joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408910
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x40891f
add esp, 0xfffffff0
call fcn.00402ab0
mov ebx, edx
mov edi, eax
mov esi, 0x675254
push 0x408a10
call sub.kernel32.dll_LoadLibraryW
mov dword [esi], eax
cmp dword [esi], 0
je 0x4089f4
push 0x408a28
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x675220], eax
push 0x408a38
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x675224], eax
push 0x408a48
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x675228], eax
push 0x408a5c
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x67522c], eax
push 0x408a6c
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x675230], eax
push 0x408a8c
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x675234], eax
push 0x408a9c
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x675238], eax
push 0x408ac4
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x67523c], eax
push 0x408ad4
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x675240], eax
push 0x408af0
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x675244], eax
inc byte [edi + 0x24]
mov eax, edi
call fcn.00408da0
test bl, bl
je 0x408a09
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x41383c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
cmp dword [0x675270], 0xca
jne 0x413858
call fcn.004137a8
mov dword [0x675270], 0xcb
mov eax, dword [0x675270]
cmp eax, 0xcb
jne 0x413888
mov eax, dword [0x6753bc]
cmp byte [eax + 0xc], 0
je 0x41387c
mov ebx, dword [0x6753bc]
call dword [ebx]
cmp eax, 2
jne 0x41386f
mov eax, dword [0x6752b0]
mov dword [0x6752b8], eax
jmp 0x413894
cmp eax, 0xcc
je 0x413894
call fcn.0065a09c
call fcn.004137c8
pop ebx
ret

Function at 0x413fd4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, 0x1c
call fcn.0065c4dc
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
pop esi
pop ebx
ret
Function at 0x4674b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x467652
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00431054
mov dx, word [edi + 4]
call fcn.00430a28
and byte [esi + 0x30], 0xfe
mov eax, dword [edi + 8]
call fcn.0063d178
mov byte [ebp - 5], al
mov al, byte [0x467660]
and al, byte [ebp - 5]
mov dl, byte [0x467664]
cmp dl, al
sete byte [ebp - 6]
push 0x90
call sub.user32.dll_GetKeyState
mov ebx, eax
and bl, 1
cmp byte [ebp - 6], 0
je 0x46754c
test bl, bl
jne 0x46753b
mov ax, word [edi + 4]
sub ax, 0xc
je 0x467550
add eax, 0xffffffeb
sub ax, 8
jb 0x467550
sub ax, 4
je 0x467550
test bl, bl
je 0x46754c
mov ax, word [edi + 4]
add eax, 0xffffffa0
sub ax, 0xa
jb 0x467550
xor eax, eax
jmp 0x467552
mov al, 1
mov byte [esi + 0x31], al
cmp word [edi + 4], 0x58
jne 0x4675c3
mov byte [esi + 0x32], 0
call fcn.0053c3b8
test eax, eax
setne al
and al, byte [ebp - 6]
je 0x46763c
xor eax, eax
mov dword [ebp - 4], eax
mov al, byte [0x467664]
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x58
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00467714
test eax, eax
jge 0x4675b1
or byte [esi + 0x30], 1
call fcn.004660ac
mov edx, 0x467670
call fcn.00465a60
mov dword [edi + 0xc], 1
jmp 0x46763c
mov cl, byte [edi + 4]
mov dl, byte [ebp - 5]
mov eax, esi
call fcn.00466efc
mov dword [edi + 0xc], eax
jmp 0x46763c
call fcn.0053c3b8
test eax, eax
setne al
and al, byte [ebp - 6]
je 0x46761b
test bl, bl
je 0x46761b
mov ax, word [edi + 4]
add eax, 0xffffffa0
sub ax, 0xa
jae 0x46761b
cmp byte [esi + 0x32], 0
jne 0x4675f1
lea eax, [esi + 0x34]
call fcn.00403274
mov byte [esi + 0x32], 1
lea eax, [ebp - 0xc]
mov dx, word [edi + 4]
sub dl, 0x60
add dl, 0x30
call fcn.00403418
mov edx, dword [ebp - 0xc]
lea eax, [esi + 0x34]
call fcn.00403524
mov dword [edi + 0xc], 1
jmp 0x46763c
mov byte [esi + 0x32], 0
mov ax, word [edi + 4]
add eax, 0xfffffff0
sub ax, 3
jb 0x46763c
mov cl, byte [edi + 4]
mov dl, byte [ebp - 5]
mov eax, esi
call fcn.00466efc
mov dword [edi + 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467659
lea eax, [ebp - 0xc]
call fcn.00403274
ret

Function at 0x4676a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov bx, word [edi + 4]
call fcn.00431054
mov edx, ebx
call fcn.00430a28
test byte [esi + 0x30], 1
jne 0x46770e
cmp bx, 0x61
jb 0x4676f8
mov eax, dword [0x671d00]
mov eax, dword [eax]
call fcn.00629790
mov eax, dword [0x671d00]
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
mov edx, dword [0x671d00]
mov edx, dword [edx]
mov edx, dword [edx + 0x1c]
mov eax, dword [edx + eax*4]
push eax
push ebx
call sub.user32.dll_VkKeyScanExW
mov ebx, eax
mov eax, dword [edi + 8]
call fcn.0063d178
mov edx, eax
mov ecx, ebx
mov eax, esi
call fcn.00466efc
mov dword [edi + 0xc], eax
pop edi
pop esi
pop ebx
ret
Function at 0x513e64
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c4], ecx
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.00403e28
xor eax, eax
push ebp
push 0x513fae
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 4]
call fcn.00657cc8
mov edx, dword [ebp - 0x2c0]
lea eax, [ebp - 4]
call fcn.004038bc
mov edx, dword [ebp - 4]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x513f6e
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 4]
call fcn.00658934
mov edx, dword [ebp - 0x2c0]
lea eax, [ebp - 0x2c4]
call fcn.004034e4
mov eax, dword [ebp - 0x2c4]
lea edx, [ebp - 8]
call fcn.00657c90
mov eax, dword [ebp - 8]
mov edx, 0x513fc8
call fcn.0040362c
je 0x513f35
mov eax, dword [esi + 4]
mov edi, dword [eax + 0x24]
dec edi
cmp edi, 0
jl 0x513f35
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + edi*4]
mov edx, dword [ebp - 8]
call fcn.006587f4
test al, al
je 0x513f2f
mov ebx, edi
jmp 0x513f35
dec edi
cmp edi, 0xffffffff
jne 0x513f16
cmp ebx, 0xffffffff
jne 0x513f6e
push 0x101
push 0x2b4
lea eax, [ebp - 0x2bc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetFileInfoW
mov ecx, dword [ebp - 0x2bc]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 4]
call fcn.00652c78
mov eax, dword [esi + 4]
mov ebx, dword [eax + 0x24]
dec ebx
mov edx, ebx
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513fb5
lea eax, [ebp - 0x2c4]
call fcn.00403274
lea eax, [ebp - 0x2c0]
call fcn.00403880
lea eax, [ebp - 8]
call fcn.00403274
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x522cc4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x522ccc
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov edi, 0x675fd8
xor eax, eax
push ebp
push 0x522efc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp byte [0x675ff8], 0
jne 0x522ecc
inc byte [0x675ff8]
jmp 0x522eb6
mov eax, dword [0x675fcc]
mov eax, dword [eax + 0x1c]
mov edx, dword [edi]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0xc], eax
inc dword [edi]
lea edx, [ebp - 0xc]
mov al, 6
call fcn.00470320
test bl, bl
jne 0x522d5b
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0062d6d0
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov eax, dword [0x672be8]
mov eax, dword [eax]
call fcn.0065918c
mov eax, dword [ebp - 0x18]
mov cl, 0x28
mov dl, 3
call fcn.00623608
cmp ax, 6
jne 0x522eb6
mov eax, dword [ebp - 0xc]
call fcn.00522bf8
mov esi, eax
lea edx, [ebp - 8]
xor eax, eax
call fcn.006202a0
call fcn.005093e8
call fcn.00506928
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0062d6d0
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov eax, dword [0x672808]
mov eax, dword [eax]
call fcn.0065918c
mov eax, dword [ebp - 0x18]
push eax
call fcn.005093e8
xor edx, edx
pop ecx
call fcn.0050687c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x672c9c]
mov eax, dword [eax]
push eax
mov al, byte [0x522f10]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [esi*4 + 0x66c544]
mov eax, 0x522f14
call fcn.0065918c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x20]
call fcn.00403a34
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x522f30
call fcn.00658380
mov edx, dword [ebp - 0x24]
xor eax, eax
pop ecx
call fcn.00438acc
mov byte [ebp - 0x11], al
call fcn.005093e8
xor edx, edx
call fcn.005068d4
call fcn.005093e8
call fcn.00506978
cmp byte [ebp - 0x11], 0
je 0x522eb2
mov ecx, 1
mov edx, 0x80000000
mov eax, dword [ebp - 8]
call fcn.0065c53c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x522ea3
lea edx, [ebp - 0x20]
mov al, 5
call fcn.00624c88
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4377d4]
call fcn.00438200
mov edi, eax
mov ebx, dword [edi + 0x24]
dec ebx
cmp ebx, 0
jl 0x522e7c
mov eax, dword [edi + 0x20]
lea esi, [eax + ebx*4]
mov eax, dword [esi]
call fcn.006584d0
test al, al
jne 0x522e76
xor ecx, ecx
mov edx, dword [esi]
mov eax, edi
call fcn.004384b0
dec ebx
cmp ebx, 0xffffffff
jne 0x522e5a
mov eax, edi
call fcn.004028c0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.00532af4
mov eax, dword [eax + 8]
call fcn.00652324
call fcn.00532af4
call fcn.0052c168
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
mov byte [ebp - 1], 1
jmp 0x522ec6
test bl, bl
jne 0x522ec6
mov eax, dword [0x675fcc]
mov eax, dword [eax + 0x18]
cmp eax, dword [edi]
jg 0x522d08
dec byte [0x675ff8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522f03
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403298
lea eax, [ebp - 8]
call fcn.00403880
ret
Function at 0x6230e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 7], cx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x623318
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x6767ec], 0
je 0x623125
mov word [ebp - 0xa], 2
jmp 0x6232fd
call fcn.0048e078
test eax, eax
je 0x623174
mov eax, dword [0x6729f8]
cmp dword [eax], 0
je 0x623174
mov eax, dword [0x671910]
mov ax, word [eax + 0xa9]
mov word [ebp - 0xc], ax
call fcn.00532af4
and byte [eax + 0x14], 0xfb
test byte [ebp - 0xc], 0x80
je 0x623160
call fcn.00532af4
or byte [eax + 0x14], 4
mov eax, dword [0x671910]
and word [eax + 0xa9], 0xff7f
mov byte [ebp - 0xe], 1
jmp 0x623178
mov byte [ebp - 0xe], 0
mov ebx, dword [0x672ddc]
mov bl, byte [ebx + 0x10]
cmp bl, 0xff
je 0x62319a
mov eax, dword [0x672ddc]
mov eax, ebx
call fcn.00631cfc
test al, al
jne 0x62319a
xor eax, eax
jmp 0x62319c
mov al, 1
mov ebx, eax
mov eax, dword [0x671ae4]
mov eax, dword [eax]
mov al, byte [eax + 0x16d]
xor al, 1
test al, bl
je 0x6231bd
mov eax, dword [0x671ae4]
mov eax, dword [eax]
call fcn.00640888
mov eax, dword [0x671ae4]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
push eax
call sub.user32.dll_IsWindowVisible
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0xd], al
test bl, bl
je 0x6231f3
mov al, byte [ebp - 5]
sub al, 4
jae 0x6231f3
xor eax, eax
mov al, byte [ebp - 5]
add eax, 0x3e8
call fcn.004accd0
mov word [ebp - 0xa], 2
mov eax, dword [0x671ae4]
mov eax, dword [eax]
cmp byte [eax + 0x16d], 0
je 0x62321e
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00403438
mov eax, dword [ebp - 0x14]
call fcn.0065a024
jmp 0x623297
xor eax, eax
push ebp
push 0x62327a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00403438
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0061fbf4
mov edx, dword [ebp - 0x14]
mov eax, dword [0x672ddc]
call fcn.004032c8
mov eax, dword [0x672ddc]
mov dl, byte [ebp - 5]
mov byte [eax + 4], dl
mov eax, dword [0x672ddc]
mov dx, word [ebp - 7]
mov word [eax + 5], dx
call fcn.006316a4
mov word [ebp - 0xa], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x623297
cmp byte [ebp - 0xd], 0
jne 0x6232b2
push 0
mov eax, dword [0x671ae4]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 0xe], 0
je 0x6232d1
mov eax, dword [0x671910]
mov dx, word [ebp - 0xc]
mov word [eax + 0xa9], dx
call fcn.00532af4
and byte [eax + 0x14], 0xfb
call fcn.005093e8
test eax, eax
je 0x6232fd
call fcn.00509530
call fcn.0053c3b8
test eax, eax
je 0x6232fd
call fcn.0053c3b8
cmp byte [eax + 0x464], 0
je 0x6232fd
mov byte [eax + 0x46a], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62331f
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00403298
ret

Function at 0x624a8c
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push eax
push 0x624aa0
push 0
call sub.shell32.dll_ShellExecuteW
ret
Function at 0x624aac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x624bb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.006584d0
test al, al
je 0x624b8c
mov eax, dword [0x671f34]
cmp byte [eax], 0
je 0x624b29
mov eax, dword [0x671ca0]
cmp dword [eax], 0
jne 0x624b02
push 0x624bc0
push 0x624bd4
call sub.kernel32.dll_LoadLibraryW
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [0x671ca0]
mov dword [edx], eax
mov eax, dword [0x671a1c]
cmp dword [eax], 0
jne 0x624b29
push 0x624bec
push 0x624bd4
call sub.kernel32.dll_LoadLibraryW
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [0x671a1c]
mov dword [edx], eax
mov eax, dword [0x671ca0]
cmp dword [eax], 0
je 0x624b65
mov eax, dword [0x671a1c]
cmp dword [eax], 0
je 0x624b65
push ebx
mov eax, dword [0x671ca0]
mov eax, dword [eax]
call eax
mov ebx, eax
test ebx, ebx
je 0x624b9e
push 0
push 0
push 0
push ebx
mov eax, dword [0x671a1c]
mov eax, dword [eax]
call eax
push ebx
call sub.ole32.dll_CoTaskMemFree
jmp 0x624b9e
push 5
push 0
lea ecx, [ebp - 4]
mov eax, 0x624c08
mov edx, ebx
call fcn.006591e4
mov eax, dword [ebp - 4]
push eax
push 0x624c18
push 0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x624b9e
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0065885c
mov eax, dword [ebp - 4]
call fcn.00624a8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x624bbb
lea eax, [ebp - 4]
call fcn.00403880
ret

Function at 0x624f1c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x624f99
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x624f7e
mov eax, ebx
call fcn.00624e94
test al, al
jne 0x624f7e
lea edx, [ebp - 8]
mov eax, ebx
call fcn.006250a0
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0065885c
mov eax, dword [ebp - 4]
call fcn.00403ab8
mov esi, eax
mov eax, ebx
call fcn.00403ab8
cmp esi, eax
jge 0x624f76
mov eax, dword [ebp - 4]
call fcn.00624f1c
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x624fa0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x625164
Capabilities:
Get disk size

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
call fcn.0061f2ac
mov eax, ebx
call fcn.0065c550
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0
call sub.kernel32.dll_GetDiskFreeSpaceW
call fcn.0061f308
mov eax, dword [esp]
imul dword [esp + 4]
add esp, 0x10
pop ebx
ret
Function at 0x6254c4
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403e48
xor eax, eax
push ebp
push 0x6255b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00625074
lea eax, [ebp - 0x270]
mov ecx, 0x6255c8
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x3f
call fcn.006585c8
test eax, eax
jne 0x625575
test byte [ebp - 0x268], 0x10
je 0x625566
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 8]
call fcn.00624fa8
test al, al
je 0x625566
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_RemoveDirectoryW
lea eax, [ebp - 0x26c]
call fcn.0065866c
test eax, eax
je 0x625537
lea eax, [ebp - 0x26c]
call fcn.00658690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6255be
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x6255d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x625659
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x671848]
cmp byte [eax], 0
jne 0x625601
mov eax, dword [0x671910]
test byte [eax + 0xd], 0x80
je 0x625609
push ebx
call sub.kernel32.dll_DeleteFileW
jmp 0x625643
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
lea eax, [ebp - 4]
mov ecx, 0x62566c
mov edx, ebx
call fcn.00403b24
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], 0x54
xor eax, eax
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0x24]
push eax
call sub.shell32.dll_SHFileOperationW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625660
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x625670
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
xor ecx, ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403e48
xor eax, eax
push ebp
push 0x62577d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00625074
lea eax, [ebp - 0x270]
mov ecx, 0x625790
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x3f
call fcn.006585c8
test eax, eax
jne 0x625732
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
test byte [ebp - 0x268], 0x10
jne 0x625719
test bl, bl
je 0x62570e
mov eax, dword [ebp - 8]
call fcn.006255d0
jmp 0x625723
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x625723
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00625670
lea eax, [ebp - 0x26c]
call fcn.0065866c
test eax, eax
je 0x6256e6
lea eax, [ebp - 0x26c]
call fcn.00658690
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625784
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x625a40
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403e48
xor eax, eax
push ebp
push 0x625b50
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00625074
lea eax, [ebp - 0x270]
mov ecx, 0x625b60
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x3f
call fcn.006585c8
test eax, eax
jne 0x625b0e
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc eax
je 0x625aff
test byte [ebp - 0x268], 0x10
je 0x625af6
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00625a40
pop ecx
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_RemoveDirectoryW
jmp 0x625aff
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x26c]
call fcn.0065866c
test eax, eax
je 0x625ab3
lea eax, [ebp - 0x26c]
call fcn.00658690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625b57
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x625dd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x625e18]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x625de6
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x625df5
or bl, 4
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x625e04
or bl, 8
push 2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x625e13
or bl, 0x10
mov eax, ebx
pop ebx
ret

Function at 0x629804
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov word [ebp - 2], dx
push ecx
push edx
call sub.user32.dll_VkKeyScanExW
mov ebx, eax
movzx esi, bx
cmp esi, 0xffff
je 0x629885
lea eax, [ebp - 0x104]
mov edx, pe_nt_image_headers32
call fcn.0065c4dc
mov eax, esi
shr eax, 8
test al, 1
je 0x629848
mov byte [ebp - 0xf4], 0xff
mov edi, dword [ebp + 8]
push edi
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call sub.user32.dll_ToAsciiEx
mov ebx, eax
test bx, bx
jbe 0x629885
push 1
lea eax, [ebp - 2]
push eax
movzx eax, bx
push eax
lea eax, [ebp - 4]
push eax
push 1
mov eax, edi
call fcn.00656db4
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov ax, word [ebp - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1e0a00e1
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2310acf
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x847517
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x8472a2
add esi, esi
or ebx, esi
call fcn.0084754d
sub ebx, esi
xor dword [edi], eax
and ebx, esi
add edi, 1
sub esi, 0x4c176f13
mov esi, ebx
cmp edi, edx
jne fcn.00847517
and esi, esi
and ebx, esi
sub esi, 1
ret