joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410930
Capabilities:
Encode data using xor

Disassembly:
add dword [0x45a858], 0x4ca23d60
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.00423080
mov ecx, edi
mov esi, eax
call fcn.004072c0
cmp esi, eax
je 0x41098c
jmp 0x410960
xor dword [0x46bd84], 0xb0043b2f
mov ecx, edi
mov byte [esi], 0
inc esi
movzx eax, word [0x479b7a]
imul eax, eax, 0x87b39530
mov word [0x479b7a], ax
call fcn.004072c0
cmp esi, eax
jne 0x410960
xor dword [0x46affc], 0x1a800580
pop edi
pop esi
ret

Function at 0x411450
Capabilities:
Encode data using xor

Disassembly:
and dword [0x473624], 0x86a0d037
push esi
mov esi, ecx
call fcn.0040f850
mov eax, dword [0x4637b4]
shl eax, 3
cmp eax, 0xfefcdd8f
jl 0x41147d
and dword [0x46f6d4], 0x8002030c
jmp 0x41149f
movsx eax, word [0x47b05c]
mov ecx, 0xc4fabf98
sub ecx, eax
mov eax, dword [0x471924]
or eax, ecx
add dword [0x467224], eax
dec word [0x47b05c]
cmp dword [esi + 0x18], 0
jne 0x4114d8
jmp 0x4114b0
mov dword [0x466194], 0x38e7dd20
call fcn.00428b40
mov dword [esi + 0x18], eax
mov eax, dword [0x45d114]
and eax, 0xa60d773d
xor dword [0x469a4c], eax
cmp dword [esi + 0x18], 0
je 0x4114b0
add dword [0x45d8b8], 0xe231ee25
pop esi
ret
Function at 0x412bb0
Capabilities:
Encode data using xor

Disassembly:
add dword [0x474ee8], 0x5f17476c
sub esp, 8
mov eax, dword [0x46ca38]
not eax
and dword [0x46b00c], eax
push esi
push edi
push 0
call fcn.0042ae40
imul ecx, dword [0x467960], 0xaa52fb43
add esp, 4
cmp dword [0x458e60], 0
mov esi, eax
mov edi, edx
mov dword [0x467960], ecx
jne 0x412ca7
cmp dword [0x459678], 0
jne 0x412ca7
and dword [0x466e0c], 0xbefe3d7b
push 0
call fcn.0042ae40
add esp, 4
sub eax, esi
sbb edx, edi
test edx, edx
jg 0x412c71
jl 0x412c30
test eax, eax
jae 0x412c71
jmp 0x412c30
movzx eax, word [0x4798f2]
and eax, 0x6be73686
mov word [0x4798f2], ax
push 0x3e8
call dword [0x459814]
xor dword [0x45de68], 0xc79a3f44
push 0
call fcn.0042ae40
add esp, 4
sub eax, esi
sbb edx, edi
mov dword [esp + 0xc], edx
js 0x412c30
jg 0x412c71
test eax, eax
jb 0x412c30
dec dword [0x467c28]
mov eax, dword [0x467c28]
imul eax, eax, 0x4d03b21d
cmp eax, 0x1b435aee
jne 0x412c95
and dword [0x464240], 0x402a5d4e
jmp 0x412ca7
movzx eax, word [0x4819d2]
add eax, 0x13500405
mov word [0x4819d2], ax
mov ecx, dword [0x466c28]
mov eax, dword [0x46cff4]
not ecx
and eax, ecx
pop edi
pop esi
cmp eax, 0xf476f61
jle 0x412cc9
mov dword [0x465798], 0xcb774d0a
add esp, 8
ret

Function at 0x414f60
Capabilities:
Encode data using xor

Disassembly:
movzx eax, word [0x47667e]
xor eax, 0x84a867be
mov word [0x47667e], ax
mov ecx, dword [0x473ef0]
mov eax, dword [0x4626b4]
not ecx
and eax, ecx
or dword [0x45c348], eax
cmp dword [0x4721ec], 0x34d8c043
jle 0x414f9d
add dword [0x460d1c], 0xd3cb3250
mov eax, dword [esp + 4]
test eax, eax
je 0x41503c
lea edx, [esp + 4]
lea ecx, [ecx]
mov dword [0x467358], 0x69fa279a
lea edx, [edx + 4]
mov dword [eax], 1
movzx eax, word [0x47b522]
not eax
and eax, 0x2a610208
mov word [0x47e180], ax
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
movzx eax, word [0x47c94c]
or eax, 0xffffff73
mov word [0x47c94c], ax
mov eax, dword [esp + 4]
mov dword [eax + 8], 0
mov ecx, dword [0x46f558]
movzx eax, word [0x47b8e4]
xor ecx, 0xe5a7befe
or ecx, 0x85260ee8
add eax, ecx
mov word [0x47b8e4], ax
mov eax, dword [edx]
mov dword [esp + 4], eax
add dword [0x46dd6c], 0x6d1d5d44
mov eax, dword [esp + 4]
test eax, eax
jne 0x414fb0
mov ecx, dword [0x46a28c]
mov eax, dword [0x460408]
xor ecx, eax
add dword [0x45bc80], ecx
mov eax, dword [0x46e544]
xor eax, 0x1e6aeb4d
cmp eax, 0x7906adb8
jge 0x41506b
mov dword [0x471d70], 0x55181156
ret
mov dword [0x4673a4], 0x774f3a5e
ret
Function at 0x4199c0
Capabilities:
Write file on windows

Disassembly:
movsx ecx, word [0x476622]
movzx eax, word [0x47d712]
or ecx, 0x29dad976
and eax, ecx
mov word [0x47d712], ax
mov eax, dword [0x46a550]
sub eax, 0x65419578
or eax, 0x797a8bba
add dword [0x471c54], eax
cmp dword [0x483324], 0
jne 0x419a37
mov dword [0x46e654], 0x8200081
call fcn.00428b40
mov dword [0x483324], eax
movsx eax, word [0x47fdd2]
sar eax, 2
and eax, 0xc2973240
cmp eax, 0xf81dab18
jl 0x419a37
mov eax, dword [0x45ce24]
sar eax, 6
xor eax, 0xa4c31d8b
sub dword [0x4741b4], eax
inc dword [0x46d394]
mov eax, dword [0x46d394]
push esi
push edi
xor eax, 0x9f96e19c
or eax, dword [0x47329c]
push 3
mov dword [0x47329c], eax
push 0xa96
call fcn.00414800
movsx ecx, word [0x479d7c]
mov edi, eax
imul ecx, ecx, 0xea366399
push edi
push dword [esp + 0x18]
or ecx, 0xd2099daf
and dword [0x46452c], ecx
dec word [0x479d7c]
call fcn.0042c6a1
mov ecx, dword [0x471448]
add esp, 0x10
sub ecx, 0x7cce4e47
mov esi, eax
cmp ecx, 0x115e67ce
jne 0x419ab5
imul ecx, dword [0x45b378], 0x4829b4
mov dword [0x45b378], ecx
push edi
push 3
call fcn.00415310
movsx eax, word [0x47fd84]
add esp, 8
sub eax, 0x3cc9f1b8
or eax, 0xa03fc969
cmp dword [0x45f580], eax
jg 0x419af0
movsx eax, word [0x4762c6]
and eax, 0x8d7fb110
xor eax, 0x34d0d016
or dword [0x45ec18], eax
test esi, esi
jne 0x419ba4
mov eax, dword [0x45ebf4]
xor eax, 0xac810a5c
or dword [0x470fb8], eax
push 0x3e8
call dword [0x459814]
movsx eax, word [0x47a9de]
not eax
or eax, 0x9a09d419
cmp eax, 0x9eb955a4
jg 0x419b32
add dword [0x45b4f0], 0xffb9fffa
push 3
push 0xa96
call fcn.00414800
mov ecx, dword [0x459f0c]
add esp, 8
shl ecx, 7
mov edi, eax
cmp ecx, 0x4152a141
jle 0x419b79
mov edx, dword [0x4733d4]
mov ecx, dword [0x45d380]
not edx
xor ecx, edx
cmp ecx, 0x8e6b791a
je 0x419b79
mov ax, word [0x479c18]
cwde
xor dword [0x4651b0], eax
push edi
push dword [esp + 0x10]
call fcn.0042c6a1
add dword [0x46f244], 0x24b66255
mov esi, eax
push edi
push 3
call fcn.00415310
add esp, 0x10
xor dword [0x461400], 0x2d962cf9
mov eax, dword [0x4674c4]
and eax, 0x30078404
or eax, 0x4dc023d1
add dword [0x471db4], eax
inc dword [0x4674c4]
test esi, esi
je 0x419c27
xor dword [0x468514], 0x46f22a2e
push esi
push 1
push 4
push 0x483324
call fcn.0042c854
xor dword [0x46c7e4], 0x8f8b4226
push esi
call fcn.0042c376
mov eax, dword [0x45b480]
add esp, 0x14
imul eax, dword [0x475170]
dec dword [0x45b480]
or eax, 0xe4365394
cmp eax, 0xaa9251ef
jl 0x419c27
movsx eax, word [0x480e86]
imul eax, eax, 0x343a4dbd
cmp eax, 0x8f663327
jle 0x419c27
mov ax, word [0x480344]
or dword [0x45cdd4], 0xf5f6edfb
pop edi
pop esi
ret
Function at 0x423f00
Capabilities:
Hash data with md5

Disassembly:
imul eax, dword [0x47470c], 0x3a4e0e49
mov dword [0x47470c], eax
mov dword [ecx], 0
xor dword [0x45c1c4], 0xb996b808
mov dword [ecx + 4], 0
movsx eax, word [0x4765de]
imul eax, eax, 0x6714483
cmp eax, 0xdb86af04
je 0x423f46
add dword [0x4745a8], 0xc1a24f76
jmp 0x423f50
xor dword [0x46ab78], 0x8c44738c
mov dword [ecx + 8], 0x67452301
mov eax, dword [0x4728a0]
sub eax, dword [0x46d1d4]
xor eax, 0xdfc4101d
and dword [0x45e3a8], eax
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x45c7f4]
xor eax, 0x164cdfac
cmp eax, 0xb235ea5a
jne 0x423f8f
add dword [0x470e6c], 0x9fff1bf8
mov dword [ecx + 0x10], 0x98badcfe
mov eax, dword [0x473f98]
sub eax, dword [0x45a7b8]
mov dword [0x473f98], eax
inc dword [0x45a7b8]
mov dword [ecx + 0x14], 0x10325476
mov dword [0x467700], 0xbd19a5cc
ret
Function at 0x433eaa
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4585d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042de2c
mov dword [ebp - 0x14], eax
cmp dword [0x483eb4], esi
jne 0x433f9d
push 0x800
push esi
push 0x44e280
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x433f2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43407d
push esi
push esi
push 0x44e280
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43407d
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43407d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x483eb4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x483eb8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x483ebc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x483ec4], eax
test eax, eax
je 0x433f9a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x483ec0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x433fc2
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x433fb5
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x433fd7
push 4
pop eax
jmp 0x43407f
cmp dword [ebp - 0x14], esi
je 0x433fd7
push dword [0x483eb4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x433fbc
mov eax, dword [0x483ec0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x434035
cmp dword [0x483ec4], edi
je 0x434035
push eax
call ebx
push dword [0x483ec4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x434035
test eax, eax
je 0x434035
call ecx
test eax, eax
je 0x43402a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43402a
test byte [ebp - 8], 1
jne 0x434035
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x434065
mov eax, dword [0x483eb8]
cmp eax, edi
je 0x434062
push eax
call ebx
test eax, eax
je 0x434062
call eax
mov esi, eax
test esi, esi
je 0x434062
mov eax, dword [0x483ebc]
cmp eax, edi
je 0x434062
push eax
call ebx
test eax, eax
je 0x434062
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x483eb4]
call ebx
test eax, eax
je 0x43407d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43407f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00433c6f
mov esp, ebp
pop ebp
ret
Function at 0x40281c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x402826
repz ret
jmp fcn.00402a2b

Function at 0x40488b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004037d3
and dword [ebp - 0x14], 0
cmp dword [0x44b84c], 0
mov dword [ebp - 0x18], eax
jne 0x40493e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4049e6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4049e6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44b84c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44b850], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44b854], eax
call edi
push eax
call esi
mov dword [0x44b85c], eax
test eax, eax
je 0x40493e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44b858], eax
mov eax, dword [0x44b858]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404997
cmp dword [0x44b85c], ecx
je 0x404997
push eax
call esi
push dword [0x44b85c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404997
test ebx, ebx
je 0x404997
call edi
test eax, eax
je 0x40498e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40498e
test byte [ebp - 8], 1
jne 0x404997
or dword [ebp + 0x10], 0x200000
jmp 0x4049ca
mov eax, dword [0x44b850]
cmp eax, dword [ebp - 0x18]
je 0x4049ca
push eax
call esi
test eax, eax
je 0x4049ca
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4049ca
mov eax, dword [0x44b854]
cmp eax, dword [ebp - 0x18]
je 0x4049ca
push eax
call esi
test eax, eax
je 0x4049ca
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44b84c]
call esi
test eax, eax
je 0x4049e6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4049e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040281c
leave
ret

Function at 0x401166
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8a9140]
jne 0x401170
repz ret
jmp fcn.004014af
Function at 0x421282
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00421432
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x421380
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x421323
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x421366
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x42133a
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x421355
test al, 0x40
je 0x42134c
mov ecx, dword [edi + 0x20]
jmp 0x421353
test al, 0x80
je 0x421366
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x421366
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4212f2
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x508cf0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x663b1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0065547a
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x508d72
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.006520b9
mov eax, dword [eax]
push 0xa38d80
push eax
call fcn.00640434
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00655705
test bl, bl
je 0x508d72
push 0xa38d80
lea ecx, [esp + 0xc]
call fcn.00655ae1
push 0xa38d8c
lea ecx, [esp + 0xc]
call fcn.00655ae1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x508dae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00655705
jmp 0x508e79
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x508e32
lea edx, [esp + 0x7c]
push 0xa38d88
push edx
call fcn.00640434
add esp, 8
test eax, eax
je 0x508e32
lea eax, [esp + 0x7c]
push 0xa38d84
push eax
call fcn.00640434
add esp, 8
test eax, eax
je 0x508e32
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x508dc2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00655705
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x50a0e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x50a142
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x50a150
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x663c7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0xb14a78]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x50a288
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x50a1b6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00655705
xor eax, eax
jmp 0x50a2ff
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0065588e
push esi
lea ecx, [esp + 0xc]
call fcn.00655b1d
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0xa38dd0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x50a2dd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push connect
call fcn.0050a0e0
test eax, eax
jne 0x50a2dd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push connect
mov ecx, edi
call fcn.0050a0e0
test eax, eax
jne 0x50a2dd
lea eax, [esp + 0x14]
push 0xa38dac
push eax
call fcn.006416b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x50a2bc
lea ecx, [esp + 0x14]
push 0xa38da8
push ecx
call fcn.00641630
mov esi, eax
add esp, 8
test esi, esi
jne 0x50a2bc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x50a2bf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0065583e
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x50a1ce
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00655705
xor eax, eax
jmp 0x50a2ff
mov byte [esi], 0
push 0xa38da4
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00655705
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x51ffa0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x52000e
cmp si, 0x69
ja 0x52000e
add esi, 0xffd0
cmp si, 0x11
je 0x51ffde
push 0x11
call edi
test ax, ax
jge 0x51ffde
or esi, 0x2000
cmp si, 0x10
je 0x51fff3
push 0x10
call edi
test ax, ax
jge 0x51fff3
or esi, 0x4000
cmp si, 0x12
je 0x520008
push 0x12
call edi
test ax, ax
jge 0x520008
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x52001b
mov esi, 0xbd
jmp 0x51ffcf
cmp si, 0x6e
jne 0x520028
mov esi, 0xbe
jmp 0x51ffcf
cmp si, 0x6f
jne 0x51ffc9
mov esi, 0xbf
jmp 0x51ffcf

Function at 0x5219b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xb26480]
xor edx, edx
cmp eax, edx
jne 0x5219d6
xor eax, eax
mov byte [eax + 0xb26380], al
inc eax
cmp eax, 0x100
jl 0x5219be
mov dword [0xb26480], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xb26380
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x521a67
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x521a3a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x521a08
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x521ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x521b33
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x521b1a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret