joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001caa
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001d2a
push str.avifil32.dll
call fcn.10009b60
test al, al
jne 0x10001cc3
pop esi
ret
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileInit
push dword [esi + 4]
call edi
push str.AVIFileExit
push dword [esi + 4]
mov dword [esi + 8], eax
call edi
push str.AVIFileRelease
push dword [esi + 4]
mov dword [esi + 0xc], eax
call edi
push str.AVIFileOpen
push dword [esi + 4]
mov dword [esi + 0x10], eax
call edi
push str.AVIStreamInfo
push dword [esi + 4]
mov dword [esi + 0x14], eax
call edi
push str.AVIStreamOpenFromFile
push dword [esi + 4]
mov dword [esi + 0x18], eax
call edi
push str.AVIStreamRelease
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
pop edi
mov al, 1
pop esi
ret

Function at 0x10001d60
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001de0
push str.winmm.dll
call fcn.10009b60
test al, al
jne 0x10001d79
pop esi
ret
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioInstallIOProcA
push dword [esi + 4]
call edi
push str.mmioOpenA
push dword [esi + 4]
mov dword [esi + 8], eax
call edi
push str.mmioClose
push dword [esi + 4]
mov dword [esi + 0xc], eax
call edi
push str.mmioAscend
push dword [esi + 4]
mov dword [esi + 0x10], eax
call edi
push str.mmioRead
push dword [esi + 4]
mov dword [esi + 0x14], eax
call edi
push str.mmioDescend
push dword [esi + 4]
mov dword [esi + 0x18], eax
call edi
push str.mciSendCommandA
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
pop edi
mov al, 1
pop esi
ret
Function at 0x100051a3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10014d34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0xe8], eax
jne 0x100051d1
cmp dword [esi + 0xec], edi
je 0x100052bb
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
mov dword [esi + 0xe8], eax
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi + 0x30]
mov dword [esi + 0xec], edi
mov dword [ebp - 8], edi
call fcn.10009b60
mov ebx, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, ebx
sete byte [ebp - 0x25]
and dword [ebp - 0x2c], 0
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x10005226
push 0
push dword [esi + 4]
call ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x9c]
mov edx, dword [esi + 0xa4]
mov ecx, dword [esi + 0x98]
push 0x10
sub edx, eax
push edx
mov edx, dword [esi + 0xa0]
sub edx, ecx
push edx
push eax
push ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 0x491
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x10005270
mov ecx, esi
call fcn.10009b60
cmp dword [ebp - 0x2c], 0
je 0x1000527d
push 1
push dword [esi + 4]
call ebx
cmp byte [ebp - 0x25], 0
pop ebx
je 0x1000528d
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x100052bb
mov eax, dword [esi + 0x98]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0xa4]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0xa0]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ecx]
push edx
call dword [eax + 0x34]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.10009710
leave
ret 8

Function at 0x100089c1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8

Function at 0x10008de5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push edi
mov edi, ecx
cmp eax, 0x1a
jl 0x10008e3e
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x10008e3e
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x18]
call ebx
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push 0x10
sub edx, eax
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
push ecx
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.10009b60
push 1
push dword [edi + 0x18]
call ebx
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x10009710
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10014d34]
jne 0x1000971a
repz ret
jmp fcn.10009ea3
Function at 0x10009b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10009b6f
pop dword [ebp - 0x34]
mov eax, 0x3497ba9c
sub eax, 0x24971f2d
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xe9aef22c
sub dword [ebp - 0x44], 0x9b5cace1
mov dword [ebp - 0x40], 0x574bade
add dword [ebp - 0x40], 0x2cbe9167
mov dword [ebp - 0x3c], 0xe2672fb7
add dword [ebp - 0x3c], 0x69e51477
mov dword [ebp - 0x38], 0xa72acec9
add dword [ebp - 0x38], 0x58d53137
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xb9cecb86
add dword [ebp - 0x44], 0xbaa39dd0
mov dword [ebp - 0x40], 0xbe19ab35
sub dword [ebp - 0x40], 0x7cad49c0
mov dword [ebp - 0x3c], 0x5fa5d8ac
add dword [ebp - 0x3c], 0x3c993c0
mov dword [ebp - 0x38], 0x12ed02de
sub dword [ebp - 0x38], 0x12ed02de
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x38e57
push 0
call eax
mov ecx, 0x9ab861ed
sub ecx, 0x9ab815c4
xor ebx, ebx
add ebx, eax
mov esi, 0x10019600
add esi, dword [ebp - 0x34]
mov edi, 0x45612e7f
add edi, 0xa8f2c5b9
add dword [ebp - 0x30], eax
mov edx, dword [esi]
add dword [ebp - 0x28], 0xe13629b2
xor edx, edi
xor dword [ebp - 0x10], eax
mov dword [ebx], edx
xor dword [ebp - 0x18], 0xaf20af41
add ebx, 4
add esi, 0x513fb33a
add esi, 0xaec04cca
loop 0x10009c83
add eax, 0x142a1e6
add eax, 0xfebe8191
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x41af61
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_FoldersCookies
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x447370
call fcn.004442a4
add esp, 0x28
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x41afc8
push ebx
call fcn.004442b0
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
push str..txt
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 2
call fcn.004011c0
add esp, 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push eax
push 1
push 0
push dword [ebp - 0xc]
mov eax, 0
call fcn.00444292
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41b016
push ebx
call fcn.004442b0
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41b02a
push ebx
call fcn.004442b0
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x53deda
push dword [ebp - 4]
call fcn.00401004
add esp, 8
cmp eax, 0
je 0x41b175
push reloc.WS2_32.dll_bind
push 0
push 0
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x41b074
mov eax, 0x53deda
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x41b088
mov eax, 0x53deda
push eax
push 4
mov ebx, 0x444ea0
call fcn.004442a4
add esp, 0x34
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x41b0c7
push 0x53deda
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.00401004
add esp, 8
cmp eax, 0
je 0x41b0c7
xor eax, eax
jmp 0x41b0cc
mov eax, 1
test eax, eax
je 0x41b13b
push dword [ebp - 4]
push 0x53deec
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 3
call fcn.004011c0
add esp, 0xc
mov dword [ebp - 0xc], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x41b104
mov eax, 0x53deda
push eax
push 1
mov ebx, 0x446470
call fcn.004442a4
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41b12a
push ebx
call fcn.004442b0
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x41b13b
mov dword [ebp - 8], 1
lea eax, [ebp - 0x20]
push eax
push 1
push 0
push 0
mov eax, 0
call fcn.00444292
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41b16c
push ebx
call fcn.004442b0
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x41b02e
mov eax, dword [ebp - 8]
jmp 0x41b17d
push eax
push dword [ebp - 0x20]
mov eax, 1
call fcn.00444292
add esp, 4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41b19e
push ebx
call fcn.004442b0
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4234fc
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00423347
and eax, 1
xor eax, 1
test eax, eax
je 0x423535
mov edx, 0
mov eax, 0
jmp 0x42356f
push 0x33
call 0x42353c
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret

Function at 0x423573
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00423347
and eax, 1
xor eax, 1
test eax, eax
je 0x4235ac
mov edx, 0
mov eax, 0
jmp 0x4235e4
push 0x33
call 0x4235b3
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4235ea
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.00423347
and eax, 1
xor eax, 1
test eax, eax
je 0x423617
mov eax, 0
jmp 0x42364c
push 0x33
call 0x42361e
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x42377c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.00423347
and eax, 1
xor eax, 1
test eax, eax
je 0x42379d
jmp 0x42383e
cmp dword [ebp + 8], 0
jne 0x4237a7
cmp dword [ebp + 0xc], 0
je 0x4237d1
cmp dword [ebp + 0x10], 0
jne 0x4237b7
cmp dword [ebp + 0x14], 0
je 0x4237d1
cmp dword [ebp + 0x18], 0
jne 0x4237c7
cmp dword [ebp + 0x1c], 0
je 0x4237d1
xor eax, eax
jmp 0x4237d6
mov eax, 1
test eax, eax
je 0x4237e3
jmp 0x42383e
push 0x33
call 0x4237ea
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x18

Function at 0x423ec1
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.00423347
and eax, 1
xor eax, 1
test eax, eax
je 0x423eee
mov eax, 0
jmp 0x423f21
push 0x33
call 0x423ef5
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x423f43
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.00423347
and eax, 1
xor eax, 1
test eax, eax
je 0x423f70
mov eax, 0
jmp 0x423fb8
mov dword [ebp - 4], 0
push 0x33
call 0x423f7e
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x10

Function at 0x423ff2
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call fcn.00423347
and eax, 1
xor eax, 1
test eax, eax
je 0x424039
mov edx, 0
mov eax, 0
jmp 0x42413b
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0x33
call 0x42405c
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x42ed0a
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x867d88]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x42ed45
add dword [esp], 5
retf

Function at 0x42efab
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x867d88]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x42efe6
add dword [esp], 5
retf

Function at 0x43618d
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x867d88]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4361c8
add dword [esp], 5
retf
Function at 0x44e200
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5345bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00528f42
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x44e282
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00526d5c
mov eax, dword [eax]
push 0x84dd10
push eax
call fcn.00517bf4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.005291cd
test bl, bl
je 0x44e282
push 0x84dd10
lea ecx, [esp + 0xc]
call fcn.0052955d
push 0x84dd1c
lea ecx, [esp + 0xc]
call fcn.0052955d
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x44e2be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.005291cd
jmp 0x44e389
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x44e342
lea edx, [esp + 0x7c]
push 0x84dd18
push edx
call fcn.00517bf4
add esp, 8
test eax, eax
je 0x44e342
lea eax, [esp + 0x7c]
push 0x84dd14
push eax
call fcn.00517bf4
add esp, 8
test eax, eax
je 0x44e342
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x44e2d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.005291cd
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x44eb80
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x44ebe2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x44ebf0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x53463b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x863bbc]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x44ed28
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x44ec56
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005291cd
xor eax, eax
jmp 0x44ed9f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0052930a
push esi
lea ecx, [esp + 0xc]
call fcn.00529599
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x84dd50
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x44ed7d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push bind
call fcn.0044eb80
test eax, eax
jne 0x44ed7d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push bind
mov ecx, edi
call fcn.0044eb80
test eax, eax
jne 0x44ed7d
lea eax, [esp + 0x14]
push 0x84dd2c
push eax
call fcn.00518dc0
mov esi, eax
add esp, 8
test esi, esi
jne 0x44ed5c
lea ecx, [esp + 0x14]
push 0x84dd28
push ecx
call fcn.00518d40
mov esi, eax
add esp, 8
test esi, esi
jne 0x44ed5c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x44ed5f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.005292ba
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x44ec6e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005291cd
xor eax, eax
jmp 0x44ed9f
mov byte [esi], 0
push 0x84dd24
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.005291cd
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x45fa90
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x45fafe
cmp si, 0x69
ja 0x45fafe
add esi, 0xffd0
cmp si, 0x11
je 0x45face
push 0x11
call edi
test ax, ax
jge 0x45face
or esi, 0x2000
cmp si, 0x10
je 0x45fae3
push 0x10
call edi
test ax, ax
jge 0x45fae3
or esi, 0x4000
cmp si, 0x12
je 0x45faf8
push 0x12
call edi
test ax, ax
jge 0x45faf8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x45fb0b
mov esi, 0xbd
jmp 0x45fabf
cmp si, 0x6e
jne 0x45fb18
mov esi, 0xbe
jmp 0x45fabf
cmp si, 0x6f
jne 0x45fab9
mov esi, 0xbf
jmp 0x45fabf

Function at 0x461730
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x874490]
xor edx, edx
cmp eax, edx
jne 0x461756
xor eax, eax
mov byte [eax + 0x874390], al
inc eax
cmp eax, 0x100
jl 0x46173e
mov dword [0x874490], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x874390
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4617e7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4617ba
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x461788
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x461860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4618b3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x46189a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x535998
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x20]
call fcn.0052fc50
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub eax, esi
sub ecx, edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
call fcn.00464d80
add esp, 0x14
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.0052fcc2
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret