joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004f741
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0x40
jae 0x1004f758
xor eax, eax
jmp 0x1004f86d
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x1004f77b
xor eax, eax
jmp 0x1004f86d
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0x3c]
add ecx, 0xf8
cmp dword [ebp + 0xc], ecx
jae 0x1004f796
xor eax, eax
jmp 0x1004f86d
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
cmp dword [ecx], 0x4550
je 0x1004f7bd
xor eax, eax
jmp 0x1004f86d
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x16]
and ecx, 0x2000
test ecx, ecx
jne 0x1004f7da
xor eax, eax
jmp 0x1004f86d
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x16]
and ecx, 2
test ecx, ecx
jne 0x1004f7f1
xor eax, eax
jmp 0x1004f86d
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x14]
cmp ecx, 0xe0
je 0x1004f809
xor eax, eax
jmp 0x1004f86d
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
add eax, 0xf8
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], eax
mov dword [ebp - 4], 0
jmp 0x1004f82c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
xor edx, edx
mov dx, word [ecx + 6]
cmp dword [ebp - 4], edx
jge 0x1004f868
mov eax, dword [ebp - 4]
imul eax, eax, 0x28
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x28
mov esi, dword [ebp - 8]
mov esi, dword [esi + 0x14]
mov edx, dword [edx + eax + 0x14]
add edx, dword [esi + ecx + 0x10]
cmp edx, dword [ebp + 0xc]
jbe 0x1004f866
xor eax, eax
jmp 0x1004f86d
jmp 0x1004f823
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0x4074ea
Capabilities:
Execute anti-debugging instructions
Print debug messages
Terminate process

Disassembly:
add esi, 0
neg ecx
mov dword [0x4100fd], esi
sub edi, 0
not ecx
mov dword [0x4100f9], edi
or ebx, 0
not ecx
mov dword [0x410109], ebx
pop eax
jmp fcn.00403719
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430004]
jne 0x40100a
repz ret
jmp fcn.00401587

Function at 0x40444b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x430004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00401e3b
and dword [ebp - 0x14], 0
cmp dword [0x4329e8], 0
mov dword [ebp - 0x18], eax
jne 0x4044fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4045a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4045a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4329e8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4329ec], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4329f0], eax
call edi
push eax
call esi
mov dword [0x4329f8], eax
test eax, eax
je 0x4044fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4329f4], eax
mov eax, dword [0x4329f4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404557
cmp dword [0x4329f8], ecx
je 0x404557
push eax
call esi
push dword [0x4329f8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404557
test ebx, ebx
je 0x404557
call edi
test eax, eax
je 0x40454e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40454e
test byte [ebp - 8], 1
jne 0x404557
or dword [ebp + 0x10], 0x200000
jmp 0x40458a
mov eax, dword [0x4329ec]
cmp eax, dword [ebp - 0x18]
je 0x40458a
push eax
call esi
test eax, eax
je 0x40458a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40458a
mov eax, dword [0x4329f0]
cmp eax, dword [ebp - 0x18]
je 0x40458a
push eax
call esi
test eax, eax
je 0x40458a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4329e8]
call esi
test eax, eax
je 0x4045a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4045a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x421004]
jne 0x40100a
repz ret
jmp fcn.00401243

Function at 0x40314b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x421004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040213e
and dword [ebp - 0x14], 0
cmp dword [0x4238ac], 0
mov dword [ebp - 0x18], eax
jne 0x4031fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4032a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4032a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4238ac], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4238b0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4238b4], eax
call edi
push eax
call esi
mov dword [0x4238bc], eax
test eax, eax
je 0x4031fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4238b8], eax
mov eax, dword [0x4238b8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403257
cmp dword [0x4238bc], ecx
je 0x403257
push eax
call esi
push dword [0x4238bc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403257
test ebx, ebx
je 0x403257
call edi
test eax, eax
je 0x40324e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40324e
test byte [ebp - 8], 1
jne 0x403257
or dword [ebp + 0x10], 0x200000
jmp 0x40328a
mov eax, dword [0x4238b0]
cmp eax, dword [ebp - 0x18]
je 0x40328a
push eax
call esi
test eax, eax
je 0x40328a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40328a
mov eax, dword [0x4238b4]
cmp eax, dword [ebp - 0x18]
je 0x40328a
push eax
call esi
test eax, eax
je 0x40328a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4238ac]
call esi
test eax, eax
je 0x4032a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4032a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x405670
Capabilities:
Allocate or change rwx memory
Create pipe
Execute shellcode via indirect call
Get common file path
Get file attributes
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44c
mov eax, dword [0x421004]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
xor ebx, ebx
xor esi, esi
cmp esi, 0x562d05
jne 0x4056a9
mov eax, dword [0x422934]
mov dword [0x45f694], eax
cmp dword [0x45f30c], 0x3c
jne 0x4056b5
push ebx
call edi
inc esi
cmp esi, 0x5f6c74
jl 0x405697
cmp dword [0x45f30c], 0x7c
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jne 0x40573f
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push str.Huhadidek
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [0x45f30c], 0x110a
jne 0x4057a7
push str.Buyezinanax_babotuxavofex_copujen
mov dword [0x45f300], ebx
mov dword [0x45f304], ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push str.wudomizegotog
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSize]
push ebx
call fcn.0040100f
add esp, 4
push ebx
call fcn.0040100f
add esp, 4
push ebx
call fcn.0040100f
add esp, 4
call fcn.00405410
xor ecx, ecx
cmp dword [0x45f30c], ebx
jbe 0x4057eb
jmp 0x4057c0
mov eax, dword [0x45f694]
mov dword [esp + 0x10], eax
mov eax, 0xa231
add dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov al, byte [edx + ecx]
mov edx, dword [0x45f030]
mov byte [edx + ecx], al
inc ecx
cmp ecx, dword [0x45f30c]
jb 0x4057c0
push str.msimg32.dll
call esi
mov ecx, dword [0x45f30c]
mov edx, dword [0x45f030]
lea eax, [esp + 0x14]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.004055e0
call fcn.00405430
mov edi, dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetAtomNameA]
xor esi, esi
lea eax, [esp + 0x28]
push eax
push 0
call edi
push 0
push 0
push 0
call ebx
cmp esi, 0x1a01e
jle 0x405848
cmp dword [esp + 0x30], 0xf5bed7
jne 0x405851
inc esi
cmp esi, 0x1ece7a52
jl 0x405825
mov edi, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
nop
cmp esi, 0x12e6c3
jne 0x40586d
call fcn.00405400
cmp dword [0x45f30c], 0x3dc
mov dword [0x45f034], 0x8e46a6f0
jne 0x4058a7
xor ecx, ecx
lea eax, [esp + 0x18]
push eax
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x24], ecx
call edi
push 0
push 0
push 0
push 0
push 0
push 0
push str.socuyaxokepajivinixu_jedubatilelokatuzaze_futalufa_kemabahayujozosigulon
call ebx
inc esi
cmp esi, 0x1519a5
jl 0x405860
mov ecx, dword [esp + 0x454]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x49bbe0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c000]
push edi
or ebp, 0xffffffff
jmp 0x49bc02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x49bc09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49bbf8
mov eax, 1
add ebx, ebx
jne 0x49bc1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49bc10
jne 0x49bc2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49bc10
xor ecx, ecx
sub eax, 3
jb 0x49bc40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49bcb2
mov ebp, eax
add ebx, ebx
jne 0x49bc4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x49bc58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x49bc7c
inc ecx
add ebx, ebx
jne 0x49bc68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49bc5d
jne 0x49bc79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49bc5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49bc9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49bc8d
jmp 0x49bbfe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49bc9c
add edi, ecx
jmp 0x49bbfe
pop esi
lea edi, [esi + 0x99000]
mov eax, dword [edi]
or eax, eax
je 0x49bcfb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9b000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9b03c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49bcb9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9b044]
or eax, eax
je 0x49bcf5
mov dword [ebx], eax
add ebx, 4
jmp 0x49bcd6
call dword [esi + 0x9b040]
mov ebp, dword [esi + 0x9b048]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49bd2f
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x401070
Capabilities:
Hide graphical window

Disassembly:
mov ebp, esp
push esi
mov eax, dword [ebp + 4]
mov dword [0x4040c3], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401082
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x4040c3]
mov dword [ebp - 0x48], eax
mov eax, 0x40214c
mov dword [ebp - 0x54], eax
mov ecx, str.uquamarine
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov dword [0x4041ac], 8
mov dword [0x4041b0], 0x4000
push 0x4041ac
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
xor ecx, ecx
push ecx
push dword [0x4040c3]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.kippohome
push eax
mov eax, str.uquamarine
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x404200], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x404200]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x401132
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x401124
mov esp, ebp
ret

Function at 0x401d2a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov ecx, 6
lea edx, [0x4032b6]
mov eax, 0
add eax, dword [edx]
add edx, 4
sub ecx, 1
jne 0x401d41
add eax, 5
add eax, 2
mov dword [0x4032fe], eax
push 0x100
push 0x403c48
push dword [0x403b18]
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 4]
push eax
push 0x4039e8
push 0x100
push 0x403c48
call sub.kernel32.dll_GetFullPathNameA
mov esi, dword [ebp - 4]
lodsb al, byte [esi]
test al, al
jne 0x401d90
mov al, 0x2e
mov byte [esi - 1], al
cmp al, 0x2e
jne 0x401d86
mov dword [esi], 0x696e69
push 0x4039e8
push 0x104
push 0x403c48
push str.Position
push str.Position
push str.Position
call sub.kernel32.dll_GetPrivateProfileStringA
cmp byte [0x403c48], 0x50
je 0x401e17
mov edi, 0x403aec
mov edx, 0x403c48
mov ecx, 0xb
call fcn.00401efe
stosd dword es:[edi], eax
loop 0x401dd5
push 0x403aec
push dword [0x403890]
call sub.user32.dll_SetWindowPlacement
push 0x403c24
push dword [0x403890]
call sub.user32.dll_GetClientRect
mov eax, dword [0x4032fe]
mov edx, 0xb0
cmp dword [0x403c2c], eax
jb 0x401e17
cmp dword [0x403c30], edx
jae 0x401e34
push 2
push 0xdc
push 0x190
push 0
push 0
push 0
push dword [0x403890]
call sub.user32.dll_SetWindowPos
clc
popal
mov esp, ebp
pop ebp
ret
Function at 0x405516
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4087d0]
jne 0x405520
repz ret
jmp fcn.00406683
Function at 0x40b8d0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4802cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00474e09
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40b952
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00472ce3
mov eax, dword [eax]
push 0x4b5ca8
push eax
call fcn.00465724
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00475094
test bl, bl
je 0x40b952
push 0x4b5ca8
lea ecx, [esp + 0xc]
call fcn.00475424
push 0x4b5cb4
lea ecx, [esp + 0xc]
call fcn.00475424
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40b98e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00475094
jmp 0x40ba59
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40ba12
lea edx, [esp + 0x7c]
push 0x4b5cb0
push edx
call fcn.00465724
add esp, 8
test eax, eax
je 0x40ba12
lea eax, [esp + 0x7c]
push 0x4b5cac
push eax
call fcn.00465724
add esp, 8
test eax, eax
je 0x40ba12
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b9a2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00475094
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40c260
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40c2c2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40c2d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48034b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4c12b0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40c408
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40c336
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00475094
xor eax, eax
jmp 0x40c47f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004751d1
push esi
lea ecx, [esp + 0xc]
call fcn.00475460
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40c45d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040c260
test eax, eax
jne 0x40c45d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040c260
test eax, eax
jne 0x40c45d
lea eax, [esp + 0x14]
push 0x4b5cc4
push eax
call fcn.004667a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c43c
lea ecx, [esp + 0x14]
push 0x4b5cc0
push ecx
call fcn.00466720
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c43c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40c43f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00475181
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40c34e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00475094
xor eax, eax
jmp 0x40c47f
mov byte [esi], 0
push 0x4b5cbc
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00475094
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41ccd0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41cd3e
cmp si, 0x69
ja 0x41cd3e
add esi, 0xffd0
cmp si, 0x11
je 0x41cd0e
push 0x11
call edi
test ax, ax
jge 0x41cd0e
or esi, 0x2000
cmp si, 0x10
je 0x41cd23
push 0x10
call edi
test ax, ax
jge 0x41cd23
or esi, 0x4000
cmp si, 0x12
je 0x41cd38
push 0x12
call edi
test ax, ax
jge 0x41cd38
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41cd4b
mov esi, 0xbd
jmp 0x41ccff
cmp si, 0x6e
jne 0x41cd58
mov esi, 0xbe
jmp 0x41ccff
cmp si, 0x6f
jne 0x41ccf9
mov esi, 0xbf
jmp 0x41ccff

Function at 0x41e5a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4d1a28]
xor edx, edx
cmp eax, edx
jne 0x41e5c6
xor eax, eax
mov byte [eax + 0x4d1928], al
inc eax
cmp eax, 0x100
jl 0x41e5ae
mov dword [0x4d1a28], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4d1928
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41e657
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41e62a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41e5f8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41e6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41e723
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41e70a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret