joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46eb00
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4986e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4cf500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
xor ecx, ecx
mov word [ebp - 0x2c], cx
mov ecx, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x46eb50
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [ebp - 0x2c]
call fcn.0040cb00
mov dword [ebp - 4], ebx
mov ebx, edi
mov ecx, esi
call fcn.0046e3b0
test al, al
sete bl
cmp dword [ebp - 0x18], 8
jb 0x46eb8b
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00472b96
add esp, 4
test bl, bl
jne 0x46ebd6
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 0x30]
push ecx
mov dword [edi + 0x40], eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov edx, dword [ebp - 0x30]
and dl, 4
sub dl, 4
movzx eax, dl
push 0
neg eax
push 0
sbb eax, eax
push 0
and eax, 4
push eax
push str.Mozilla_4.0__compatible__MSIE_7.0__Windows_NT_5.2__.NET_CLR_1.1.4322__.NET_CLR_2.0.50727_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [edi + 0x38], eax
test eax, eax
jne 0x46ebda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x4c], eax
xor al, al
jmp 0x46ebe1
call fcn.0046ec00
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472ba1
mov esp, ebp
pop ebp
ret 8

Function at 0x46eca0
Capabilities:
Check http status code
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.WININET.dll_HttpQueryInfoA]
push esi
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
xor esi, esi
push 0x20000013
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 8
mov dword [ebp - 4], esi
call ebx
test eax, eax
je 0x46ed2a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp ecx, 0xc8
jne 0x46ecea
cmp eax, esi
je 0x46ecf6
cmp ecx, 0x12e
jne 0x46ed2a
cmp eax, esi
jne 0x46ed2a
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x20000005
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 8
mov dword [ebp - 4], esi
call ebx
test eax, eax
je 0x46ed2a
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471070
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4cf500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [edx]
push edi
mov edi, dword [ebp + 8]
xor edx, edx
push 0x206
mov dword [ebp - 0x214], eax
push edx
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x210], ecx
mov word [ebp - 0x20c], dx
call fcn.00477f60
mov ecx, dword [ebp - 0x214]
mov eax, dword [ecx]
mov ebx, dword [ebx]
mov edi, dword [edi]
add esp, 0xc
push esi
push 0x104
lea edx, [ebp - 0x20c]
push edx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, eax
lea eax, [ebp - 0x20c]
lea ecx, [eax + 2]
jmp 0x4710f0
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4710f0
sub eax, ecx
mov ecx, dword [ebp - 0x210]
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00401b90
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00472ba1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4711d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49ce18
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4cf500]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
lea ebx, [esi + 4]
push ecx
mov dword [esp + 0x30], 0
call fcn.0040b4f0
add esp, 8
lea edi, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.00404dc0
xor bl, bl
mov byte [esp + 0x28], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x47125c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00401630
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x30], 2
call fcn.00403e90
add esp, 4
push eax
mov byte [esp + 0x30], bl
call fcn.00404040
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4712b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x472ba1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4cf500]
jne 0x472bab
repz ret
jmp fcn.0047c1da
Function at 0x486fa8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4cf500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0047e009
and dword [ebp - 0x14], 0
cmp dword [0x4d7f90], 0
mov dword [ebp - 0x18], eax
jne 0x48705b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x487103
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a8dd4
push ebx
call edi
test eax, eax
je 0x487103
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4d7f90], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4d7f94], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4d7f98], eax
call edi
push eax
call esi
mov dword [0x4d7fa0], eax
test eax, eax
je 0x48705b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4d7f9c], eax
mov eax, dword [0x4d7f9c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4870b4
cmp dword [0x4d7fa0], ecx
je 0x4870b4
push eax
call esi
push dword [0x4d7fa0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4870b4
test ebx, ebx
je 0x4870b4
call edi
test eax, eax
je 0x4870ab
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4870ab
test byte [ebp - 8], 1
jne 0x4870b4
or dword [ebp + 0x10], 0x200000
jmp 0x4870e7
mov eax, dword [0x4d7f94]
cmp eax, dword [ebp - 0x18]
je 0x4870e7
push eax
call esi
test eax, eax
je 0x4870e7
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4870e7
mov eax, dword [0x4d7f98]
cmp eax, dword [ebp - 0x18]
je 0x4870e7
push eax
call esi
test eax, eax
je 0x4870e7
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4d7f90]
call esi
test eax, eax
je 0x487103
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x487105
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00472ba1
leave
ret
Function at 0x490ec0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4947a0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4cf500]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cf500]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [0x4d070c]
cmp eax, 0xffffffff
jne 0x490f00
xor esi, esi
jmp 0x490f09
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x18], esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x58], 0
test esi, esi
je 0x490f5d
nop
cmp dword [esi + 0x14], 0
jne 0x490faa
cmp dword [esi + 0x10], 0
jne 0x490fb0
push 0x48e800
push 0x4d7fbc
call fcn.0048ec90
mov eax, dword [0x4d070c]
add esp, 8
cmp eax, 0xffffffff
je 0x491061
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x58], 0xffffffff
test esi, esi
je 0x490f8b
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x490f8b
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00472ba1
add esp, 0x48
ret
cmp dword [esi + 0x10], 0
je 0x490ff2
mov ebp, dword [esi + 0x10]
mov eax, dword [ebp + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebp]
test ecx, ecx
je 0x490fe0
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
cmp dword [esi + 0x10], 0
jne 0x490fb0
cmp dword [esi + 0x14], 0
je 0x490f2a
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x491017
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebp, dword [edi + 8]
test ebp, ebp
je 0x49104a
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x49104a
mov edx, dword [ebp]
mov eax, dword [edx + 4]
mov ecx, ebp
call eax
lea ecx, [ebp + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x49104a
mov eax, dword [ebp]
mov edx, dword [eax + 8]
mov ecx, ebp
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
cmp dword [esi + 0x14], 0
jne 0x490ffc
jmp 0x490f20
call fcn.00492080
mov esi, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov edi, 0xb
mov dword [esp + 0x18], str.boost::thread_resource_error
call fcn.00473183
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
mov dword [esp + 0x1c], vtable.boost::thread_resource_error.0
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x5c], 1
call fcn.00405a60
int3
Function at 0x4911b0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x494808
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4cf500]
xor eax, esp
mov dword [esp + 0x34], eax
push ebp
push esi
push edi
mov eax, dword [0x4cf500]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x4910c0
push 0
push 0
call fcn.00473862
mov ebp, eax
add esp, 0x18
test ebp, ebp
jne 0x491252
call fcn.00492080
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
mov esi, eax
lea edi, [ebp + 0xb]
mov dword [esp + 0x14], str.boost::thread_resource_error
call fcn.00473183
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebp
mov byte [esp + 0x28], 0
mov dword [esp + 0x14], vtable.boost::thread_resource_error.0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x54], ebp
call fcn.00405a60
mov ecx, dword [esi]
add ecx, 4
mov edx, 1
lock xadd dword [ecx], edx
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x491275
cmp eax, 0xffffffff
je 0x491275
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebp
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00472ba1
add esp, 0x44
ret
Function at 0x9fefc4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9fefca
pop ebp
sub ebp, 6
sub ebp, 0x5fefc4
jmp 0x9ff028
jmp 0x9ff031
mov eax, 0x5fefc4
add eax, ebp
add eax, 0x93
mov ecx, 0x5b5
mov edx, 0xb6f8ab6
xor byte [eax], dl
inc eax
dec ecx
jne 0x9ff048
jmp 0x9ff05b
cmp eax, 0x8a3f3d7b
mov dh, 0xb6
mov dh, 0x37
ja 0x9ff0b4
mov dh, 0xb6
mov dh, 0xb5
jnp 0x9ff07a
mov edi, 0xcb6b6b6
sahf
mov dh, 0xb6
or al, 0x9e
mov dh, 0xb6
mov dh, 0x41
push esp
mov ch, 0x7e
cmp eax, 0xb6b6ba37
mov dh, 0xb5
aaa
mov edx, 0xb5b6b6b6
jae 0x9ff068
out 0xde, al
push ds
stosb byte es:[edi], al
mov eax, 0x65acdeb6
out 0xb6, eax
mov bh, 0x9a
xchg edx, eax
fidiv word [ebp - 0x6e]
cmpsd dword [esi], dword es:[edi]
loope 0x9ff0f4
mov bl, 0xb6
mov dh, 0xb6
pop edi
sahf
mov dh, 0xb6
mov dh, 0xe3
cmp eax, 0xbe333d5a
mov dh, 0xb6
mov dh, 0x3d
and edi, dword [edx + 0x3db6b6b6]
cmp esp, dword [esi + 0x77b6b6b6]
pop edi
ja 0x9ff115
mov ah, 0x87
mov ah, 0x35
je 0x9ff06e
invalid
cmp eax, 0xb6b6be0b
mov dh, 0x85
jg 0x9ff082
xor eax, 0xb9feb35e
xor bh, al
mov dh, 0xb6
mov dh, 0xb9
invalid
mov ecx, 0xb6b6ac32
mov dh, 0x36
dec ebp
pop edi
mov ecx, 0xb6b6a732
mov dh, 0xd0
aaa
dec ebp
dec ecx
xchg ebx, eax
mov ecx, 0xb6b6a332
mov dh, 0xf7
pop edi
jp 0x9ff17c
dec ecx
dec ecx
lahf
cli
invalid
mov dh, 0xb6
mov ah, 0x64
mov ecx, 0xb6b6b333
mov dh, 0xb4
mov ecx, 0xb6b6b333
mov dh, 0x3c
mov al, byte [0xb964a4f0]
xor eax, 0x4949496e
mov ah, 0x64
mov ecx, 0xb6b6b333
mov dh, 0x3c
mov al, byte [0xb964a4f0]
xor eax, 0xb6b6b6dc
test dword [esi - 0x4c], esi
mov ecx, 0xb6b6b333
mov dh, 0x3c
invalid
mov al, byte [0xb964a4f0]
xor eax, 0xb6b6b79c
mov ah, 0x64
mov ecx, 0xb6b6b333
mov dh, 0x3c
mov al, byte [0xa564a4f0]
jbe 0x9ff17d
mov ecx, 0xb6b6b333
mov dh, 0x3c
mov al, byte [0xa564a4f0]
jbe 0x9ff18c
mov ecx, 0xb6b6b333
mov dh, 0x3c
mov al, byte [0xa564a4f0]
jbe 0x9ff19b
mov ecx, 0xb6b6b333
mov dh, 0x3c
mov al, byte [0xa564a4f0]
jbe 0x9ff1af
xor dh, byte [eax + 0x3db6b6b6]
imul ebx, dword [ebp + 0x3eb53c6e], 0xb40df1b1
mov dh, 0xb6
mov dh, 0x5f
invalid
Function at 0x40c120
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x486ebb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047b29a
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40c1a2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004784be
mov eax, dword [eax]
push 0x4a71f0
push eax
call fcn.0046ad64
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047b525
test bl, bl
je 0x40c1a2
push 0x4a71f0
lea ecx, [esp + 0xc]
call fcn.0047b8b5
push 0x4aad58
lea ecx, [esp + 0xc]
call fcn.0047b8b5
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40c1de
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047b525
jmp 0x40c2a9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40c262
lea edx, [esp + 0x7c]
push 0x4aad54
push edx
call fcn.0046ad64
add esp, 8
test eax, eax
je 0x40c262
lea eax, [esp + 0x7c]
push 0x4aad50
push eax
call fcn.0046ad64
add esp, 8
test eax, eax
je 0x40c262
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c1f2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047b525
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40caa0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40cb02
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40cb10
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x486f3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4b1e94]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40cc48
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40cb76
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047b525
xor eax, eax
jmp 0x40ccbf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0047b662
push esi
lea ecx, [esp + 0xc]
call fcn.0047b8f1
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x4aad90
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40cc9d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040caa0
test eax, eax
jne 0x40cc9d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040caa0
test eax, eax
jne 0x40cc9d
lea eax, [esp + 0x14]
push 0x4aad6c
push eax
call fcn.0046bda0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40cc7c
lea ecx, [esp + 0x14]
push 0x4aad68
push ecx
call fcn.0046bd20
mov esi, eax
add esp, 8
test esi, esi
jne 0x40cc7c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40cc7f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047b612
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40cb8e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047b525
xor eax, eax
jmp 0x40ccbf
mov byte [esi], 0
push 0x4aad64
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047b525
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41d0f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41d15e
cmp si, 0x69
ja 0x41d15e
add esi, 0xffd0
cmp si, 0x11
je 0x41d12e
push 0x11
call edi
test ax, ax
jge 0x41d12e
or esi, 0x2000
cmp si, 0x10
je 0x41d143
push 0x10
call edi
test ax, ax
jge 0x41d143
or esi, 0x4000
cmp si, 0x12
je 0x41d158
push 0x12
call edi
test ax, ax
jge 0x41d158
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41d16b
mov esi, 0xbd
jmp 0x41d11f
cmp si, 0x6e
jne 0x41d178
mov esi, 0xbe
jmp 0x41d11f
cmp si, 0x6f
jne 0x41d119
mov esi, 0xbf
jmp 0x41d11f

Function at 0x41e8a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4c2598]
xor edx, edx
cmp eax, edx
jne 0x41e8c6
xor eax, eax
mov byte [eax + 0x4c2498], al
inc eax
cmp eax, 0x100
jl 0x41e8ae
mov dword [0x4c2598], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4c2498
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41e957
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41e92a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41e8f8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41e9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41ea23
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41ea0a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret