joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40229a
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push 0x44c54c
push dword [esp + 0x10]
mov esi, eax
call fcn.0043460c
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4022b8
xor al, al
jmp 0x4022de
cmp dword [esi + 0x18], 0x10
mov eax, dword [esi + 0x14]
jb 0x4022c6
mov esi, dword [esi + 4]
jmp 0x4022c9
add esi, 4
push edi
push eax
push 1
push esi
call fcn.00434785
push edi
call fcn.0043487e
add esp, 0x14
mov al, 1
pop edi
pop esi
ret 4

Function at 0x4022e3
Capabilities:
Read file on windows

Disassembly:
push 0x40
mov eax, 0x4477cc
call fcn.00436dd6
xor edi, edi
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x49], 0
mov dword [ebp - 0x14], 0xf
call fcn.004040e4
push 2
push edi
push ebx
mov dword [ebp - 4], edi
call fcn.00434984
push ebx
call fcn.00434ba6
push edi
push edi
push ebx
mov esi, eax
call fcn.00434984
add esp, 0x1c
mov eax, esi
lea ecx, [ebp - 0x2c]
call fcn.004026eb
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x40233a
lea eax, [ebp - 0x28]
push ebx
push esi
push 1
push eax
call fcn.00434eb4
add esp, 0x10
cmp esi, eax
jne 0x40239c
push ebx
call fcn.0043487e
pop ecx
lea ecx, [ebp - 0x2c]
lea esi, [ebp - 0x48]
call fcn.00406e5f
mov byte [ebp - 4], 1
cmp dword [0x45a26c], 8
mov eax, dword [0x45a258]
jae 0x402374
mov eax, 0x45a258
mov edi, dword [0x45a268]
mov ecx, dword [ebp - 0x34]
push eax
lea eax, [ebp - 0x48]
call fcn.00402d78
test eax, eax
jne 0x40238e
mov byte [ebp - 0x49], 1
push 0
push 1
lea esi, [ebp - 0x48]
call fcn.00402dd3
xor edi, edi
push ebx
call fcn.0043487e
pop ecx
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404100
mov al, byte [ebp - 0x49]
call fcn.00436e59
ret
Function at 0x4023b7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x459040]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
push ebx
mov dword [ebp - 0x80], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x7c], ebx
push 0x206
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push ebx
push eax
call fcn.00436e80
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push str.SoftwareSOHUSoHuVA
push 0x80000001
mov dword [ebp - 0x78], 0x208
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x7c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x402499
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
mov edi, str.Path
push edi
push dword [ebp - 0x74]
call esi
cmp dword [ebp - 0x78], ebx
je 0x402457
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0043452e
pop ecx
pop ecx
test eax, eax
je 0x40248e
lea eax, [ebp - 0x70]
push eax
push str.SoftwareSOHUSoHuVAInstallPath
push 0x80000002
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40248e
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push edi
push dword [ebp - 0x70]
call esi
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
lea eax, [ebp - 0x6c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x40249f
sub eax, edx
sar eax, 1
jne 0x4024c4
xor eax, eax
movzx ecx, word [eax + str.C:Program_Files_]
mov word [ebp + eax - 0x6c], cx
inc eax
inc eax
cmp cx, bx
jne 0x4024b1
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x80]
call fcn.0040270e
mov ecx, dword [ebp + 0x19c]
mov eax, dword [ebp - 0x80]
xor ecx, ebp
pop ebx
call fcn.0043419d
add ebp, 0x1a0
leave
ret 4

Function at 0x4041e6
Capabilities:
Hash data via wincrypt

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x404203
call fcn.0040422f
jmp 0x404205
xor eax, eax
ret 8
Function at 0x406399
Capabilities:
Check http status code
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x459040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.0040721a
pop ecx
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
cmp edi, esi
jne 0x4063d7
push esi
push 1
lea esi, [ebp - 0x20]
call fcn.00402dd3
xor eax, eax
jmp 0x406456
push 4
lea eax, [ebp - 0x28]
push eax
push 2
push edi
mov dword [ebp - 0x28], 0x3e8
call dword [sym.imp.WININET.dll_InternetSetOptionW]
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x4063f9
lea eax, [ebp - 0x1c]
push ebx
push esi
push 0x84400000
push esi
push esi
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebx, eax
cmp ebx, esi
jne 0x406419
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x406448
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x20000013
push ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
jne 0x406464
call edi
push ebx
call edi
push esi
push 1
lea esi, [ebp - 0x20]
call fcn.00402dd3
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043419d
leave
ret
call edi
push ebx
call edi
xor edi, edi
cmp dword [ebp - 0x24], 0xc8
je 0x406483
push esi
push 1
lea esi, [ebp - 0x20]
call fcn.00402dd3
mov eax, edi
jmp 0x406455
inc edi
jmp 0x406474

Function at 0x4065b9
Capabilities:
Get file version info

Disassembly:
push 0x28
mov eax, 0x446c80
call fcn.00436dd6
xor edi, edi
push edi
push ebx
call fcn.0043452e
pop ecx
pop ecx
test eax, eax
je 0x4065db
xor eax, eax
jmp 0x406675
push edi
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
je 0x4065d4
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.004040e4
mov eax, esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.004026eb
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x406611
lea eax, [ebp - 0x28]
push eax
push esi
push edi
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], edi
jae 0x406629
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
push ecx
push 0x44cdfc
push eax
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x30]
movzx cx, byte [eax + 0xa]
shl cx, 8
movzx esi, cx
movzx ecx, byte [eax + 8]
or esi, ecx
movzx cx, byte [eax + 0xe]
movzx eax, byte [eax + 0xc]
shl cx, 8
movzx ecx, cx
shl esi, 0x10
or esi, ecx
push edi
push 1
lea ecx, [ebp - 0x2c]
or esi, eax
call fcn.00404100
mov eax, esi
call fcn.00436e59
ret
Function at 0x406702
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x459040]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push esi
push 0x103
xor esi, esi
lea eax, [ebp - 0x77]
push esi
push eax
mov byte [ebp - 0x78], 0
call fcn.00436e80
add esp, 0xc
push 0x104
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x80], esi
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x4067a2
push ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
mov dword [ebp - 0x7c], esi
cmp ebx, esi
je 0x4067a1
mov eax, dword [ebx + 0xc]
cmp eax, esi
je 0x4067a1
cmp dword [eax], esi
je 0x4067a1
push edi
mov edi, dword [ebx + 0xc]
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esi + edi]
cmp dword [ecx], eax
jne 0x406792
inc dword [ebp - 0x7c]
mov esi, dword [ebp - 0x7c]
shl esi, 2
cmp dword [esi + edi], 0
jne 0x40676c
jmp 0x4067a0
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x7c]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ebp - 0x80]
xor ecx, ebp
pop esi
call fcn.0043419d
add ebp, 0x90
leave
ret

Function at 0x406a44
Capabilities:
Get mac address on windows

Disassembly:
push ebp
sub esp, 0x41c
lea ebp, [esp - 4]
mov eax, dword [0x459040]
xor eax, ebp
mov dword [ebp + 0x41c], eax
push 8
mov eax, 0x44734d
call fcn.00436d6d
xor ebx, ebx
push 0x3ff
lea eax, [ebp + 0x1d]
mov esi, ecx
push ebx
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 0x14], esi
mov byte [ebp + 0x1c], bl
call fcn.00436e80
add esp, 0xc
push ebx
lea ecx, [ebp]
mov dword [ebp + 0x18], 0xf
call fcn.004040e4
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], ebx
push ebx
mov dword [ebp - 0x10], ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, ebx
je 0x406aca
cmp eax, 0x6f
je 0x406aca
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00403b9d
push ebx
push 1
lea ecx, [ebp]
call fcn.00404100
mov eax, esi
jmp 0x406b3c
push dword [ebp - 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, ebx
je 0x406ab0
lea eax, [ebp - 0x10]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x406af2
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x406ab0
lea esi, [edi + 0x190]
push dword [esi]
lea eax, [edi + 0x194]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.00437230
add esp, 0xc
push dword [esi]
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp]
call fcn.00404d7d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp]
push eax
call fcn.00403b9d
push ebx
push 1
lea ecx, [ebp]
call fcn.00404100
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x41c]
xor ecx, ebp
call fcn.0043419d
add ebp, 0x420
leave
ret
Function at 0x406bb7
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x2c
mov eax, 0x446c53
call fcn.00436dd6
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x38], edi
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.004040e4
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], edi
push 0xf0000040
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.00404208
cmp eax, 0x80090019
jne 0x406c07
push 0xf0000048
lea eax, [ebp - 0x34]
push eax
call fcn.00404208
cmp eax, edi
jge 0x406c1b
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.00403b9d
jmp 0x406cb8
mov dword [ebp - 0x30], edi
lea eax, [ebp - 0x30]
push eax
push edi
push edi
push 0x8003
mov byte [ebp - 4], 2
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x406c41
call fcn.0040422f
jmp 0x406c43
xor eax, eax
cmp eax, edi
jl 0x406c9c
cmp dword [esi + 0x18], 0x10
mov eax, dword [esi + 0x14]
jb 0x406c55
mov esi, dword [esi + 4]
jmp 0x406c58
add esi, 4
push eax
push esi
lea eax, [ebp - 0x30]
call fcn.004041e6
test eax, eax
jl 0x406c9c
push 0x11
pop eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x38], eax
call fcn.004026eb
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x406c80
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x30]
call fcn.004041c2
test eax, eax
jl 0x406c9c
push 0x10
pop eax
lea ecx, [ebp - 0x2c]
call fcn.004026eb
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.00403b9d
cmp dword [ebp - 0x30], edi
je 0x406cb8
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 0x30], edi
lea esi, [ebp - 0x34]
call fcn.00404244
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404100
mov eax, ebx
call fcn.00436e59
ret
Function at 0x406e97
Capabilities:
Encode data using base64

Disassembly:
push 0x20
mov eax, 0x446c20
call fcn.00436d6d
mov edi, ecx
and dword [ebp - 0x2c], 0
mov esi, edx
mov dword [ebp - 0x24], esi
call fcn.0040414b
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
cmp dword [edi + 0x18], 0x10
mov dword [ebp - 0x2c], ebx
jb 0x406ec8
mov eax, dword [edi + 4]
jmp 0x406ecb
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x14]
xor edi, edi
mov dword [ebp - 0x20], eax
test eax, eax
je 0x40700f
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x20]
mov al, byte [eax]
inc edi
inc dword [ebp - 0x14]
mov byte [ebp + edi - 0x11], al
mov dword [ebp - 0x1c], edi
cmp edi, 3
jne 0x406f5e
mov al, byte [ebp - 0x10]
mov cl, byte [ebp - 0xf]
shr al, 2
mov byte [ebp - 0x18], al
mov al, byte [ebp - 0x10]
and al, 3
shl al, 4
shr cl, 4
add al, cl
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0xf]
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp - 0x16], al
mov al, byte [ebp - 0xe]
and al, 0x3f
and dword [ebp - 0x1c], 0
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x1c]
movzx esi, byte [ebp + eax - 0x18]
call fcn.00407fff
mov al, byte [eax]
mov edi, dword [ebp - 0x24]
mov byte [ebp - 0x28], al
push dword [ebp - 0x28]
call fcn.00403005
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x406f31
and dword [ebp - 0x1c], 0
mov edi, dword [ebp - 0x1c]
cmp dword [ebp - 0x20], 0
jne 0x406ede
test edi, edi
je 0x40700f
cmp edi, 3
jge 0x406f8a
push 3
pop ecx
sub ecx, edi
push ecx
lea eax, [ebp + edi - 0x10]
push 0
push eax
call fcn.00436e80
add esp, 0xc
mov cl, byte [ebp - 0x10]
and dword [ebp - 0x14], 0
mov al, cl
shr al, 2
mov byte [ebp - 0x18], al
mov al, byte [ebp - 0xf]
and cl, 3
mov dl, al
shl cl, 4
shr dl, 4
add cl, dl
mov byte [ebp - 0x17], cl
mov cl, byte [ebp - 0xe]
and al, 0xf
mov dl, cl
shl al, 2
shr dl, 6
add al, dl
mov byte [ebp - 0x16], al
lea eax, [edi + 1]
and cl, 0x3f
mov byte [ebp - 0x15], cl
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x406ff9
mov eax, dword [ebp - 0x14]
movzx esi, byte [ebp + eax - 0x18]
call fcn.00407fff
mov al, byte [eax]
mov edi, dword [ebp - 0x24]
mov byte [ebp - 0x28], al
push dword [ebp - 0x28]
call fcn.00403005
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x20]
jl 0x406fce
mov edi, dword [ebp - 0x1c]
push 3
pop esi
cmp edi, esi
jge 0x40700f
sub esi, edi
mov edi, dword [ebp - 0x24]
push 0x3d
call fcn.00403005
dec esi
jne 0x407002
mov eax, dword [ebp - 0x24]
call fcn.00436e45
ret
Function at 0x407018
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWARESOHUSohuVA
push 0x80000001
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407073
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.RegisterId
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x407079
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, eax
cmp esi, 1
push edi
jle 0x407152
push 0x34
pop eax
cdq
idiv esi
and dword [ebp - 4], 0
add eax, 6
mov dword [ebp - 0x18], eax
lea eax, [ecx + esi*4 - 4]
mov edi, dword [eax]
dec esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
sub dword [ebp - 4], 0x61c88647
mov eax, dword [ebp - 4]
shr eax, 2
and eax, 3
xor edx, edx
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], edx
jbe 0x40710a
mov esi, dword [ecx + edx*4 + 4]
mov ebx, edi
shr ebx, 5
shl edi, 4
mov eax, esi
shl eax, 2
xor eax, ebx
mov ebx, esi
xor esi, dword [ebp - 4]
shr ebx, 3
xor ebx, edi
mov edi, edx
and edi, 3
xor edi, dword [ebp - 8]
add eax, ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebx + edi*4]
xor edi, dword [ebp - 0xc]
add edi, esi
xor eax, edi
add dword [ecx + edx*4], eax
mov edi, dword [ecx + edx*4]
inc edx
mov dword [ebp - 0xc], edi
cmp edx, dword [ebp - 0x10]
jb 0x4070c7
mov eax, dword [ecx]
mov ebx, edi
mov esi, eax
shr ebx, 5
shl esi, 2
xor esi, ebx
mov ebx, eax
xor eax, dword [ebp - 4]
and edx, 3
xor edx, dword [ebp - 8]
shl edi, 4
shr ebx, 3
xor ebx, edi
mov edi, dword [ebp + 8]
mov edx, dword [edi + edx*4]
xor edx, dword [ebp - 0xc]
add esi, ebx
add edx, eax
mov eax, dword [ebp - 0x14]
xor esi, edx
add dword [eax], esi
dec dword [ebp - 0x18]
mov edi, dword [eax]
mov dword [ebp - 0xc], edi
jne 0x4070ad
jmp 0x407215
cmp esi, 0xffffffff
jge 0x407215
push 0x34
neg esi
pop eax
cdq
idiv esi
mov edx, dword [ecx]
lea edi, [esi - 1]
lea esi, [ecx + esi*4 - 4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
add eax, 6
imul eax, eax, 0x9e3779b9
mov dword [ebp - 4], eax
mov esi, dword [ebp - 0x10]
shr eax, 2
and eax, 3
mov dword [ebp - 8], eax
test esi, esi
jbe 0x4071cc
mov eax, dword [ecx + esi*4 - 4]
mov ebx, eax
shr ebx, 5
mov edi, edx
shl edi, 2
xor edi, ebx
shl eax, 4
mov ebx, edx
xor edx, dword [ebp - 4]
shr ebx, 3
xor ebx, eax
mov eax, esi
and eax, 3
xor eax, dword [ebp - 8]
add edi, ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + eax*4]
xor eax, dword [ecx + esi*4 - 4]
add eax, edx
xor edi, eax
sub dword [ecx + esi*4], edi
mov edx, dword [ecx + esi*4]
dec esi
jne 0x40718e
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ebx, eax
mov edi, edx
shr ebx, 5
shl edi, 2
xor edi, ebx
mov ebx, edx
shl eax, 4
and esi, 3
xor esi, dword [ebp - 8]
shr ebx, 3
xor ebx, eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + esi*4]
mov eax, dword [ebp - 0x14]
xor esi, dword [eax]
mov eax, dword [ebp - 4]
xor edx, eax
add esi, edx
add edi, ebx
xor edi, esi
sub dword [ecx], edi
mov edx, dword [ecx]
add eax, 0x61c88647
mov dword [ebp - 4], eax
jne 0x40717e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4084a9
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xd8]
mov eax, dword [eax]
push edi
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x4084cd
push 1
push edi
push edi
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x7c]
pop edi
pop esi
ret 8
Function at 0x4093ab
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 4]
mov esi, ecx
cmp eax, 0x100
je 0x4093c8
cmp eax, 0x104
jne 0x409462
push dword [edi]
mov eax, dword [esi]
call dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0x4093e5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp dword [edi], eax
jne 0x40942a
cmp dword [edi + 8], 0x1b
jne 0x4093f9
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x7c]
xor eax, eax
inc eax
jmp 0x409464
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push 0xa4
call ebx
push 0xa5
movzx ebp, ax
call ebx
movzx ecx, ax
mov eax, 0x8000
test eax, ebp
pop ebp
pop ebx
jne 0x409424
test eax, ecx
je 0x40942a
cmp dword [edi + 8], 0x73
je 0x4093eb
push dword [edi]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x409462
push edi
push dword [edi + 8]
push 0x87
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x409462
cmp dword [edi + 8], 9
jne 0x409462
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x414dc4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x414dd2
push 0xd
pop eax
jmp 0x414e05
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x414dd9
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x415284
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x459040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
push ecx
push dword [esi]
mov dword [ebp - 0x21c], ecx
xor edi, edi
or eax, 0x2001f
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
call fcn.00415246
mov ebx, eax
cmp ebx, edi
je 0x4152ea
cmp dword [ebp - 0x214], edi
je 0x4152e3
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x415382
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x415312
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00415284
mov dword [ebp - 0x220], eax
cmp eax, edi
jne 0x415393
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x4152f2
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], edi
je 0x41535d
push dword [ebp - 0x214]
call ebx
mov dword [ebp - 0x214], edi
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], edi
call fcn.00415400
mov esi, eax
cmp dword [ebp - 0x214], edi
je 0x415380
push dword [ebp - 0x214]
call ebx
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043419d
leave
ret 4
cmp dword [ebp - 0x214], edi
je 0x4153a7
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x220]
jmp 0x415382

Function at 0x415400
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x45da34], 0
jne 0x415430
push 0x44db80
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x415429
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45da38], eax
mov byte [0x45da34], 1
mov eax, dword [0x45da38]
test eax, eax
je 0x415448
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x415454
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4

Function at 0x41962a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x446296
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x459040]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, esi
call fcn.0040ddf0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [esp + 0xc], vtable.shui::CSHSignalArgs.0
and dword [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
push esi
add esi, 0x98
push esi
call fcn.00402acc
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret