joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1d9e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a1dd6
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049fe43
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049fe1b
jmp 0x4a1de2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a3595
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a35d7
call fcn.004a9b94
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a35d7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a35ce
xor eax, eax
jmp 0x4a35df
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a35e5
pop edi
pop esi
pop ebx
ret 4

Function at 0x4aa0c4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4aa0f2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4aa110
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004aa02a
jmp 0x4aa110
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4aa110
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004aa02a
test edi, edi
mov eax, edi
jne 0x4aa0fa
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x42cbb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and byte [ecx + 0x30], 0
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x42cb98
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0042a9d4
inc edi
sub cl, byte [esi + 8]
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0042a9d4
mov dh, bl
in eax, 0xbe
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x42cbc1
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x42cbc1
call fcn.0042a9d4
mov edi, dword [ebp - 0x3a]
inc ebp
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0042a9d4
aam 0xd
loopne 0x42cb82
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
call fcn.0042b1d4
cmp al, 0x89
inc esi
cmp al, 0x8b
inc edi
inc eax
mov dword [esi + 0x40], eax
movzx eax, byte [edi + 0x44]
mov byte [esi + 0x44], al
movzx eax, byte [edi + 0x45]
mov byte [esi + 0x45], al
mov eax, esi
pop edi
pop esi
pop ebp
ret 4

Function at 0x42e2a0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb8
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push eax
mov dword [esp + 0x10], ebx
mov dword [esi], eax
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x42e305
cmp dword [0x494e44], 3
jg 0x42e2f7
push 3
push 0x23
push str.d:webapps_b_build_slave_repo_build_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x1c]
lea ebx, [eax + 2]
call fcn.00413f50
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.0040b370
add esp, 8
test bl, 2
je 0x42e305
lea ecx, [esp + 0x10]
call fcn.00414010
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42e310
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
mov eax, dword [ecx]
push ebx
xor ebx, ebx
push ebx
push dword [eax]
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x42e36f
cmp dword [0x494e44], 3
jg 0x42e361
push 3
push 0x23
push str.d:webapps_b_build_slave_repo_build_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x14]
lea ebx, [eax + 1]
call fcn.00413f50
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.0040b370
add esp, 8
test bl, 1
je 0x42e36f
lea ecx, [esp + 8]
call fcn.00414010
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43dc30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
mov esi, dword [ebx + 4]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp - 4], ecx
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp esi, eax
je 0x43dcb3
mov esi, dword [ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x43dcb3
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x43dca1
cmp esi, eax
jne 0x43dc93
jmp 0x43dcb6
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edx
push dword [eax]
call fcn.0043dd50
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x43dcf0
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 4]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x43dd0a
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x43dd2c
cmp eax, esi
jne 0x43dd12
mov dword [ecx], edi
jmp 0x43dd2c
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x43dd2c
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.004321a0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x441dc0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x492250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x492df8]
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x40c], ebx
push esi
push edi
cmp ebx, 0xffffffff
jne 0x441e60
mov edi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_TlsFree]
cmp eax, ebx
je 0x441e0d
mov ebx, eax
mov dword [ebp - 0x40c], ebx
jmp 0x441e3e
cmp byte [0x494ee8], 0
jne 0x441ed7
int3
mov ecx, ebx
mov edx, 0x492df8
or eax, 0xffffffff
lock cmpxchg dword [edx], ecx
cmp eax, 0xffffffff
je 0x441e60
push ebx
call esi
mov ebx, dword [0x492df8]
mov dword [ebp - 0x40c], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x441e75
cmp byte [0x494ee8], 0
jne 0x441ee5
int3
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.0045c050
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x400
call fcn.0045a324
add esp, 4
lea esi, [ebp - 0x408]
mov ebx, eax
mov ecx, 0x100
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a313
mov esp, ebp
pop ebp
ret
push 1
call fcn.0046515c
push 1
call fcn.0046515c
push 1
call fcn.0046515c
int3

Function at 0x441ef0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x492250]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x492df8]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], 0
push edi
mov ecx, 0x100
mov dword [esp + 0xc], eax
mov esi, ebx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.0045a32d
add esp, 4
mov edi, 0x100
nop word [eax + eax]
mov esi, dword [0x495f04]
xor dl, dl
test esi, esi
jle 0x441f88
nop dword [eax]
mov ecx, dword [esp + esi*4 + 0x10]
test ecx, ecx
je 0x441f83
mov eax, dword [esi*4 + 0x495800]
test eax, eax
je 0x441f83
push ecx
mov dword [esp + esi*4 + 0x14], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x441f60
dec edi
test edi, edi
jle 0x441f91
test dl, dl
jne 0x441f50
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045a313
mov esp, ebp
pop ebp
ret
Function at 0x4454b0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x168], 0
mov dword [ecx + 0x170], 0
mov dword [ecx + 0x174], 0
mov dword [ecx + 0x14], 0x67452301
mov dword [ecx + 0x18], 0xefcdab89
mov dword [ecx + 0x1c], 0x98badcfe
mov dword [ecx + 0x20], 0x10325476
mov dword [ecx + 0x24], 0xc3d2e1f0
ret
Function at 0x454637
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 4], 0
push ebx
push 0x38
call fcn.0045a053
pop ecx
test eax, eax
je 0x454659
mov ecx, eax
call 0x42c950
mov ebx, eax
jmp 0x45465b
xor ebx, ebx
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.0041e350
test al, al
je 0x4546bb
push edi
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x24]
mov eax, 0x1000
test edx, edx
cmove edx, eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x28]
dec eax
push edx
add eax, ecx
push eax
push ecx
call fcn.004546c5
add esp, 0xc
pop edi
test eax, eax
jne 0x4546bb
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
and dword [esi], eax
call fcn.00445000
mov eax, esi
pop esi
jmp 0x4546c0
mov eax, dword [ebp + 8]
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4548c3
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x492250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
pop edi
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x45494c
push edi
call fcn.00413e90
pop ecx
test al, al
je 0x454938
push edi
push 0x2c
push str.d:webapps_b_build_slave_repo_build_srcwow_basewinwow_priviledge_utils.cc
lea ecx, [ebp - 0xc4]
inc ebx
call fcn.00413f50
add eax, 8
push str.AllocateAndInitializeSid_failed.
push eax
call fcn.0040b370
pop ecx
pop ecx
test bl, 1
je 0x454948
lea ecx, [ebp - 0xc4]
call fcn.00414010
xor al, al
jmp 0x4549a9
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
test esi, esi
pop esi
jne 0x4549a3
push edi
call fcn.00413e90
pop ecx
test al, al
je 0x45499e
push edi
push 0x34
push str.d:webapps_b_build_slave_repo_build_srcwow_basewinwow_priviledge_utils.cc
lea ecx, [ebp - 0xc4]
mov ebx, edi
call fcn.00413f50
add eax, 8
push str.CheckTokenMembership_failed.
push eax
call fcn.0040b370
pop ecx
pop ecx
test bl, 2
jmp 0x45493b
cmp dword [ebp - 0x10], ebx
setne al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0045a313
mov esp, ebp
pop ebp
ret
Function at 0x401f8b
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.00406f46
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00406f46
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
jne 0x402021
mov dword [ebp - 0x18], esp
mov eax, 4
call fcn.00406f58
cmp dword [ebp - 0x18], esp
je 0x40201e
push 6
call fcn.00406f52
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 5
call fcn.00406f58
cmp dword [ebp - 0x18], esp
je 0x40204d
push 6
call fcn.00406f52
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 6
call fcn.00406f58
cmp dword [ebp - 0x18], esp
je 0x40207b
push 6
call fcn.00406f52
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push str.SeDebugPrivilege
push 0
mov eax, 7
call fcn.00406f58
cmp dword [ebp - 0x18], esp
je 0x4020a7
push 6
call fcn.00406f52
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 8
call fcn.00406f58
cmp dword [ebp - 0x18], esp
je 0x402136
push 6
call fcn.00406f52
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 2
call fcn.00406f58
cmp dword [ebp - 0x18], esp
je 0x40215b
push 6
call fcn.00406f52
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x402163
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00406f4c
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00406f4c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40e300
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47647b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046aef4
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40e382
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00468c4d
mov eax, dword [eax]
push 0x54e230
push eax
call fcn.0045b874
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046b17f
test bl, bl
je 0x40e382
push 0x54e230
lea ecx, [esp + 0xc]
call fcn.0046b50f
push 0x551d9c
lea ecx, [esp + 0xc]
call fcn.0046b50f
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40e3be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046b17f
jmp 0x40e489
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40e442
lea edx, [esp + 0x7c]
push 0x551d98
push edx
call fcn.0045b874
add esp, 8
test eax, eax
je 0x40e442
lea eax, [esp + 0x7c]
push 0x551d94
push eax
call fcn.0045b874
add esp, 8
test eax, eax
je 0x40e442
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e3d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046b17f
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40ec80
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40ece2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40ecf0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4764fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x55e600]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40ee28
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40ed56
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046b17f
xor eax, eax
jmp 0x40ee9f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046b2bc
push esi
lea ecx, [esp + 0xc]
call fcn.0046b54b
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x551dd4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40ee7d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.0040ec80
test eax, eax
jne 0x40ee7d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.0040ec80
test eax, eax
jne 0x40ee7d
lea eax, [esp + 0x14]
push 0x551db0
push eax
call fcn.0045c8b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40ee5c
lea ecx, [esp + 0x14]
push 0x551dac
push ecx
call fcn.0045c830
mov esi, eax
add esp, 8
test esi, esi
jne 0x40ee5c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40ee5f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046b26c
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40ed6e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046b17f
xor eax, eax
jmp 0x40ee9f
mov byte [esi], 0
push 0x551da8
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046b17f
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41f8b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41f91e
cmp si, 0x69
ja 0x41f91e
add esi, 0xffd0
cmp si, 0x11
je 0x41f8ee
push 0x11
call edi
test ax, ax
jge 0x41f8ee
or esi, 0x2000
cmp si, 0x10
je 0x41f903
push 0x10
call edi
test ax, ax
jge 0x41f903
or esi, 0x4000
cmp si, 0x12
je 0x41f918
push 0x12
call edi
test ax, ax
jge 0x41f918
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41f92b
mov esi, 0xbd
jmp 0x41f8df
cmp si, 0x6e
jne 0x41f938
mov esi, 0xbe
jmp 0x41f8df
cmp si, 0x6f
jne 0x41f8d9
mov esi, 0xbf
jmp 0x41f8df

Function at 0x4210a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x56ecf0]
xor edx, edx
cmp eax, edx
jne 0x4210c6
xor eax, eax
mov byte [eax + 0x56ebf0], al
inc eax
cmp eax, 0x100
jl 0x4210ae
mov dword [0x56ecf0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x56ebf0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x421157
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x42112a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4210f8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4211d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x421223
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x42120a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret