joyce8/EMBER2024-capa huggingface dataset:
Function at 0x562e81
Capabilities:
Encrypt data using aes

Disassembly:
pushal
neg edi
mov dword [esp + 0x1c], edx
popal
mov ax, word [esp]
neg bx
sub bl, ah
cmc
jmp 0x562dca
mov ebp, 0x21b570b2
mov esi, 0xde8f3040
mov bl, byte [esp]
mov al, byte [esp]
mov dword [ecx + 0xc], edx
jmp 0x562de5
stc
mov bl, bh
xor edx, eax
jmp 0x562e03

Function at 0x61c5f9
Capabilities:
Encode data using xor

Disassembly:
xor bh, al
dec ebp
test al, 0x20
pop eax
push edi
clc
invalid
adc dword [ecx + reloc.MSVCRT.dll_strncpy], ebx
sbb esi, dword [esi - 0x1e]
sar byte [ebp - 0x34], cl
stosb byte es:[edi], al
mov ebp, 0xfc5921b8
clc
sub al, 0x4c
sub eax, 0x9e2c2b42
loope 0x61c5d7
xor eax, 0xc5af71ec
push edx
cmp esi, dword [ebp - reloc.MSVCRT.dll_strncpy]
jmp 0xe2941674

Function at 0x62ff4d
Capabilities:
Encode data using xor

Disassembly:
inc dword [ebp - 0x4b]
pop ebp
add ecx, dword [esi - reloc.MSVCRT.dll_strncpy]
and ebx, dword [edx + reloc.MSVCRT.dll_strncpy]
div esi
mov eax, edi
fdiv qword [edi + 0x72]
sub ch, byte [edi + 0x27]
clc

Function at 0x6355b1
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + esi*4 - 0x65146f0d], ebx
fdiv dword [edi - reloc.MSVCRT.dll_strncpy]
xor al, dh
mov dword [reloc.MSVCRT.dll_strncpy], eax
in al, 6
xor bl, byte [ecx - 0x5d683b5]
fstp qword [esi - 0x528a8279]
push edi
xor al, byte [eax + 0x2e08180f]
invalid
mov esp, 0xa526ef5b
stc
xchg dword [edx], esi
mov ecx, dword [edx]
xchg ebx, eax
jbe 0x635557
cdq
push ss
jg 0x6355bd
pop ds
rol dl, cl
mov esi, 0x9f01e997
invalid

Function at 0x637c76
Capabilities:
Encode data using xor

Disassembly:
aam 0xb7
pop ss
xchg esp, eax
dec ebx
adc al, 0x4a
push edi
inc edi
cmp dh, byte [ebp - 0x64f2775c]
mov dh, 0x50
sub dword [ebx - 0x4f], esp
cmp al, 0xa3
or byte [edi - 0x60], ah
mov al, byte [0x56da1523]
add eax, 0x2d8a33df
adc edi, dword [edx]
invalid
ret
mov al, byte [0x56da1523]
add eax, 0x2d8a33df
adc edi, dword [edx]
mov byte [0x6de7a4c3], al
in eax, dx
insb byte es:[edi], dx
pop ss
xor dword [edx + reloc.MSVCRT.dll_strncpy], eax
not edx
or ebx, dword [ecx + reloc.MSVCRT.dll_strncpy]
sub eax, 0x368c9cdd
jecxz 0x637c5e
mov byte [ebx + 0x2b73ef7c], cl
out dx, eax
push 0xffffffffffffffa7
dec eax
mov esi, 0x7d75f4aa
outsd dx, dword [esi]
jns 0x637cb7
cli
add eax, 0x679fc8c8
cmpsd dword [esi], dword es:[edi]
lodsb al, byte [esi]
inc esp
out 0x78, eax
mov bh, 0xe7
xchg ecx, eax
out 0x8a, eax
dec eax
stosb byte es:[edi], al
cmp al, al
iretd
Function at 0x6422e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dx
xchg dword [esp + 0xf], edi
pop dword [esp]
jmp 0x642343
mov dx, di
lea edi, [esi*4]
bswap edx
inc dl
btr edx, edx
sub esp, 0x1e
jmp 0x642aaf
mov di, word [esp]
mov dx, word [esp]
push esp
mov di, 0xa239
mov eax, dword [esp + 2]
xchg dh, al
jmp 0x6423db
mov edi, eax
setle ah
bsr di, cx
not di
btc edi, edi
not eax
jmp 0x642371
shr dh, 7
setne dh
add esp, 1
inc edi
cmc
bswap edi
jmp 0x642398
add esp, 0
xchg di, ax
mov edi, esp
mov ax, sp
lea edi, [eax*4]
pushal
jmp 0x64272f
and ax, 0x1f5a
pop word [esp]
pop dx
mov edi, dword [esp]
rdtsc
xchg byte [esp], al
jmp 0x6423c2
pop dx
lea eax, [edx*4]
btc eax, ebx
add esp, 0x1b
mov di, 0x73a7
xchg ah, dh
jmp 0x6423b3
sete dh
xchg word [esp + 0x21], di
add esp, 0x1c
lea edi, [edx + edi]
mov edi, 0x703a8bae
xchg byte [esp + 4], dh
jmp 0x6423f3
test eax, 0xb247489
mov dword [esp + 0xb], esi
lea edi, [esi*4]
bsf di, si
mov ah, byte [esp + 7]
btc eax, edi
call fcn.00642676
lea edi, [edi*4]
mov ax, word [esp + 1]
call 0x64275c
enter 0x648d, 0x24
or cl, byte [edi]
mov ebx, 0x2474ffff
adc eax, 0x675ceb92
out dx, eax
jg 0x642788
jmp 0xca1a98c
add byte [ecx + edx*4], bl
add dword [eax - 0x6d], esp
jae 0x64272e
adc al, byte [eax + 0x13f912e7]
mov ah, byte [0xff6ec754]
je 0x6427c2
push es
cld
mov edi, ebp
pop di
xchg word [esp + 7], di
push word [esp + 7]
call fcn.00642784
jbe 0x6427ae
imul ecx, dword [eax], reloc.MSVCRT.dll_strncpy
dec eax
das
fidivr dword [eax]
stosb byte es:[edi], al
aas
scasd eax, dword es:[edi]
retf 0xae39
rdtsc
pop dx
mov ax, 0xe667
xchg ah, dh
setbe dh
not edx
jmp 0x64241e

Function at 0x6425fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr dh, 7
xchg byte [esp + 4], dl
lea eax, reloc.MSVCRT.dll_strncpy
push word [esp + 0xd]
xchg dword [esp + 9], eax
xchg edi, eax
jmp 0x64262b
stc
lea edi, [eax*4]
jmp 0x6425db
Function at 0x642784
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x642876
btc edi, ebx
not edi
mov dword [esp + 7], ecx
xchg word [esp + 0xb], dx
not dh
stc
jmp 0x642855
xchg ah, dh
sub esp, 0x18
setns ah
mov word [esp + 0x20], di
setnp dh
mov di, word [esp + 0x1c]
jmp 0x6427f2
xchg ah, dh
xchg edi, eax
mov edi, dword [esp + 0xf]
lea edi, [edx + ebx]
xchg word [esp + 8], di
stc
jmp 0x64281a
sub esp, 0
pushal
lea esp, [esp + 0x56]
lea edi, reloc.MSVCRT.dll_strncpy
mov di, bx
mov dh, bh
jmp 0x6429da
mov dh, byte [esp + 0xf]
mov ah, byte [esp + 0x17]
mov dl, dh
rdtsc
not di
mov eax, dword [esp + 0xb]
jmp 0x642842
mov edi, 0xfb064ab2
xchg byte [esp + 0x23], dh
btc edi, ebx
mov dword [esp + 0x11], ebp
bsr di, cx
jmp 0x64294e
xchg dh, al
pop dword [esp + 6]
xchg dword [esp + 0xe], edx
pop dword [esp + 2]
sub esp, 0x18
jmp 0x6428a8
sub esp, 0
bswap eax
pop word [esp + 0x15]
xor eax, esi
bswap edi
setne dh
jmp 0x6428c3
mov di, word [esp + 0xe]
xchg byte [esp + 4], dh
mov eax, 0x25dba4c6
mov word [esp + 0xe], sp
xchg edx, eax
mov di, 0x3d4f
jmp 0x6428df
push dword [esp + 8]
mov edx, edi
mov byte [esp + 0x18], dh
mov edx, esi
clc
rcl dx, cl
jmp 0x6428fa
mov edi, dword [esp]
mov dh, byte [esp]
inc dh
xchg edi, eax
rdtsc
btr edi, esp
jmp 0x6429b8
xchg dword [esp + 0xc], edx
mov dword [esp + 0x13], esi
sub esp, 0x1a
lea esp, [esp + 0x4a]
mov edi, 0x8d8de224
bswap edx
jmp 0x642935
lea edi, [ebp + 0x6f]
mov di, word [esp + 0x14]
pop dword [esp + 2]
rcl dh, 3
clc
push dword [esp + 0x10]
jmp 0x642923
and dh, bh
stc
push edx
push word [esp + 1]
mov ax, 0x7d87
xchg dx, di
jmp 0x6429a2
pop word [esp + 1]
mov eax, dword [esp + 1]
mov dword [esp], ecx
mov dh, 0x6a
jmp 0x642a96
bsf dx, si
xchg edx, edi
inc al
xchg di, ax
mov edi, 0xdc227e0e
not dx
jmp 0x64298c
bts edi, ebx
sub esp, 0x1e
mov dh, byte [esp + 9]
bswap edi
mov ah, byte [esp + 0xf]
stc
jmp 0x642976
mov word [esp], sp
call fcn.00642a1e
dec ebp
les ebx, [edx + 0x3d]
int3
Function at 0x6429ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edi
sub esp, 0xc
mov di, cx
mov byte [esp + 2], ch
jmp 0x642a63
xchg word [esp + 3], di
xchg byte [esp + 4], dl
mov edx, 0x99a867f2
mov dword [esp + 1], ebp
jmp 0x642a76
mov dword [esp + 3], esi
ror dh, 7
mov dh, byte [esp + 7]
pop dword [esp]
mov ax, si
jmp 0x642a31
bsf di, ax
pop dword [esp]
clc
lea edx, [edx + edi]
bswap eax
push dword [esp + 0xa]
jmp 0x642a49
not edi
rdtsc
rol ax, cl
push dword [esp + 8]
pushal
push esp
jmp 0x642af8
inc dx
pop dword [esp + 0xc]
mov edi, dword [esp]
rol dh, 3
sub esp, 6
mov dword [esp + 4], eax
jmp 0x642bf2
add esp, 6
mov dh, byte [esp + 1]
sub esp, 0xc
sub esp, 6
rdtsc
mov edi, ecx
jmp 0x642ac3
add esp, 0x29
clc
mov al, ah
bswap edx
pop di
dec edx
jmp 0x642adc
xchg edi, edx
mov edx, 0x885e0fe2
xchg dword [esp + 0x2e], edi
push word [esp + 0x30]
neg ax
xchg dh, dl
call fcn.00642b05
iretd
mov di, dx
pop dword [esp + 8]
lea eax, [edx + ebx]
sub esp, 0x12
push dword [esp + 0x1d]
clc
jmp 0x642b1f
mov di, dx
mov dx, di
lea edi, reloc.MSVCRT.dll_strncpy
xchg ah, dh
xchg byte [esp], dh
pushal
jmp 0x642b3d
xchg word [esp + 3], dx
bswap eax
pop di
mov dword [esp], eax
xchg word [esp + 1], ax
add esp, 3
jmp 0x642b57
pop word [esp + 0x10]
pop word [esp + 9]
lea esp, [esp + 0xf]
push word [esp + 3]
mov word [esp], di
bts edx, ebx
jmp 0x642b8f

Function at 0x642b76
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x41]
btr eax, esp
mov edi, dword [esp]
mov ax, bp
jmp 0x642bd9
lea edi, [edx*4]
mov edi, edx
mov edi, dword [esp]
mov dh, pe_nt_image_headers32
inc dl
dec ax
jmp 0x642c34
mov dl, 0x5c
mov dl, byte [esp]
neg dh
rdtsc
not dx
bswap edi
jmp 0x642ba5
setno ah
cmp eax, ecx
xchg edi, eax
mov dh, byte [esp]
mov di, bx
mov di, 0x927b
jmp 0x642bc1
mov dword [esp + 1], eax
xchg dword [esp], edi
mov al, 0x9e
mov dh, byte [esp + 1]
xchg dx, di
push edx
jmp 0x642d4f
xchg edx, eax
shr dh, 5
mov edx, ebp
mov ax, cx
clc
sub esp, 0xe
jmp 0x642c0e
add esp, 2
rdtsc
call fcn.00642c57
bswap edx
bswap edi
shr edi, 0xd
mov ah, byte [esp + 5]
mov dh, 0xfa
bsr di, bp
jmp 0x642c78
mov edi, esp
push word [esp + 0xb]
add esp, 0xd
mov dh, byte [esp]
mov edi, dword [esp + 5]
mov dh, bh
jmp 0x642c9c
Function at 0x643139
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edi
not dh
mov dx, word [esp + 1]
xchg byte [esp + 4], al
mov dh, 2
jmp 0x643180
jmp 0x643122
rdtsc
mov ah, byte [esp + 1]
cmp di, 0x6c18
xchg ah, dh
not eax
not dh
jmp 0x643167
mov word [esp], di
xchg dword [esp], edx
mov edi, ecx
cmc
mov byte [esp], dh
add al, dh
jmp 0x64313b
xchg dword [esp], edi
mov word [esp], sp
rol di, cl
mov edi, 0x5154c17a
add esp, 3
jmp 0x6431d0
mov edx, dword [esp + 0xa]
pop di
mov edi, dword [esp + 0xc]
push edx
lea esp, [esp + 0xd]
xchg dword [esp], edi
jmp 0x643156
not di
lea edx, reloc.MSVCRT.dll_strncpy
xchg byte [esp], al
bsf di, si
bsr di, cx
mov edi, 0xa5ec0cbe
jmp 0x643202
mov edx, 0x2ca966e8
clc
xchg byte [esp], dh
not ax
not di
mov di, word [esp]
jmp 0x643194
lea esp, [esp]
rdtsc
neg edx
and dh, bh
mov byte [esp], dh
rcl edi, 0x15
jmp 0x6431b6
mov dx, word [esp]
add esp, 0
call fcn.006431e1
inc ebx
ret 0x3750
Function at 0x6431e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 2]
bsf dx, ax
xchg edx, edi
mov word [esp + 4], dx
jmp 0x643400
lea esp, [esp + 0x41]
xchg dh, al
lea eax, [edx + ebx]
rdtsc
push esp
mov edi, dword [esp + 1]
jmp 0x6432b7
mov dh, 0x7a
rdtsc
sub esp, 0xa
rdtsc
lea eax, [ebx*4]
sub esp, 0x18
jmp 0x64323b
mov edi, edx
mov byte [esp + 1], dh
sub esp, 0xe
lea eax, [edx + esi]
mov dl, 0x7c
lea edi, [edx*4]
jmp 0x643255
bsr ax, bp
neg di
stc
shr edi, 3
pop dx
xchg edi, eax
jmp 0x6432cb
mov word [esp + 2], sp
mov byte [esp + 4], ch
xchg dx, di
pop word [esp + 1]
jmp 0x643329
xchg byte [esp + 2], dh
not ax
rdtsc
not dh
xchg word [esp + 1], ax
mov dh, 0xc2
jmp 0x643290
mov byte [esp], dh
add al, dh
inc dh
sub esp, 4
mov eax, 0x96b2a9de
mov eax, edi
jmp 0x6432a0
sub esp, 0xc
pop dx
mov edi, 0x5020d518
xor ax, 0xd5c
mov byte [esp + 3], ah
mov dx, 0x5b5
jmp 0x643279
bswap edi
lea edx, [ebp + 0x37]
pop edi
neg dh
sub esp, 0xe
mov ax, dx
jmp 0x643354
and dh, bh
mov dh, ch
lea esp, [esp + 3]
mov ah, byte [esp]
sub esp, 0x12
bswap eax
jmp 0x643304
inc dh
btr edx, edx
rdtsc
bsr dx, cx
xchg di, ax
cmp di, 0x8992
jmp 0x6433d5
shr dh, 7
pop di
mov byte [esp + 0x11], dh
lea esp, [esp + 6]
push word [esp + 2]
push word [esp + 5]
jmp 0x64333b
rdtsc
mov ax, 0x45e7
mov dword [esp], esi
btc eax, ebx
mov edi, dword [esp + 1]
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0x6432e9
xchg byte [esp + 8], al
lea edi, [eax + ebx]
bsf di, ax
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0x6433e8
mov word [esp + 0x11], dx
xchg byte [esp + 0xa], dh
cmc
setae ah
lea edx, [edx + edi]
setnp dh
jmp 0x643397
mov edx, ecx
clc
mov word [esp + 0xd], di
btc edx, ebx
mov dh, byte [esp + 0x13]
xchg dh, al
jmp 0x6433ae
rdtsc
mov edx, eax
mov dh, bh
setle dh
pop word [esp + 6]
bsr di, cx
jmp 0x64376c
mov dl, 0xd4
neg edi
mov byte [esp + 5], ch
sub dh, ah
setns dh
mov edx, dword [esp + 5]
jmp 0x64337c
btc edx, ebx
call fcn.006434e9
push word [esp + 1]
pop word [esp + 1]
lea esp, [esp + 3]
pushal
pop word [esp + 0x12]
jmp 0x643803
push 0
call 0x643774
pop word [esp + 0xa]
push word [esp + 5]
call fcn.006437ed
adc byte [edx + 0x789a6f08], bl
jnp 0x643812
push dword [esp + 0xd]
pushal
lea esp, [esp + 0x43]
pushal
lea esp, [esp + 0xf]
jmp 0x643795
push word [esp + 3]
push dword [esp + 0x1b]
call 0x6437e8
movsb byte es:[edi], byte [esi]
sub bh, byte [eax - 0x343bd521]
bound ebx, qword [ebp + 0x74ff66ec]
and al, 1
push dword [esp]
push word [esp + 3]
push dword [esp + 4]
lea esp, [esp + 0x10]
jmp 0x64378e

Function at 0x645428
Capabilities:
Get number of processors
Parse pe header

Disassembly:
pop dword [esp + 0xc]
call fcn.0064548c
push dword [esp + 0x18]
push dword [esp + 0x10]
pop dword [esp + 6]
jmp 0x6453ff

Function at 0x64544f
Capabilities:
Get number of processors
Parse pe header

Disassembly:
lea esp, [esp + 1]
mov word [esp], sp
push edx
lea esp, [esp + 3]
mov dword [esp + 0x88], edi
jmp 0x645411
Function at 0x64548c
Capabilities:
Get number of processors
Parse pe header

Disassembly:
call fcn.0064517f
lea esp, [esp + 0x44]
call fcn.0064544f
lea esp, [esp + 0x88]
jmp 0x645436
mov eax, dword fs:[0x30]
jmp 0x645465
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x645473
mov eax, dword [eax + 8]
push eax
jmp 0x64517a
pop dword [esp + 0x1a]
mov dword [esp + 0x88], esi
pushal
push dword [esp]
pushal
jmp 0x645408

Function at 0x6454f8
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 3]
mov dword [esp + 0x68], ebp
pushal
call fcn.00645428
mov byte [esp + 3], ah
jmp 0x6454b3

Function at 0x440130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.tJrdyPER
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x440152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440148
mov eax, 1
add ebx, ebx
jne 0x44016b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440160
jne 0x44017c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440160
xor ecx, ecx
sub eax, 3
jb 0x440190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x440202
mov ebp, eax
add ebx, ebx
jne 0x44019b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4401a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4401cc
inc ecx
add ebx, ebx
jne 0x4401b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4401ad
jne 0x4401c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4401ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4401ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4401dd
jmp 0x44014e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4401ec
add edi, ecx
jmp 0x44014e
pop esi
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x440254
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4020c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x402b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x440209
mov ecx, edi
jns 0x440238
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x402bc]
or eax, eax
je 0x44024e
mov dword [ebx], eax
add ebx, 4
jmp 0x440226
call dword [esi + 0x402b8]
mov ebp, dword [esi + 0x402c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x440288
sub esp, 0xffffff80
jmp section.NDltoTPW
Function at 0x427ea0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48e0cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004822a5
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x427f22
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047fd3a
mov eax, dword [eax]
push 0x57e214
push eax
call fcn.00471fd4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00482530
test bl, bl
je 0x427f22
push 0x57e214
lea ecx, [esp + 0xc]
call fcn.004828c0
push 0x581d9c
lea ecx, [esp + 0xc]
call fcn.004828c0
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x427f5e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00482530
jmp 0x428029
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x427fe2
lea edx, [esp + 0x7c]
push 0x581d98
push edx
call fcn.00471fd4
add esp, 8
test eax, eax
je 0x427fe2
lea eax, [esp + 0x7c]
push 0x581d94
push eax
call fcn.00471fd4
add esp, 8
test eax, eax
je 0x427fe2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x427f72
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00482530
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x428820
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x428882
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x428890
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48e14b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5889c4]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4289c8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4288f6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00482530
xor eax, eax
jmp 0x428a3f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0048266d
push esi
lea ecx, [esp + 0xc]
call fcn.004828fc
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x428a1d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.00428820
test eax, eax
jne 0x428a1d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.00428820
test eax, eax
jne 0x428a1d
lea eax, [esp + 0x14]
push 0x581db0
push eax
call fcn.004730e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4289fc
lea ecx, [esp + 0x14]
push 0x581dac
push ecx
call fcn.00473060
mov esi, eax
add esp, 8
test esi, esi
jne 0x4289fc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4289ff
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0048261d
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x42890e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00482530
xor eax, eax
jmp 0x428a3f
mov byte [esi], 0
push 0x581da8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00482530
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x43a6d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x43a73e
cmp si, 0x69
ja 0x43a73e
add esi, 0xffd0
cmp si, 0x11
je 0x43a70e
push 0x11
call edi
test ax, ax
jge 0x43a70e
or esi, 0x2000
cmp si, 0x10
je 0x43a723
push 0x10
call edi
test ax, ax
jge 0x43a723
or esi, 0x4000
cmp si, 0x12
je 0x43a738
push 0x12
call edi
test ax, ax
jge 0x43a738
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x43a74b
mov esi, 0xbd
jmp 0x43a6ff
cmp si, 0x6e
jne 0x43a758
mov esi, 0xbe
jmp 0x43a6ff
cmp si, 0x6f
jne 0x43a6f9
mov esi, 0xbf
jmp 0x43a6ff

Function at 0x43bf90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5991d0]
xor edx, edx
cmp eax, edx
jne 0x43bfb6
xor eax, eax
mov byte [eax + 0x5990d0], al
inc eax
cmp eax, 0x100
jl 0x43bf9e
mov dword [0x5991d0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5990d0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x43c047
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x43c01a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x43bfe8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x43c0c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x43c113
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x43c0fa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret