xc91c53
rdtsc
pushal
jmp 0xc91caf
bsr ax, cx
jle 0xc91d2e
mov al, byte [esp]
jmp 0xc91d0c
sub esp, 0x16
sub esp, 0x1e
jmp 0xc91d37
mov al, byte [esp]
sub esp, 0x16
sub esp, 0x1e

Function at 0xc920a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0xc91c1b
bsf cx, ax
jmp 0xc91c39
sub esp, 0xbc
mov esi, esp
rcl ax, cl
js 0xc91c48
clc
neg ax
jmp 0xc91c4d
lea ebp, [esp + 4]
cpuid
xchg ch, dl
mov al, byte [esp]
mov bl, bh
jmp 0xc91c6c
xchg dword [esp], esi
xchg word [esp + 1], cx
jmp 0xc91e39

Function at 0xcc7921
Capabilities:
Encrypt data using aes

Disassembly:
xor edx, esi
mov ebx, dword [esp]
xchg ebp, edi
jmp 0xcc79e8
xchg dword [esp], edi
stc
jmp 0xcc78f2
mov bx, word [esp]
jmp 0xcc790a
shl edx, 8
clc
xor edx, eax
rcr ah, 1
jmp 0xcc79b0
mov eax, edx
cmc
cmc
btc esi, ebx
sub bl, ch
jmp 0xcc7996
neg si
btc esi, edi
jmp 0xcc7927
mov di, word [esp]
btc edi, edi
push esp
xor edx, esi
btc esi, ebx
jmp 0xcc7948
movzx eax, byte [eax + 0xf]
btc ebx, edi
lea ebx, [ecx*4]
shl edx, 8
jmp 0xcc7962
shr eax, 0x10
mov esi, ebp
xchg di, bx
lea esi, [ecx + ebx]
mov bl, bh
jmp 0xcc79c4
mov edi, esp
add al, dh
neg bh
mov dword [ecx + 0xc], edx
lea ebp, [esi - 0x2585ca6b]
jmp 0xcc7931
lea esp, [esp + 4]
mov esi, 0xff
stc
and eax, esi
jmp 0xcc925b
lea esp, [esp + 4]
movzx esi, byte [eax + 0xe]
bts edi, ebx
jmp 0xcc7983
mov esi, edi
and edi, esi
sub esp, 2
mov bp, word [esp]
lea esp, [esp + 2]
push esi
jmp 0xcc7b52
mov edi, edx
mov bp, 0x9047
shr edi, 8
jmp 0xcc7c24
mov eax, dword [eax*4 + 0xc8ea38]
xchg bp, di
xor eax, 0x1000000
mov bl, 0xde
jmp 0xcc82f3
Function at 0xe80068
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
jmp 0xe80073
mov byte [esp + 2], dh
pushfd
pop word [esp]
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0xe8000d
push word [esp + 1]
push dword [esp + 2]
pop dword [esp]
mov word [esp + 1], dx
mov word [esp + 1], ax
push word [esp + 3]
jmp 0xe80029
mov dword [esp + 0x1c], esi
push bp
mov byte [esp], bl
jmp 0xe80041
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xe800cf
mov ebp, eax
lea ebp, [ebp + 8]
mov eax, dword [ebp]
pop ebp
jmp 0xe8009f
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
push ebp
jmp 0xe800b5

Function at 0xe80160
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push eax
jmp 0xe7d003
call fcn.00e7d008
je 0xe7caea
jne 0xe802dc
and byte [ecx + 0x69ab5839], ch
wait
adc dword [ecx + 0x4ce313e0], eax
add ax, 0x66b1
cmp dword [ebx], 0xdceb4550
iretd
cmp word [ebx], 0x4550
jmp 0xe8012b
lea esp, [esp + 3]
mov byte [esp], al
lea esp, [esp + 1]
lea esp, [esp + 4]
jmp 0xe80148

Function at 0x401115
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov eax, edx
mov dword [esp + 0x10], 0xe3
mov edi, 0x7ffffffe
mov esi, 0x9908b0df
mov ebp, dword [eax]
dec dword [esp + 0x10]
lea ebx, [eax + 4]
mov ecx, dword [ebx]
xor ebp, ecx
and ebp, edi
xor ebp, dword [eax]
and ecx, 1
neg ecx
shr ebp, 1
and ecx, esi
xor ebp, ecx
xor ebp, dword [eax + 0x634]
cmp dword [esp + 0x10], 0
mov dword [eax], ebp
mov eax, ebx
jne 0x40112e
mov dword [esp + 0x10], 0x18c
mov ebp, dword [eax]
lea ebx, [eax + 4]
mov ecx, dword [ebx]
xor ebp, ecx
and ebp, edi
xor ebp, dword [eax]
and ecx, 1
neg ecx
shr ebp, 1
and ecx, esi
xor ebp, ecx
xor ebp, dword [eax - 0x38c]
dec dword [esp + 0x10]
mov dword [eax], ebp
mov eax, ebx
jne 0x401163
mov ebx, dword [eax]
mov ecx, dword [edx]
xor ebx, ecx
and ebx, edi
xor ebx, dword [eax]
and ecx, 1
neg ecx
shr ebx, 1
and ecx, esi
pop edi
xor ebx, ecx
xor ebx, dword [eax - 0x38c]
pop esi
mov dword [eax], ebx
pop ebp
mov dword [edx + 0x9c4], 0x270
mov dword [edx + 0x9c0], edx
pop ebx
pop ecx
ret
Function at 0x44a97c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov eax, dword [0x966c98]
mov dword [ebp - 4], eax
pushal
mov eax, 0xffffffff
mov ecx, dword [ebp + 0xc]
cmp ecx, 0
je 0x44a9c0
mov esi, dword [ebp + 8]
dec esi
xor ebx, ebx
mov edi, dword [ebp - 4]
mov bl, byte [esi + ecx]
xor bl, al
shr eax, 8
and eax, 0xffffff
xor eax, dword [edi + ebx*4]
loop 0x44a9ae
and eax, 0x7fffffff
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
xor edx, edx
div dword [ebp + 0x14]
shl edx, 2
add edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
jmp 0x44a9e1
mov esp, ebp
pop ebp
ret 0x14
Function at 0x459ab0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4edfdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004e1ab4
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x459b32
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004df2d8
mov eax, dword [eax]
push 0x950d24
push eax
call fcn.004d1314
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004e1d3f
test bl, bl
je 0x459b32
push 0x950d24
lea ecx, [esp + 0xc]
call fcn.004e20cf
push 0x950d30
lea ecx, [esp + 0xc]
call fcn.004e20cf
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x459b6e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004e1d3f
jmp 0x459c39
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x459bf2
lea edx, [esp + 0x7c]
push 0x950d2c
push edx
call fcn.004d1314
add esp, 8
test eax, eax
je 0x459bf2
lea eax, [esp + 0x7c]
push 0x950d28
push eax
call fcn.004d1314
add esp, 8
test eax, eax
je 0x459bf2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x459b82
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004e1d3f
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x45a460
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x45a4c2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x45a4d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ee05b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x962a00]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x45a608
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x45a536
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004e1d3f
xor eax, eax
jmp 0x45a67f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004e1e7c
push esi
lea ecx, [esp + 0xc]
call fcn.004e210b
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x45a65d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push bind
call fcn.0045a460
test eax, eax
jne 0x45a65d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push bind
mov ecx, edi
call fcn.0045a460
test eax, eax
jne 0x45a65d
lea eax, [esp + 0x14]
push 0x950d40
push eax
call fcn.004d2480
mov esi, eax
add esp, 8
test esi, esi
jne 0x45a63c
lea ecx, [esp + 0x14]
push 0x950d3c
push ecx
call fcn.004d2400
mov esi, eax
add esp, 8
test esi, esi
jne 0x45a63c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x45a63f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004e1e2c
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x45a54e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004e1d3f
xor eax, eax
jmp 0x45a67f
mov byte [esi], 0
push 0x950d38
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004e1d3f
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4