joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x403108]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x168]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x168], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x11c]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push str.PATH
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [0x403120], eax
cmp dword [0x403120], 0
je 0x40107b
push 0x40300c
call fcn.00401190
add esp, 4
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jne 0x4010f6
push 0x100
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4010b6
push 0x5c
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.MSVCR90.dll_strrchr]
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x4010be
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov edx, dword [ebp - 0x10c]
mov byte [edx], 0
lea eax, [ebp - 0x108]
mov dword [0x403120], eax
push str.lefty
call fcn.00401190
add esp, 4
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jne 0x4010f6
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx]
test edx, edx
jne 0x401124
mov eax, dword [section..data]
push eax
mov ecx, dword [ebp - 0x16c]
push ecx
push str._s__e__load_dotty.lefty___sdotty.init___dotty.createviewandgraph_null_file_null_null__txtview_off___
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x10
jmp 0x40114b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [section..data]
push ecx
mov edx, dword [ebp - 0x16c]
push edx
push str._s__e__load_dotty.lefty___sdotty.init___dotty.createviewandgraph__Ns_file_null_null__txtview_off___
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x14
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x168]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
call dword [sym.imp.MSVCR90.dll_exit]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040131c
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40131c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403108]
jne 0x401326
repz ret
jmp fcn.00401640
Function at 0x40135e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor edx, edx
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x401366
mov dword [edx*4 + 0x4224f8], ecx
inc edx
cmp edx, 0x100
jb 0x401361
mov esi, 0x800
jmp 0x4013ae
mov ecx, dword [edx*4 + 0x4220f8]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x4224f8]
mov dword [edx*4 + 0x4224f8], ecx
inc edx
cmp edx, esi
jb 0x401392
mov dword [0x4244f8], 0x40160e
call fcn.0040128c
mov ecx, dword [0x4244f8]
test eax, eax
mov edx, 0x4016a7
cmove ecx, edx
mov dword [0x4244f8], ecx
pop esi
ret

Function at 0x40142c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x401481
and dword [edi], 0
mov edx, 0x400000
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
cmp esi, edx
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x401488
test ecx, ecx
je 0x401481
mov ecx, dword [ebp - 4]
mov edx, 0x400000
test esi, esi
jne 0x401449
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401483
Function at 0x405c15
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
mov eax, ecx
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x405c38
xor eax, eax
jmp 0x405d6e
push ebx
lea ebx, [edx - 4]
or ecx, 0xffffffff
add ebx, eax
mov dword [ebp - 0x14], ebx
lea edx, [edi + eax]
cmp edx, ebx
jae 0x405c5b
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x405c58
inc edx
cmp edx, ebx
jb 0x405c4b
mov eax, dword [ebp - 4]
mov edi, edx
sub edi, eax
mov eax, edi
sub eax, ecx
cmp edx, ebx
jae 0x405d56
cmp eax, 3
jbe 0x405c92
xor esi, esi
mov al, byte [edx + 4]
mov ecx, edi
mov dword [ebp - 0x10], ecx
test al, al
je 0x405cce
cmp al, 0xff
je 0x405cce
and esi, 3
xor eax, eax
add esi, esi
or esi, 1
inc eax
jmp 0x405d4f
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x405c72
cmp byte [esi + 0x41e8f0], 0
je 0x405cbb
movzx eax, byte [esi + 0x41e900]
mov ecx, edx
sub ecx, eax
mov al, byte [ecx + 4]
test al, al
je 0x405cbb
cmp al, 0xff
jne 0x405c72
and esi, 3
mov ecx, edi
add esi, esi
or esi, 1
inc edi
mov eax, dword [ebp - 4]
jmp 0x405c44
movzx ebx, al
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
shl ebx, 8
or ebx, eax
sub ebx, edi
sub ebx, 5
mov dword [ebp - 0xc], ebx
test esi, esi
je 0x405d27
movzx eax, byte [esi + 0x41e900]
shl eax, 3
push 0x18
pop ecx
sub ecx, eax
mov dword [ebp - 8], eax
mov eax, ebx
shr eax, cl
test al, al
je 0x405d16
cmp al, 0xff
jne 0x405d27
xor ebx, ebx
push 0x20
pop ecx
sub ecx, dword [ebp - 8]
inc ebx
shl ebx, cl
dec ebx
xor ebx, dword [ebp - 0xc]
jmp 0x405cec
mov ecx, dword [ebp - 0x10]
mov eax, ebx
shr eax, 0x18
and al, 1
mov byte [edx + 1], bl
neg al
mov byte [edx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 3], al
mov eax, ebx
mov ebx, dword [ebp - 0x14]
shr eax, 8
push 5
mov byte [edx + 2], al
pop eax
add edi, eax
jmp 0x405cc6
lea ecx, [eax - 1]
shl esi, cl
xor ecx, ecx
and esi, 7
cmp eax, 3
mov eax, dword [ebp + 0xc]
cmova esi, ecx
pop ebx
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x406966
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x40696e
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret

Function at 0x40697c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x421004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x40699c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4069ae
mov al, 1
jmp 0x406a4a
push ebx
push 0x20a
xor ebx, ebx
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.00407ed0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4069ce
mov esi, dword [esi]
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0040c5b8
lea eax, [ebp - 0x210]
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], eax
xorps xmm0, xmm0
pop ecx
mov eax, 0x1494
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x230]
pop ecx
push eax
movlpd qword [ebp - 0x21e], xmm0
mov dword [ebp - 0x216], ebx
mov dword [ebp - 0x22c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [ebp - 0x21e], ebx
je 0x406a35
xor al, al
jmp 0x406a49
test eax, eax
je 0x406a45
cmp eax, 2
je 0x406a45
cmp eax, 0x402
jne 0x406a47
mov bl, 1
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00406c98
leave
ret
Function at 0x406a57
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418b05
mov eax, dword fs:[0]
push eax
mov eax, 0x228c
call fcn.00418830
mov eax, dword [0x421004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x2298], eax
mov esi, ecx
test eax, eax
je 0x406bfd
lea eax, [ebp - 0x248]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, edi
jae 0x406bfd
test eax, eax
je 0x406bfd
xor ebx, ebx
push ebx
call fcn.0040c5da
push eax
call fcn.0040c445
pop ecx
pop ecx
mov dword [ebp - 0x2294], ebx
xor eax, eax
mov dword [ebp - 0x2260], ebx
mov dword [ebp - 0x2250], ebx
mov dword [ebp - 0x224c], 7
mov word [ebp - 0x2260], ax
lea eax, [ebp - 0x2260]
mov dword [ebp - 4], ebx
cmp eax, esi
je 0x406b19
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x406b0a
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x2260]
push eax
call fcn.0040625c
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
push 0xa
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push 0x14
push eax
call fcn.0040c424
cdq
mov ecx, 0x7fff
idiv ecx
push edx
call fcn.0040c585
lea eax, [ebp - 0x38]
push eax
call fcn.0040bebb
add esp, 0x14
lea ecx, [ebp - 0x2260]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004062aa
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x2290]
call fcn.004061ba
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2260]
cmp dword [ebp - 0x224c], 8
push dword [ebp - 0x2250]
cmovae ecx, dword [ebp - 0x2260]
push ecx
mov ecx, eax
call fcn.004062aa
push eax
lea ecx, [ebp - 0x2278]
call fcn.004061e9
lea ecx, [ebp - 0x2290]
mov byte [ebp - 4], 3
call fcn.0040618f
cmp dword [ebp - 0x2264], 8
lea eax, [ebp - 0x2278]
push ebx
cmovae eax, dword [ebp - 0x2278]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406c19
lea ecx, [ebp - 0x2278]
call fcn.0040618f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2260]
call fcn.0040618f
mov eax, dword [ebp - 0x2294]
inc eax
mov dword [ebp - 0x2294], eax
cmp eax, 0x32
jl 0x406ad4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406c98
leave
ret
push 0x2000
lea eax, [ebp - 0x2248]
push ebx
push eax
call fcn.00407ed0
add esp, 0xc
lea ecx, [ebp - 0x2248]
cmp dword [ebp - 0x2264], 8
lea eax, [ebp - 0x2278]
cmovae eax, dword [ebp - 0x2278]
push 0x1000
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x406c7b
lea eax, [ebp - 0x2248]
push eax
call fcn.0040bebb
pop ecx
mov ecx, dword [ebp - 0x2298]
push eax
lea eax, [ebp - 0x2248]
push eax
call fcn.0040625c
mov bl, 1
lea ecx, [ebp - 0x2278]
call fcn.0040618f
lea ecx, [ebp - 0x2260]
call fcn.0040618f
mov al, bl
jmp 0x406bff
Function at 0x40d0df
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40d11e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d11e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d11e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40d11e
cmp dword [ecx + 0x74], 0xe
jbe 0x40d11e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40dd1a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41a61c
push 0x41a614
push str.FlsAlloc
push 0x1f
call fcn.0040dc55
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40dd4e
push dword [ebp + 8]
mov ecx, esi
call dword [0x419154]
call esi
jmp 0x40dd54
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40dd98
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41a62c
push 0x41a624
push str.FlsGetValue
push 0x21
call fcn.0040dc55
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ddcf
push dword [ebp + 8]
mov ecx, esi
call dword [0x419154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40ddd7
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41a634
push 0x41a62c
push str.FlsSetValue
push 0x22
call fcn.0040dc55
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40de11
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x419154]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41018a
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x421004]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4101d5
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004103a7
test al, al
jne 0x4101cf
sub edx, 2
cmp edx, edi
jne 0x4101b5
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4101f7
lea eax, [edi + 2]
cmp edx, eax
je 0x4101f7
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004100d6
add esp, 0x10
jmp 0x4102f1
push esi
lea ecx, [ebp - 0x255]
call fcn.004103a7
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41023a
push dword [ebp - 0x25c]
jmp 0x4101e7
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x410277
cmp word [ebp - 0x226], 0
je 0x410298
cmp word [ebp - 0x226], ax
jne 0x410277
cmp word [ebp - 0x224], 0
je 0x410298
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004100d6
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4102e4
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x410251
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4102cc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4102f1
push 0x40ff06
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004151c0
add esp, 0x10
jmp 0x4102c1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406c98
leave
ret
Function at 0x30069ec5
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x30088760
call fcn.30069edb
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x300cec78
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x30069c64
cmp eax, esi
jne 0x30069c57
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30069c67
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30069c3e
xor esi, esi
inc esi
mov eax, dword [0x300cec74]
cmp eax, esi
jne 0x30069c7a
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x30069ca9
mov eax, dword [0x300cec74]
test eax, eax
jne 0x30069ca3
mov dword [0x300cec74], esi
push 0x3000169c
push 0x30001690
call fcn.30165000
pop ecx
pop ecx
test eax, eax
je 0x30069ca9
jmp 0x30069dd1
mov dword [0x300cd7e0], esi
mov eax, dword [0x300cec74]
cmp eax, esi
jne 0x30069ccd
push 0x3000168c
push 0x30001674
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x300cec74], 2
test ebx, ebx
jne 0x30069cd9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x300cec84], 0
je 0x30069cfd
push 0x300cec84
call fcn.3006a502
pop ecx
test eax, eax
je 0x30069cfd
push 0
push 2
push 0
call dword [0x300cec84]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x30069d59
test al, al
je 0x30069d17
cmp dword [ebp - 0x1c], 0
jne 0x30069d59
mov al, byte [esi]
test al, al
je 0x30069d27
cmp al, 0x20
ja 0x30069d27
inc esi
mov dword [ebp - 0x20], esi
jmp 0x30069d17
test byte [ebp - 0x3c], 1
je 0x30069d33
movzx eax, word [ebp - 0x38]
jmp 0x30069d36
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call main
mov dword [0x300cd7dc], eax
cmp dword [0x300cd7d0], 0
jne 0x30069dad
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x30069d68
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x30069d7b
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x30069d04
cmp dword [0x300cd7e0], 0
jne 0x30069dbc
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x300cd7dc]
jmp 0x30069ddd
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.30069f20
ret
call fcn.30069567
jmp 0x30069c04
Function at 0x4121f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46d0fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00461e68
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x412272
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045fdb7
mov eax, dword [eax]
push 0x77c1d0
push eax
call fcn.00452cd4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004620f3
test bl, bl
je 0x412272
push 0x77c1d0
lea ecx, [esp + 0xc]
call fcn.00462483
push 0x77fd38
lea ecx, [esp + 0xc]
call fcn.00462483
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4122ae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004620f3
jmp 0x412379
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x412332
lea edx, [esp + 0x7c]
push 0x77fd34
push edx
call fcn.00452cd4
add esp, 8
test eax, eax
je 0x412332
lea eax, [esp + 0x7c]
push 0x77fd30
push eax
call fcn.00452cd4
add esp, 8
test eax, eax
je 0x412332
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4122c2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004620f3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x412b70
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x412bd2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x412be0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46d17b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x786248]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x412d18
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x412c46
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004620f3
xor eax, eax
jmp 0x412d8f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00462230
push esi
lea ecx, [esp + 0xc]
call fcn.004624bf
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x412d6d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.00412b70
test eax, eax
jne 0x412d6d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.00412b70
test eax, eax
jne 0x412d6d
lea eax, [esp + 0x14]
push 0x77fd4c
push eax
call fcn.00453d10
mov esi, eax
add esp, 8
test esi, esi
jne 0x412d4c
lea ecx, [esp + 0x14]
push 0x77fd48
push ecx
call fcn.00453c90
mov esi, eax
add esp, 8
test esi, esi
jne 0x412d4c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x412d4f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004621e0
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x412c5e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004620f3
xor eax, eax
jmp 0x412d8f
mov byte [esi], 0
push 0x77fd44
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004620f3
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x423250
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x4232be
cmp si, 0x69
ja 0x4232be
add esi, 0xffd0
cmp si, 0x11
je 0x42328e
push 0x11
call edi
test ax, ax
jge 0x42328e
or esi, 0x2000
cmp si, 0x10
je 0x4232a3
push 0x10
call edi
test ax, ax
jge 0x4232a3
or esi, 0x4000
cmp si, 0x12
je 0x4232b8
push 0x12
call edi
test ax, ax
jge 0x4232b8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x4232cb
mov esi, 0xbd
jmp 0x42327f
cmp si, 0x6e
jne 0x4232d8
mov esi, 0xbe
jmp 0x42327f
cmp si, 0x6f
jne 0x423279
mov esi, 0xbf
jmp 0x42327f

Function at 0x424a00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x796890]
xor edx, edx
cmp eax, edx
jne 0x424a26
xor eax, eax
mov byte [eax + 0x796790], al
inc eax
cmp eax, 0x100
jl 0x424a0e
mov dword [0x796890], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x796790
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x424ab7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x424a8a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x424a58
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x424b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x424b83
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x424b6a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret