joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7a972c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a9736
pushal
call 0x7a973c
pop ebp
sub ebp, 0x10
sub ebp, 0x3a972c
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7a9760
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7a9769
mov eax, 0x3a972c
add eax, ebp
add eax, 0x63
mov ecx, 0x60c
mov edx, 0x6e2a43b3
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a9780
jmp 0x7a9793
cmp byte [esi + 0x38], bh
cmp cl, byte [edi + 0x32b3b3b3]
jb 0x7a97e9
mov bl, 0xb3
mov bl, 0xb0
jle 0x7a97af
mov bh, 0xb3
mov bl, 0xb3
or dword [ebx + 0x44b3b3b3], ebx
push ecx
mov al, 0x7b
cmp byte [edx], dh
mov edi, 0xb0b3b3b3
jbe 0x7a97f8
xlatb
xchg edi, eax
dec edi
cmp dh, byte [edi + 0x7bdbe397]
aaa
mov ebp, 0xa1d7dbb3
lahf
mov bl, 0xb2
lahf
xchg edi, eax
fist dword [eax + 0x5d]
dec ebp
xchg ecx, eax
pop ebx
mov dh, 0xb3
mov bl, 0xb3
pop edx
xor dword [ebx + 0x3ee6b3b3], 0xffffffdf
xchg edi, eax
mov bl, 0x38
mov ebx, 0x38b3b3b3
mov edi, 0x38b3b3b3
mov dword ds:[0x72b3b3b3], eax
pop edx
mov cl, 0x82
mov cl, 0x30
jno 0x7a97b3
cli
mov esp, 0x4c4c4736
dec esp
cmp byte [edi - 0x6828c169], bl
mov bh, 0x71
mov edi, 0x973f38b3
mov bh, 0xb3
mov bl, 0xb3
fstp xword [ebx + 0x37]
mov ebp, 0xa1d7dbb3
lahf
mov bl, 0xb2
lahf
xchg edi, eax
xlatb
xchg edi, eax
dec edi
cmp bh, byte [edi - 0x4c49a469]
mov bl, 0xb3
pop edx
div byte [ecx - 0x28c14c4d]
xchg edi, eax
dec edi
cmp bl, byte [edi + 0x4c5f3897]
invalid

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x2794478e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
mov eax, section..data_1
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0xaa20b02
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40673a
pop dword [ebp - 0x34]
mov eax, 0xe1eb7ef
add eax, 0xf221af4b
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xaec03d4e
add dword [ebp - 0x44], 0x9f9207fd
mov dword [ebp - 0x40], 0x4cc8ec68
add dword [ebp - 0x40], 0xe56a5fdd
mov dword [ebp - 0x3c], 0xad862535
add dword [ebp - 0x3c], 0x9ec61ef9
mov dword [ebp - 0x38], 0xd0ddf25b
add dword [ebp - 0x38], 0x2f220da5
lea eax, [ebp - 0x44]
push eax
mov eax, 0x67c01c3d
add eax, 0x988064c7
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xa0f69491
add dword [ebp - 0x44], 0xd37bd4c5
mov dword [ebp - 0x40], 0x74a8ec66
add dword [ebp - 0x40], 0xccc3750f
mov dword [ebp - 0x3c], 0x5d92d91a
add dword [ebp - 0x3c], 0x5dc9352
mov dword [ebp - 0x38], 0xc31a97a3
add dword [ebp - 0x38], 0x3ce5685d
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xc309cea6
add eax, 0x3d36b25a
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3b279
push 0
call eax
mov ecx, 0x379e6c3c
sub ecx, 0x379e15ae
xor ebx, ebx
add ebx, eax
mov edi, 0xebe466b0
add edi, 0x14627d50
add edi, dword [ebp - 0x34]
mov edx, 0xe52cb731
xor dword [ebp - 0x28], ecx
mov esi, dword [edi]
add esi, edx
xor dword [ebp - 0x18], eax
mov dword [ebx], esi
mov dword [ebp - 0x20], 0xe151390c
add ebx, 4
add edi, 0xe3294a6
sub edi, 0xe3294a2
loop 0x406858
add eax, 0x7508bb1c
sub eax, 0x75076e11
mov ebx, eax
add eax, 5
mov ecx, 0xa573cbaa
add ecx, 0x5acc3456
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x688008], 0x8088405
inc edx
mov dword [ebx + 0x688008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cc40
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cc71
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc59
add dl, dl
jne 0x41cc7c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cccd
xor eax, eax
add dl, dl
jne 0x41cc89
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd6a
add dl, dl
jne 0x41cc98
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cca3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccae
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccb9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41ccc3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cc68
mov eax, 1
add dl, dl
jne 0x41ccdb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cce6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccd2
sub eax, ebx
mov ebx, 1
jne 0x41cd19
mov ecx, 1
add dl, dl
jne 0x41ccff
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccf6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cd30
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd3b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cd27
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cd8b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cc68
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e214
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6716d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e2c5
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e2ae
test esi, esi
jbe 0x41e2c5
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088dc
test eax, eax
jne 0x41e2a0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e2c5
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e27d
jmp 0x41e2c5
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e2c5
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6716da
ret
Function at 0x41eb1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x6720cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eb57
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eb70
lea eax, [ebp - 0x10]
mov edx, dword [0x68a258]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eb83
lea eax, [ebp - 0x10]
mov edx, dword [0x68a258]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eb8f
adc edx, 0
mov edx, dword [edx*4 + 0x6890e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41ec9d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ec90
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dcc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ec90
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ec90
cmp dx, 0x150
ja 0x41ec90
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ec90
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41ecb5
inc ebx
cmp ebx, 0x19
jne 0x41eb49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6720d2
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x1003c58
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
jne 0x1003c96
push 3
push 1
push 0x10
push eax
push 0xffffffffffffffff
push dword [0x1005304]
call fcn.01003b2f
add esp, 0x18
push 0x10053c0
call dword [sym.imp.GDI32.dll_RemoveFontResourceW]
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop ebp
ret 4

Function at 0x1003e2a
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x10012c8
call fcn.0100402c
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1003e67
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003e67
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1003e7f
cmp eax, 0x20b
je 0x1003e6c
mov dword [ebp - 0x1c], ebx
jmp 0x1003e93
cmp dword [ecx + 0x84], 0xe
jbe 0x1003e67
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1003e8d
cmp dword [ecx + 0x74], 0xe
jbe 0x1003e67
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10059f4], 0xffffffff
or dword [0x10059f8], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1005340]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100533c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10059fc], eax
call fcn.01004024
cmp dword [0x10052e0], ebx
jne 0x1003eee
push fcn.01004024
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100400d
push 0x1005010
push 0x100500c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1005338]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1005334]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1005008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x1003f84
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1003f58
cmp al, 0x22
jne 0x1003f4a
cmp byte [esi], 0x22
jne 0x1003f61
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1003f6b
cmp al, 0x20
jbe 0x1003f5d
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
jmp 0x1004aca
cmp byte [esi], 0x20
jbe 0x1003f61
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1003f84
jge 0x1004b5a
dec edx
jmp 0x100e4d8
push 0x6b06
clc
pop eax
cld
xchg ecx, ecx
wait
jmp 0x1004b5a
inc dh
or dh, 0
sub cl, ah
not edx
not edx
stc
inc edx
mov dh, 0x21
lea edx, [esi]
sbb cl, 0x91
not dh
mov dh, 0xcc
xchg ecx, ecx
lea edx, [esi]
dec ecx
sub ecx, 0x228ee720
dec ecx
xchg edx, ecx
jmp 0x1004b17
cmc
sub eax, 2
not ecx
xchg ecx, ecx
jmp 0x1004a9c
nop
sbb word [eax + 0x1007c00], 0x334d
sub ecx, eax
inc ch
nop
sub ecx, edi
inc ecx
not edx
xchg ecx, edx
adc ecx, 0xc1d35961
cmp ch, dh
jmp 0x1004ae0
Function at 0x405ede
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4382c4], 0
jne 0x405f1c
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405ef2
mov dword [ecx*4 + 0x4382c0], eax
inc ecx
cmp ecx, 0x100
jl 0x405eed
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x405f49
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4382c0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x405f2a
not eax
pop ebp
ret 0xc

Function at 0x6b1bd7fc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x6b1bd806
pushal
call 0x6b1bd80c
pop ebp
sub ebp, 0x10
sub ebp, 0x3bd7fc
mov al, byte [esp + 0x28]
cmp al, 1
je 0x6b1bd830
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x6b1bd839
mov eax, 0x3bd7fc
add eax, ebp
add eax, 0x63
mov ecx, 0x5f3
mov edx, 0xd3ac0b27
xor byte [eax], dl
inc eax
dec ecx
jne 0x6b1bd850
jmp 0x6b1bd863
lodsb al, byte [esi]
ljmp 0x2727
Function at 0x417bd0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49492b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00488f95
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x417c52
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0048670d
mov eax, dword [eax]
push 0x582cdc
push eax
call fcn.00478c34
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00489220
test bl, bl
je 0x417c52
push 0x582cdc
lea ecx, [esp + 0xc]
call fcn.004895b0
push 0x582ce8
lea ecx, [esp + 0xc]
call fcn.004895b0
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x417c8e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00489220
jmp 0x417d59
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x417d12
lea edx, [esp + 0x7c]
push 0x582ce4
push edx
call fcn.00478c34
add esp, 8
test eax, eax
je 0x417d12
lea eax, [esp + 0x7c]
push 0x582ce0
push eax
call fcn.00478c34
add esp, 8
test eax, eax
je 0x417d12
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x417ca2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00489220
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x418550
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4185b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4185c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4949ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x58d2f4]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x4186f8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x418626
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00489220
xor eax, eax
jmp 0x41876f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0048935d
push esi
lea ecx, [esp + 0xc]
call fcn.004895ec
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41874d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.00418550
test eax, eax
jne 0x41874d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.00418550
test eax, eax
jne 0x41874d
lea eax, [esp + 0x14]
push 0x582cf8
push eax
call fcn.00479d80
mov esi, eax
add esp, 8
test esi, esi
jne 0x41872c
lea ecx, [esp + 0x14]
push 0x582cf4
push ecx
call fcn.00479d00
mov esi, eax
add esp, 8
test esi, esi
jne 0x41872c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41872f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0048930d
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41863e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00489220
xor eax, eax
jmp 0x41876f
mov byte [esi], 0
push 0x582cf0
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00489220
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x42aa40
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x42aaae
cmp si, 0x69
ja 0x42aaae
add esi, 0xffd0
cmp si, 0x11
je 0x42aa7e
push 0x11
call edi
test ax, ax
jge 0x42aa7e
or esi, 0x2000
cmp si, 0x10
je 0x42aa93
push 0x10
call edi
test ax, ax
jge 0x42aa93
or esi, 0x4000
cmp si, 0x12
je 0x42aaa8
push 0x12
call edi
test ax, ax
jge 0x42aaa8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x42aabb
mov esi, 0xbd
jmp 0x42aa6f
cmp si, 0x6e
jne 0x42aac8
mov esi, 0xbe
jmp 0x42aa6f
cmp si, 0x6f
jne 0x42aa69
mov esi, 0xbf
jmp 0x42aa6f

Function at 0x42c3f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x59dbe0]
xor edx, edx
cmp eax, edx
jne 0x42c416
xor eax, eax
mov byte [eax + 0x59dae0], al
inc eax
cmp eax, 0x100
jl 0x42c3fe
mov dword [0x59dbe0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x59dae0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x42c4a7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x42c47a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x42c448
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x42c520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x42c573
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x42c55a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret