joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016d94a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x101c8fb4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.1016d8df
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.10112240
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x1016d999
cmp dword [ebp - 0x1c], 5
jb 0x1016d9b1
jmp 0x1016d9ad
cmp dword [ebp - 0x10], 1
jne 0x1016d9b1
cmp dword [ebp - 0x1c], 4
ja 0x1016d9ad
jne 0x1016d9b1
cmp dword [ebp - 0x18], 0
jbe 0x1016d9b1
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x1019b088
call fcn.1016d7b3
test eax, eax
jge 0x1016d9d2
mov byte [0x101ca920], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10111b17
add ebp, 0x78
leave
ret

Function at 0x1030e473
Capabilities:
Get number of processors

Disassembly:
jmp 0x10302794
call fcn.1030277f
salc
arpl word [ebp - 0x79], cx
loop 0x1030278a
adc eax, 0x24748b56
add al, 0x8d
mov dh, 0xd4
adc byte [edx], al
add byte [ecx + 0x5e042474], cl
push edx
mov dword [esp], ebp
push esp
pop ebp
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 0x80
xchg dword [esp], ebp
pop esp
sub esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], esi
push 0x188b
mov dword [esp], edi
jmp 0x103283b3
push ebx
mov ebx, 8
add ebx, ebp
mov eax, dword [ebx]
pop ebx
sub esp, 4
mov dword [esp], eax
jmp 0x103211dd
jmp 0x1030d476
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], ecx
jmp 0x1031c856
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x1983f]
mov dword [esp + 4], ecx
pop ecx
jmp 0x10324e32
jmp 0x1031c86d
call fcn.1031c858
adc byte [eax - 0x77], dl
loopne 0x1031c87c
add al, 0
add byte [eax], al
add eax, 4
xchg dword [esp], eax
pop esp
rol byte [edi + eax*4], 4
and al, 0x5c
push eax
pop dword [ebp - 4]
push ecx
mov ecx, 0xc
add ecx, ebp
mov eax, dword [ecx]
pop ecx
push esi
mov dword [esp], eax
push dword [ebp - 4]
sub dword [esp], 0x3f8325ed
pop ecx
add ecx, 0x3f8325ed
push esi
mov dword [esp], ecx
push eax
mov eax, 8
add eax, ebp
mov edx, dword [eax]
pop eax
push eax
mov eax, 0x64
add edx, eax
pop eax
push ebx
mov dword [esp], edx
jmp 0x1030277d
jmp 0x103211f4
call fcn.103211df
or eax, dword [ebp + 0x68]
mov byte [eax], 0
jmp 0x10302bce
push esi
mov esi, 0x6114390f
xor esi, 0x61143917
mov eax, esi
pop esi
mov eax, dword fs:[eax]
push eax
pop dword [ebp - 4]
push dword [ebp - 4]
pop eax
push dword [eax + 0x30]
sub dword [esp], 0x63f80c4b
pop ecx
add ecx, 0x63f80c4b
push eax
mov eax, 0xfffffff8
add eax, ebp
mov dword [eax], ecx
pop eax
push dword [ebp - 8]
pop edx
push ecx
mov ecx, 8
add ecx, edx
mov eax, dword [ecx]
pop ecx
push edx
mov edx, 0xffffffec
add edx, ebp
mov dword [edx], eax
pop edx
push ebx
mov ebx, 0
mov dword [ebp - 0x10], ebx
pop ebx
cmp dword [ebp - 0x10], 0
je 0x10303698
jmp 0x10304265
Function at 0x1032d6f2
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax - 0x4e23]
mov dword [esp + 4], eax
pop eax
jmp 0x1031ca70

Function at 0x105a77d9
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x105a7837
jmp 0x105a77f6
push ebx
mov ebx, 0x1000
sub ecx, ebx
pop ebx
push esi
mov esi, 0x42603735
add esi, 0x62b848ad
not esi
xor esi, 0xa3b2af6
xor esi, 0x5731f4a
shr esi, 4
xor esi, 0x55aeb5a
sub eax, esi
pop esi
test dword [ecx], eax
cmp eax, 0x1000
jae 0x105a77f6
jmp 0x105a7837
sub ecx, 0x42861a21
sub ecx, eax
add ecx, 0x42861a21
push esp
pop eax
test dword [ecx], eax
mov esp, ecx
push dword [eax]
pop ecx
push dword [eax + 4]
xor dword [esp], 0x1d9f7243
pop eax
xor eax, 0x1d9f7243
push ecx
mov dword [esp], eax
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xc6a268
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts di, si
clc
cmp edi, ecx
std
jmp 0xc6a252
Function at 0xc6a710
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, dh
push word [esp + 7]
lea edx, [edx + ebx]
jmp 0xc6a720
xchg byte [esp + 0xb], ah
shr dl, 0
lea eax, reloc.RASAPI32.dll_RasHangUpA
mov dh, byte [esp + 0xb]
bsf edx, esp
jmp 0xc6ab0a
xchg word [esp], dx
mov dh, bl
lea edi, reloc.RASAPI32.dll_RasHangUpA
mov edi, dword [esp]
adc eax, edx
lea edx, reloc.RASAPI32.dll_RasHangUpA
jmp 0xc6a8fa
cld
cld
pop edi
rdtsc
setge dh
mov al, bl
jmp 0xc6a8bb
bsf eax, ecx
inc edi
lea edx, [ecx*4]
xchg edi, eax
jmp 0xc6a946
mov dx, sp
mov byte [esp + 1], bh
std
mov word [esp], cx
mov eax, 0x3f26db64
mov al, 0x7f
jmp 0xc6a8e4
mov ah, byte [esp]
setae dl
sub esp, 0x11
pop dx
setl dl
rdtsc
jmp 0xc6a95e
push word [esp]
mov word [esp + 1], sp
xchg dword [esp], edi
pop word [esp]
mov di, sp
bsr di, bp
jmp 0xc6a90f
mov di, 0x51ab
bsr dx, bx
mov di, word [esp + 1]
add esp, 0
xchg word [esp], ax
neg dl
jmp 0xc6a925
xchg dl, dh
rdtsc
xchg dword [esp + 2], edx
xchg dword [esp + 7], edi
not eax
bswap edi
jmp 0xc6aa31
lea eax, [edx + edi]
pop ax
mov edx, dword [esp]
mov dx, 0x1b3b
neg dh
pop dword [esp]
jmp 0xc6a8d8
mov ax, 0x587f
mov ah, 0x3f
mov ax, word [esp + 1]
lea esp, [esp]
jmp 0xc6aa01
rcl dh, cl
lea esp, [esp + 7]
mov edi, 0x389057b4
pop word [esp]
mov byte [esp], bl
mov eax, 0xe70901d
jmp 0xc6a98b
mov edx, 0x2b7e81b1
mov byte [esp + 0xf], dh
sbb di, 0x8835
jmp 0xc6a9e8
mov di, word [esp + 0xe]
bsr eax, esp
pop dword [esp + 6]
mov dx, word [esp + 0x14]
lea edx, [edx + esi]
pop ax
jmp 0xc6a9ba
seto dh
push cx
rdtsc
std
mov ax, sp
pop edx
jmp 0xc6aa17
adc al, 0x52
sub esp, 0x1e
mov eax, 0x78895d9a
lea eax, [ebx + ebx]
mov edi, 0x106cb8f3
rdtsc
jmp 0xc6a9d0
mov dh, byte [esp + 5]
xchg byte [esp + 6], dh
setns ah
rol edx, cl
bt edx, ebx
jmp 0xc6aaa7
lea esp, [esp + 7]
shr edx, 0xd
xchg dl, al
dec ah
lea eax, [ecx*4]
mov byte [esp + 3], bl
jmp 0xc6a9a1
push dword [esp + 0x17]
lea edx, [ebx*4]
pop dword [esp]
jmp 0xc6aa8d
mov ax, di
shl dl, 0
pushal
lea eax, [eax + edx]
bt di, di
mov ax, word [esp + 0x10]
jmp 0xc6aa4c
rcr edi, 0x19
setnp ah
mov edx, dword [esp + 0x36]
mov word [esp + 0x10], di
jmp 0xc6aad2
sbb ah, 0x4e
xchg dword [esp + 0x21], eax
clc
sub esp, 0
mov ax, 0x5f93
rdtsc
jmp 0xc6aa77
mov ax, word [esp + 7]
lea edi, [ecx + esi]
pop di
not dh
setb dl
push dword [esp + 0xa]
jmp 0xc6aa62
mov di, 0xe40f
bswap edx
xchg dx, ax
push dword [esp + 0x1b]
lea edi, [ecx + edx]
jmp 0xc6aae8
push word [esp + 0x1b]
sub dh, 0x16
mov edi, ecx
mov edx, 0xaf8b1f9
btc edi, ecx
mov eax, ecx
jmp 0xc6aabc
xchg edx, eax
mov dx, word [esp + 0x32]
mov dword [esp + 0xf], eax
pop dword [esp + 0x26]
push dx
xchg dh, dl
jmp 0xc6b356
bts ax, sp
mov word [esp + 0x11], sp
add esp, 0xd
push dword [esp + 5]
mov ax, 0x56c4
sub esp, 1
jmp 0xc6a975
lea edx, [edx + esi]
call fcn.00c6abbc
lea edx, [ecx + ebx]
pop word [esp + 6]
xchg dword [esp], eax
mov di, 0xe67c
lea edi, [ebp*4]
mov edx, dword [esp]
jmp 0xc6ae62
lea eax, reloc.RASAPI32.dll_RasHangUpA
lea eax, [ecx + edx]
mov di, bx
mov edi, 0x4b5b0f4b
cld
sub esp, 0x14
jmp 0xc6ae98
push dword [esp + 3]
lea esp, [esp + 0x42]
rdtsc
mov ah, 0x3b
sets ah
lea edi, reloc.RASAPI32.dll_RasHangUpA
jmp 0xc6aff0
Function at 0xc6abbc
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], dx
pop word [esp + 8]
add esp, 0xd
mov ah, cl
jmp 0xc6ab55
mov dx, word [esp + 0x13]
setg dh
mov di, bp
xchg byte [esp + 0xe], al
mov dword [esp + 0xe], esp
btr ax, di
jmp 0xc6ab26
push dword [esp]
mov dword [esp + 5], ecx
xchg byte [esp], dh
mov byte [esp + 4], ah
pop ax
dec eax
jmp 0xc6ab96
neg dh
not edx
pop word [esp + 3]
xchg dword [esp + 6], edx
xchg edi, eax
xchg ah, dl
jmp 0xc6abfe
shl di, 0xc
cmc
lea edx, [ebx + edi]
rdtsc
mov byte [esp + 0xd], ah
mov edi, 0x94d56ada
jmp 0xc6ab3c
push dword [esp + 5]
rdtsc
dec ax
setnp dl
mov dword [esp + 4], ebx
xchg edi, eax
jmp 0xc6ab68
rcl eax, 0xd
inc al
rcr dh, 6
lea edx, reloc.RASAPI32.dll_RasHangUpA
ror ah, cl
jmp 0xc6ab81
pushal
mov ah, dh
mov di, 0x261
lea eax, [esp + esi]
lea eax, [eax*4]
call fcn.00c6abe4
mov byte [esp + 0xa], bl
bsf dx, dx
xchg dh, ah
lea eax, [esp + edx]
pop dword [esp]
jmp 0xc6ac55
mov dh, byte [esp]
lea esp, [esp + 0x1c]
bsf edi, ecx
push word [esp + 8]
btc di, si
lea esp, [esp + 0xb]
jmp 0xc6aca3
mov al, 0x83
xchg word [esp + 4], ax
rcl dh, cl
pop di
call fcn.00c6ac49
mov ax, si
add esp, 5
jmp 0xc6acb2
xchg dword [esp], edx
mov dl, al
bts dx, bx
pop edx
call 0xc6ac8d
inc edx
mov edi, dword [esp]
pushal
mov edi, dword [esp + 0x1b]
call fcn.00c6ad28
dec ecx
jae 0xc6ad05
popal
push edx
popal
push eax
je 0xc6ad3e
add bl, bh
xchg byte [esp + 2], dl
mov dword [esp + 5], eax
lea edx, [ebp*4]
bsr edi, edx
add esp, 7
lea edx, [esi + ebp]
jmp 0xc6ac7d
mov dword [esp + 0x12], edx
pop dword [esp + 0xb]
mov dx, bx
bswap edx
jmp 0xc6ad12
xlatb
xchg dh, al
pop word [esp + 8]
add esp, 3
jmp 0xc6ace8
mov edx, 0xc606efdf
inc eax
mov byte [esp + 4], bl
mov di, 0xf421
jmp 0xc6ae32
lea edx, [edi + edi]
xchg word [esp + 0xa], dx
lea edx, reloc.RASAPI32.dll_RasHangUpA
jmp 0xc6ad79
xor eax, 0x362f38eb
and dword [eax - 0x5d], esp
fimul dword [ebx - reloc.RASAPI32.dll_RasHangUpA]
and byte [esi - 0x77], 0x54
and al, 0x2a
mov dl, byte [esp + 0x18]
lea edx, [ebx*4]
xchg byte [esp + 0x2b], dl
jmp 0xc6ad31
pop dword [esp + 0x17]
xchg dword [esp + 0x17], eax
push word [esp + 8]
mov dh, cl
jmp 0xc6adc4
mov dx, sp
mov word [esp + 0x1f], dx
mov edx, dword [esp + 0x36]
bswap edx
mov word [esp + 0x1b], sp
lea edx, [esi*4]
jmp 0xc6ad63
lea edi, reloc.RASAPI32.dll_RasHangUpA
xchg word [esp + 0x18], dx
xchg dword [esp + 0x2c], edx
jmp 0xc6adfe
rdtsc
push word [esp + 0x14]
not ax
mov edi, 0x1c945cf2
rol ax, cl
pop dx
jmp 0xc6adae
rdtsc
call 0xc6ad9b
lea eax, [eax + edx]
call 0xc6ae14
push ebx
je 0xc6ae40
popal
jae 0xc6ae6b
inc ebp
jb 0xc6ae6c
outsd dx, dword [esi]
jb 0xc6adfd
add eax, 0x19247c8b
mov edi, dword [esp + 0x19]
neg di
not dh
mov dword [esp + 0x2c], ebx
bswap edi
pop word [esp + 0x1d]
jmp 0xc6ade8
mov al, 0xb
setae ah
mov byte [esp + 2], dh
mov eax, edi
cld
sub esp, 0x1a
jmp 0xc6ade1
sbb ch, bl
sahf
cmc
call fcn.00c6ae80
dec edx
Function at 0xc6f947
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
push dword [esp + 6]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0xc6f994
mov eax, dword [eax]
jmp 0xc6fa43
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xc6f97e

Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0xddce6c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xddce76
pushal
call 0xddce7c
pop ebp
sub ebp, 0x10
sub ebp, 0x9dce6c
jmp 0xddce92
mov eax, 0x9dce6c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c1
mov edx, 0xe79e0445
xor byte [eax], dl
inc eax
dec ecx
jne 0xddcea9
jmp 0xddcebc
into
mov dh, cl
int3
Function at 0x41b300
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49bfab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00490380
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41b382
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048da60
mov eax, dword [eax]
push 0x4bd1f4
push eax
call fcn.0047fde4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0049060b
test bl, bl
je 0x41b382
push 0x4bd1f4
lea ecx, [esp + 0xc]
call fcn.0049099b
push 0x4c0d6c
lea ecx, [esp + 0xc]
call fcn.0049099b
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41b3be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0049060b
jmp 0x41b489
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41b442
lea edx, [esp + 0x7c]
push 0x4c0d68
push edx
call fcn.0047fde4
add esp, 8
test eax, eax
je 0x41b442
lea eax, [esp + 0x7c]
push 0x4c0d64
push eax
call fcn.0047fde4
add esp, 8
test eax, eax
je 0x41b442
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41b3d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0049060b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41bc80
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41bce2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x41bcf0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49c02b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4c9304]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x41be28
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x41bd56
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0049060b
xor eax, eax
jmp 0x41be9f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00490748
push esi
lea ecx, [esp + 0xc]
call fcn.004909d7
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x4c0da4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41be7d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push 0x4c0d9c
push SysReAllocString
call fcn.0041bc80
test eax, eax
jne 0x41be7d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push 0x4c0d88
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.0041bc80
test eax, eax
jne 0x41be7d
lea eax, [esp + 0x14]
push 0x4c0d80
push eax
call fcn.00480ef0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41be5c
lea ecx, [esp + 0x14]
push 0x4c0d7c
push ecx
call fcn.00480e70
mov esi, eax
add esp, 8
test esi, esi
jne 0x41be5c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41be5f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004906f8
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41bd6e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0049060b
xor eax, eax
jmp 0x41be9f
mov byte [esi], 0
push 0x4c0d78
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0049060b
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x42e970
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x42e9de
cmp si, 0x69
ja 0x42e9de
add esi, 0xffd0
cmp si, 0x11
je 0x42e9ae
push 0x11
call edi
test ax, ax
jge 0x42e9ae
or esi, 0x2000
cmp si, 0x10
je 0x42e9c3
push 0x10
call edi
test ax, ax
jge 0x42e9c3
or esi, 0x4000
cmp si, 0x12
je 0x42e9d8
push 0x12
call edi
test ax, ax
jge 0x42e9d8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x42e9eb
mov esi, 0xbd
jmp 0x42e99f
cmp si, 0x6e
jne 0x42e9f8
mov esi, 0xbe
jmp 0x42e99f
cmp si, 0x6f
jne 0x42e999
mov esi, 0xbf
jmp 0x42e99f

Function at 0x4301b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4d9b10]
xor edx, edx
cmp eax, edx
jne 0x4301d6
xor eax, eax
mov byte [eax + 0x4d9a10], al
inc eax
cmp eax, 0x100
jl 0x4301be
mov dword [0x4d9b10], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4d9a10
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x430267
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x43023a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x430208
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4302e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x430333
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x43031a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436d70
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x436f08
cmp ebp, ebx
jle 0x436f08
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x436dce
dec eax
or eax, 0xfffffff8
inc eax
je 0x436dd5
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, reloc.WS2_32.dll_accept
jns 0x436de4
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x436deb
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.0049034c
add esp, 4
cmp eax, ebx
je 0x436e0c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.0049034c
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x436efe
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x436ee5
mov al, byte [edx]
cmp al, 0xc0
jbe 0x436ed1
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x436ec6
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x436ed4
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x436ed4
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x436e70
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x436e61
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret