joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ec70
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x432cd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x408
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x418], ebx
mov eax, dword [esp + 0x420]
mov dword [esp + 0xc], 0x400
xor esi, esi
cmp dword [eax - 8], ebx
je 0x40ecc7
lea ecx, [esp + 8]
push ecx
push 0xf003f
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x40ed0a
lea ecx, [esp + 0x420]
mov byte [esp + 0x418], bl
call fcn.00425dde
lea ecx, [esp + 0x424]
mov dword [esp + 0x418], 0xffffffff
call fcn.00425dde
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x408]
mov dword fs:[0], ecx
add esp, 0x414
ret
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push ebx
push ebx
push 0x442da0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x40ed48
mov eax, dword [esp + 0x424]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.004148a9
add esp, 8
test eax, eax
jne 0x40ed48
mov esi, 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x420]
mov byte [esp + 0x418], bl
call fcn.00425dde
lea ecx, [esp + 0x424]
mov dword [esp + 0x418], 0xffffffff
call fcn.00425dde
mov ecx, dword [esp + 0x410]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x414
ret

Function at 0x40eda0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x432cf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], ebx
xor esi, esi
cmp dword [eax - 8], ebx
je 0x40edf6
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push edx
push ebx
push 0xf003f
push ebx
push 0x442da0
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
je 0x40ee27
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.00425dde
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00425dde
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov eax, dword [esp + 0x28]
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x10]
push 1
push ebx
push 0x442da0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x10], eax
je 0x40ee53
mov esi, 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.00425dde
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00425dde
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40f2a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x244
push esi
mov esi, dword [esp + 0x24c]
test esi, esi
je 0x40f340
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40f2f8
lea ecx, [esp + 8]
push esi
push ecx
lea edx, [esp + 0x10]
push 0x43e580
push edx
call fcn.00412f35
add esp, 0x10
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x110]
mov dword [esp + 0x10c], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10c]
lea ecx, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
pop edi
je 0x40f340
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
pop esi
add esp, 0x244
ret
xor eax, eax
pop esi
add esp, 0x244
ret
Function at 0x410030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x432e07
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov dword [esp + 0x1c], 0
mov eax, dword [0x43ee7c]
mov dword [esp + 0x28], 1
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 3
call fcn.0042620e
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call fcn.0042625d
lea ecx, [esp + 4]
call fcn.0042635a
push 0x43e960
lea ecx, [esp + 8]
call fcn.00424807
cmp eax, 0xffffffff
je 0x410247
mov eax, dword [esp + 4]
push ebx
push 0x43e960
lea ecx, [esp + 0xc]
mov esi, dword [eax - 8]
call fcn.00424807
sub esi, eax
lea ecx, [esp + 0x10]
sub esi, 2
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.0042469b
mov bl, 4
push 0x43e95c
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call fcn.00424807
lea edx, [esp + 0x18]
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00424717
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 5
call fcn.00425f17
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.00425dde
push 0x43e95c
lea ecx, [esp + 0x3c]
call fcn.00424807
cmp eax, 0xffffffff
jne 0x410181
lea eax, [esp + 0x38]
push 0x43e960
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00426073
lea edx, [esp + 0x10]
mov byte [esp + 0x2c], 6
push edx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0042600d
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 7
call fcn.00425f17
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 6
call fcn.00425dde
mov byte [esp + 0x2c], bl
lea ecx, [esp + 0x14]
jmp 0x410231
push 0x43e95c
lea ecx, [esp + 0x3c]
call fcn.00424807
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x40]
call fcn.00424717
mov edx, dword [esp + 0x38]
push 0x43e95c
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 8
mov esi, dword [edx - 8]
call fcn.00424807
sub esi, eax
lea eax, [esp + 0x14]
push esi
push eax
lea ecx, [esp + 0x40]
call fcn.0042469b
lea ecx, [esp + 0x18]
push 0x43e960
lea edx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x38], 9
call fcn.00426073
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 0xa
call fcn.00425f17
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 9
call fcn.00425dde
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
call fcn.004261f6
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x10]
call fcn.004261f6
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 8
call fcn.00425dde
mov byte [esp + 0x2c], bl
lea ecx, [esp + 0x18]
call fcn.00425dde
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
call fcn.00425dde
pop ebx
jmp 0x410255
lea edx, [esp + 0x34]
lea ecx, [esp + 8]
push edx
call fcn.00425f17
mov esi, dword [esp + 0x30]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.00425b53
mov dword [esp + 0x1c], 1
lea ecx, [esp + 8]
mov byte [esp + 0x28], 2
call fcn.00425dde
lea ecx, [esp + 4]
mov byte [esp + 0x28], 1
call fcn.00425dde
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 0
call fcn.00425dde
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4102b0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x124
push edi
lea ecx, [esp + 0x10]
lea eax, [esp + 0x10]
push 1
push ecx
mov dword [esp + 0xc], 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov edx, dword [esp + 8]
push 0
push 0
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x43e9d8
push 0x154b8
push 0
lea eax, [esp + 0x10]
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [0x4700d8], eax
jne 0x410351
mov ecx, 0x40
lea edi, [esp + 0x25]
mov byte [esp + 0x24], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x28]
push str.VRVSAFEC:_CreateFileMapping_Fail_On_Vista_err_d_n
push ecx
call fcn.00412f35
add esp, 0xc
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop edi
add esp, 0x124
ret
push 0
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [0x4700dc], eax
jne 0x410397
push str.VRVSAFEC:_MapViewOfFile_Fail__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x4700d8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4700d8], 0
xor eax, eax
pop edi
add esp, 0x124
ret
push esi
mov ecx, 0x63b
mov esi, 0x45a568
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x4700dc]
push 0x43e964
mov ecx, 0x4ef3
mov esi, 0x45be58
lea edi, [edx + 0x18ec]
push 0
lea eax, [esp + 0x10]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4700e0], eax
pop esi
mov eax, 1
pop edi
add esp, 0x124
ret

Function at 0x4105d0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
xor ebp, ebp
push ebp
push ebp
push 3
push ebp
push ebp
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4105f6
pop ebp
xor eax, eax
pop ebx
ret
push esi
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [esp + 0x14], ebp
cmp edi, ebp
je 0x410661
push edi
call fcn.00425b19
mov esi, eax
add esp, 4
cmp esi, ebp
je 0x410661
lea ecx, [esp + 0x14]
push ebp
push ecx
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410658
xor eax, eax
test edi, edi
jbe 0x410640
mov cl, byte [eax + esi]
xor cl, 0xcb
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x410632
mov edx, dword [esp + 0x18]
push edi
push esi
push edx
call fcn.00410670
add esp, 0xc
test eax, eax
je 0x410658
mov ebp, 1
push esi
call fcn.00425b42
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x410670
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov eax, dword [esp + 0xc]
push edi
xor edi, edi
push edi
push edi
push 4
push edi
push edi
push 0x40000000
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41069c
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 8]
push edi
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4106bc
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x4109b0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x410
mov eax, dword [esp + 0x418]
push ebp
push esi
xor esi, esi
mov ebp, 0x200
test eax, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], ebp
je 0x410a87
mov ecx, dword [esp + 0x41c]
test ecx, ecx
je 0x410a87
lea edx, [esp + 8]
push edx
push 0xf003f
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410a87
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push edi
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esp + 0x220]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x220]
push eax
push ecx
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push 0
lea ecx, [esp + 0x30]
push eax
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x410a6c
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x410a6c
inc esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
jmp 0x410a08
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0x410
ret
pop esi
xor eax, eax
pop ebp
add esp, 0x410
ret
Function at 0x410aa0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x220]
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 0x200
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x410b5c
mov eax, dword [0x443dac]
mov edi, dword [eax]
cmp edi, eax
je 0x410b46
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x410b0e
mov eax, 0x434690
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.004148a9
add esp, 8
test eax, eax
jne 0x410b3b
lea edx, [esp + 0x20]
push edx
push esi
call fcn.004109b0
add esp, 8
lea eax, [esp + 0x20]
push eax
push esi
call ebp
mov ebx, 1
mov edi, dword [edi]
mov eax, dword [0x443dac]
cmp edi, eax
jne 0x410b02
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], 0x200
inc eax
mov dword [esp + 0x10], eax
jmp 0x410ac5
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x210
ret
Function at 0x411c10
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebp
push 0x1c
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x34]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x411cae
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x411cae
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
cmp ecx, ebp
jbe 0x411cae
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x411c85
mov edx, esi
cmp edi, ebx
jb 0x411c8f
add edx, ebx
cmp edi, edx
jbe 0x411c9f
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x411c77
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x411cc0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 0x404
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x414]
lea edx, [esp + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x418]
mov dword [esp + 8], 0
push eax
push ecx
push edx
call fcn.00414c7a
add esp, 0xc
mov esi, eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x410]
lea ecx, [esp + 8]
push 0
push ecx
lea edx, [esp + 0x14]
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
pop edi
pop esi
add esp, 0x404
ret

Function at 0x4145e3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x414603
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00413ea9
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x414626
test byte [esp + 8], 2
je 0x414626
call fcn.00413f1c
mov dword [eax], 0xd
call fcn.00413f25
mov dword [eax], 5
jmp 0x4145ff
xor eax, eax
ret

Function at 0x428601
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x428639
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00426285
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0042625d
jmp 0x428645
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4a4da0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5724bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00563bf5
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4a4e22
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00560b51
mov eax, dword [eax]
push 0x7302c8
push eax
call fcn.0053f964
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00563e80
test bl, bl
je 0x4a4e22
push 0x7302c8
lea ecx, [esp + 0xc]
call fcn.0056425c
push 0x733e54
lea ecx, [esp + 0xc]
call fcn.0056425c
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4a4e5e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00563e80
jmp 0x4a4f29
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4a4ee2
lea edx, [esp + 0x7c]
push 0x733e50
push edx
call fcn.0053f964
add esp, 8
test eax, eax
je 0x4a4ee2
lea eax, [esp + 0x7c]
push 0x733e4c
push eax
call fcn.0053f964
add esp, 8
test eax, eax
je 0x4a4ee2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4a4e72
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00563e80
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4a5740
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4a57a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4a57b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x57253b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x748d0c]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4a58e8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4a5816
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00563e80
xor eax, eax
jmp 0x4a595f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00564009
push esi
lea ecx, [esp + 0xc]
call fcn.00564298
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x733e8c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4a593d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push connect
call fcn.004a5740
test eax, eax
jne 0x4a593d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push connect
mov ecx, edi
call fcn.004a5740
test eax, eax
jne 0x4a593d
lea eax, [esp + 0x14]
push 0x733e68
push eax
call fcn.00540b50
mov esi, eax
add esp, 8
test esi, esi
jne 0x4a591c
lea ecx, [esp + 0x14]
push 0x733e64
push ecx
call fcn.00540ad0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4a591c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4a591f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00563fb9
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4a582e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00563e80
xor eax, eax
jmp 0x4a595f
mov byte [esi], 0
push 0x733e60
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00563e80
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x4be540
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x4be5ae
cmp si, 0x69
ja 0x4be5ae
add esi, 0xffd0
cmp si, 0x11
je 0x4be57e
push 0x11
call edi
test ax, ax
jge 0x4be57e
or esi, 0x2000
cmp si, 0x10
je 0x4be593
push 0x10
call edi
test ax, ax
jge 0x4be593
or esi, 0x4000
cmp si, 0x12
je 0x4be5a8
push 0x12
call edi
test ax, ax
jge 0x4be5a8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x4be5bb
mov esi, 0xbd
jmp 0x4be56f
cmp si, 0x6e
jne 0x4be5c8
mov esi, 0xbe
jmp 0x4be56f
cmp si, 0x6f
jne 0x4be569
mov esi, 0xbf
jmp 0x4be56f

Function at 0x4bfe00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x75ac78]
xor edx, edx
cmp eax, edx
jne 0x4bfe26
xor eax, eax
mov byte [eax + 0x75ab78], al
inc eax
cmp eax, 0x100
jl 0x4bfe0e
mov dword [0x75ac78], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x75ab78
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4bfeb7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4bfe8a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4bfe58
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4bff30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4bff83
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4bff6a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret