joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484e00
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b9f30
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x484fa7
mov ecx, dword [0x5a1e48]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x484efc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.00483b20
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.004a7610
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.004a74d7
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5a0b88
call fcn.004a7545
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.00483ee0
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.004a7610
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.004a74d7
lea ecx, [esp + 0xc]
call fcn.004a79eb
mov ecx, dword [esp + 0xc]
push 0x5a15c4
push ecx
call fcn.00495564
add esp, 8
test eax, eax
je 0x484f24
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x484e5d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.004a74d7
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004a74d7
jmp 0x484fab
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.00484ba0
test eax, eax
push 0
je 0x484f8f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.00483240
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x484f75
cmp eax, 0x64
jg 0x484f63
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x484f00
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x484f00
cmp eax, 0x64
jge 0x484efc
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x484f00
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.00483240
mov esi, eax
jmp 0x484f00
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x484fb5
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x497020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x497040
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004994e9
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x497063
test byte [esp + 8], 2
je 0x497063
call fcn.0049955c
mov dword [eax], 0xd
call fcn.00499565
mov dword [eax], 5
jmp 0x49703c
xor eax, eax
ret

Function at 0x4a9904
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a993c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a797e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a7956
jmp 0x4a9948
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4aaff2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4ab034
call fcn.004b128f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4ab034
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4ab02b
xor eax, eax
jmp 0x4ab03c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004ab042
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b17bf
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b17ed
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b180b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b1725
jmp 0x4b180b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b180b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b1725
test edi, edi
mov eax, edi
jne 0x4b17f5
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x96b87c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x9554a2
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x9554be
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x9554aa
jmp 0x9554c9
ret
lea esp, [esp + 4]
jmp 0x955497

Function at 0x97fc69
Capabilities:
Encrypt data using aes

Disassembly:
shl edx, 8
btc ebp, ebx
sub esp, 0x14
jmp 0x97fd64
mov ebp, dword [esp]
mov bp, di
xchg edi, esi
shr eax, 0x10
mov bl, 0x62
jmp 0x97fce8
and eax, esi
mov di, 0xa763
mov ebx, eax
jmp 0x97fcc6
mov dword [ecx + 0xc], edx
bsr di, bp
bsr si, bp
mov eax, edx
mov bx, dx
jmp 0x97fc8b
mov eax, dword [eax*4 + 0x95d8a8]
bsr bp, bp
lea ebp, [eax*4]
mov di, word [esp]
jmp 0x97fd15
lea esp, [esp + 0x1c]
mov esi, 0xff
neg bh
bsf di, ax
setge bl
jmp 0x97fc9a
xor eax, 0x1000000
call fcn.0097fcfc
clc
lea esp, [esp + 2]
jmp 0x97fd44
and edi, esi
cmc
inc bl
mov edi, dword [edi*4 + 0x95d8a8]
jmp 0x97fe18
xor edx, eax
mov ebp, 0xce424676
xchg bh, al
xchg bh, al
jmp 0x97fcb4
bsf bp, si
lea esp, [esp + 0x14]
and edi, 0xff0000
mov bl, byte [esp]
call fcn.0097fd8f
mov bp, word [esp]
and edi, esi
mov edi, dword [edi*4 + 0x95d8a8]
lea ebp, [eax*4]
jmp 0x97fece
lea esp, [esp + 0x18]
mov ebp, 0xff00
stc
sub esp, 0x10
mov dword [esp + 5], ebp
jmp 0x97ff3d
sub esp, 0x18
lea ebp, [ebp + 0x4d8810af]
jmp 0x97feb7
and edi, ebp
call fcn.0097ff12

Function at 0x98070b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
add esi, 0x10
inc dh
mov di, word [esp]
mov di, word [esp]
jmp 0x9806ee
mov ebx, dword [ebp]
pop ebp
lea edx, [esi - 0xbd]
bswap edi
jmp 0x98066d
push ebp
mov ebp, ebx
lea ebp, [ebp*4]
lea ebp, [ebp + 0x95d8a8]
jmp 0x980690
mov edi, edx
push edx
call fcn.009806b9
inc edi
ret 0x3750
mov edx, dword [esi]
lea edi, [eax + 0x48b63201]
bsr di, bp
mov edi, dword [esp]
clc
jmp 0x9806d3
jmp 0x9806a7

Function at 0x9808c4
Capabilities:
Encrypt data using aes

Disassembly:
btc edi, edi
mov edi, edx
sub esp, 6
lea esp, [esp + 2]
jmp 0x9808ab
not di
mov ebx, dword [ebx*4 + 0x95d8a8]
mov di, 0x93ad
lea edi, [eax + ebx]
sub esp, 8
jmp 0x98083f
lea esp, [esp + 3]
lea esp, [esp + 0xc]
popal
mov dword [ebx], edi
pop ebx
mov edi, 0x3211999a
jmp 0x980859
shr edi, 0x18
pushal
call fcn.00980893
ret 0xf25c
lea esp, [esp + 3]
sub esp, 0xe
jmp 0x980880

Function at 0x9808cd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x980919
and ebx, ecx
lea esp, [esp + 0x58]
xor edi, dword [ebx*4 + 0x95e4a8]
jmp 0x9808fd
movzx ebx, byte [esi + 6]
sub esp, 2
sub esp, 0xc
pop word [esp + 1]
pop word [esp + 3]
jmp 0x9809a0
mov edi, dword [edi*4 + 0x95dca8]
pushal
jmp 0x9808cf
mov word [esp], di
bswap ebx
mov word [esp], di
jmp 0x980940
and ebx, ecx
lea esp, [esp + 8]
xor edi, dword [ebx*4 + 0x95e0a8]
push edx
jmp 0x980958
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + 0x95d8a8]
jmp 0x980973
Function at 0x980a71
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x980a8b
lea esp, [esp + 2]
jmp 0x980a69
and ebx, ecx
call 0x980a71
mov byte [ebp + 0x333c2464], cl
cmp al, 0x9d
test al, 0xe4
xchg ebp, eax
add byte [esi - 0x75], ah
sbb al, 0x24
jmp 0x980af3
lea esp, [esp + 1]
mov edi, dword [edi*4 + 0x95dca8]
sub esp, 0x14
push word [esp + 7]
push edx
jmp 0x980a50
mov ebx, dword [ebx*4 + 0x95d8a8]
push edx
sub esp, 0x1c
pop dword [esp + 8]
jmp 0x980b02
movzx ebx, byte [esi + 0xa]
push edx
mov byte [esp + 2], ch
mov word [esp], dx
jmp 0x980adb
and ebx, ecx
sub esp, 0x12
lea esp, [esp + 7]
add esp, 1
lea esp, [esp + 1]
jmp 0x980d1d
lea esp, [esp + 1]
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + 0x95e0a8]
lea ebx, [ebx*4]

Function at 0x980b2b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edx, dword [edx*4 + 0x95d8a8]
cmc
push esp
jmp 0x980b3a
and edx, ecx
stc
sub esp, 6
clc
stc
jmp 0x980b7e
lea esp, [esp + 2]
lea esp, [esp + 0x14]
xor edi, dword [edx*4 + 0x95e8a8]
lea edx, [eax - 0xa9]
mov dh, 0xe6
jmp 0x980b5b

Function at 0x980ef8
Capabilities:
Encrypt data using aes

Disassembly:
stc
lea esp, [esp + 1]
jmp 0x980a14
cmc
mov edx, dword [edx*4 + 0x95d8a8]
pushal
add esp, 0xb
mov word [esp + 5], sp
jmp 0x9807cf
movzx ebx, byte [esi + 5]
clc
and edx, ecx
clc
jmp 0x9807e6
xor edi, dword [ebx*4 + 0x95e0a8]
sub bx, 0xb96e
btr ebx, edx
or ebx, esi
neg bl
jmp 0x9807fd
and ebx, ecx
push edx
push dword [esp]
lea esp, [esp + 0x2c]
jmp 0x980819
push ebx
pushal
mov dword [esp + 0x10], esi
call fcn.009808c4
lea esp, [esp + 4]
movzx ebx, byte [esi + 9]
push esp
lea esp, [esp + 3]
pushal
jmp 0x980983
lea esp, [esp + 1]
and edx, ecx
stc
stc
jmp 0x9809e5
mov dh, bh
inc dh
mov edx, 0xce4a22e
mov edx, dword [esi + 4]
jmp 0x980935
mov byte [esp + 0x11], ah
jmp 0x9809f2
mov edx, dword [edx*4 + 0x95d8a8]
and edx, ecx
stc
pushal
jmp 0x9809cd
lea esp, [esp + 0x40]
xor edi, dword [edx*4 + 0x95e8a8]
mov edx, dword [esi + 8]
cmc
jmp 0x980e5f
and edx, ecx
clc
lea esp, [esp + 0x14]
xor edi, dword [edx*4 + 0x95e8a8]
jmp 0x9809bc
lea esi, [esi*4]
lea esi, [esi + 0x95d8a8]
mov edi, dword [esi]
pop esi
sub esp, 2
mov byte [esp], dh
call fcn.00980a67
in eax, 0x14
xchg dword [esi], ebp
cmc
push esi
mov esi, edi
jmp 0x980ab6
mov dword [esp + 7], eax
mov word [esp + 2], sp
lea esp, [esp + 2]
shr edi, 0x18
clc
jmp 0x980ad5
not di
mov ebx, dword [ebx*4 + 0x95d8a8]
mov edi, edx
sub esp, 0xe
jmp 0x980b18
sub esp, 0x12
lea esp, [esp + 7]
lea esp, [esp + 3]
mov dword [esi + 4], edi
not di
jmp 0x980e36
jmp 0x980833

Function at 0xa350d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa35166
lea esp, [esp + 2]
lea esp, [esp + 0x28]
push reloc.KERNEL32.dll_GetModuleHandleA
mov dword [esp], esi
push dword [esp]
mov word [esp + 4], di
pushal
pop word [esp + 0x1f]
push dword [esp + 0xc]
jmp 0xa350dd
Function at 0xa351e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa351f6
xchg bh, cl
xchg word [esp], ax
mov di, word [esp + 2]
jmp 0xa353db
lea esi, [edi + ebp]
lea ebp, [edi*4]
lea esp, [esp + 3]
popal
call fcn.00a3529d
mov bl, 0x60
rdtsc
lea esp, [esp + 3]
mov cx, word [esp]
cpuid
lea esi, [eax + ebx]
jmp 0xa352ee
lea eax, [eax - 0xe9]
rdtsc
lea esp, [esp + 5]
lea ecx, [ebx*4]
push dword [esp]
pop bp
jmp 0xa3533f

Function at 0xa5c36c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], di
pop dword [esp]
mov dword [esp], eax
call fcn.00a5c399

Function at 0xa65fa3
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00a649ab
mov edi, dword [esp + 0x5f]
lea esp, [esp + 0x64]
jmp 0xa65f7b
lea edi, [ebx + ebp]
lea edi, [eax*4]
push word [esp + 1]
pop dword [esp + 0x10]
mov di, word [esp + 0x16]
lea esp, [esp + 2]
jmp 0xa65f44
xchg dword [esp], ebx
pushfd
add ebx, 0x8cfe4885
jmp 0xa65f8b
push eax
jmp 0xa649a6
lea edi, [ebp*4]
mov edi, 0xbdc08394
pushal
jmp 0xa65f5d

Function at 0xa6be88
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 0x10]
jmp fcn.004019cd

Function at 0xa6d3e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, 0xbc
xchg edi, ebx
xchg edx, eax
pushal
jmp 0xa6d3c7

Function at 0xa75f7a
Capabilities:
Packed with generic packer

Disassembly:
popal
call fcn.00a75fa5
fisttp word [edi - 0x21]
mov edx, 0xe077e249
jbe 0xa75f82
loopne 0xa75fbc
mov ebx, dword [0x9327d48d]
in al, dx
lea esp, [esp + 3]
lea esp, [esp + 0x18]
jmp 0xa75f61

Function at 0xa7648b
Capabilities:
Packed with generic packer

Disassembly:
not ax
pop edx
mov al, byte [esp]
jmp 0xa76498
lea eax, [eax*4]
mov esi, 0x86d87c22
mov bx, dx
mov di, sp
mov bl, byte [esp]
jmp 0xa764c5
mov cx, 0x2715
mov eax, 0x6adf52cc
not cx
mov cl, 0x52
xchg dx, di
xchg ah, bl
jmp 0xa76572
pop word [esp + 0x13]
push word [esp + 3]
push edx
pop word [esp + 0xf]
mov byte [esp + 0x10], bh
push word [esp + 0x21]
jmp 0xa7655b
mov di, word [esp]
mov ax, 0x9367
rdtsc
setno dh
popal
pushal
jmp 0xa764ea
cpuid
mov bl, byte [esp]
lea ecx, [esi + edi]
lea edi, [ebx*4]
mov cx, 0x320b
bswap eax
jmp 0xa7650c
lea esp, [esp + 0xc]
pop word [esp]
lea esp, [esp + 3]
jmp fcn.00405de8
mov word [esp + 0x14], bx
lea esp, [esp + 0xd]
pop word [esp]
pop dword [esp]
jmp 0xa76544
lea esi, [ecx + 0x6b03d0cb]
setle ch
mov ebx, ecx
mov edi, 0xcc762b7c
mov dl, 0xc4
lea ebx, [ecx*4]
jmp 0xa7652d

Function at 0xa7960a
Capabilities:
Packed with generic packer

Disassembly:
pop dword [esp + 0xd]
lea esp, [esp + 3]
jmp 0xa79f4c
lea esp, [esp + 0x10]
pushal
bswap ecx
mov bl, bh
lea ebp, [ebp + 0x173e0957]
mov ebx, 0xbb40bae2
jmp 0xa79e57
Function at 0xaa00f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebp - 0x3f]
mov dx, 0xf67
not bx
mov ebp, 0x58920216
jmp 0xaa0047
mov ch, byte [esp + 0x14]
xchg dword [esp + 0xe], ebp
lea esi, [ebx*4]
mov edi, 0x42eb187e
cpuid
pushal
jmp 0xa9fffa
mov dx, 0xe02f
xchg word [esp + 0x26], dx
mov si, 0xf4b
mov dword [esp + 0x1f], esi
add esp, 0x2e
jmp 0xaa009e
lea edx, [edx*4]
lea esi, [esi - 0x7d]
pop ebx
cpuid
mov ax, di
jmp 0xaa002c
lea eax, [ebx + edi]
bsf cx, si
mov ch, byte [esp + 5]
push dword [esp + 7]
clc
rdtsc
jmp 0xaa0013
rdtsc
xchg byte [esp], dl
bswap ebp
mov bl, 0xa0
mov ecx, esi
lea ecx, [ebx + ebx]
jmp 0xaa0088
pushal
push dword [esp + 0x18]
mov byte [esp + 1], ah
mov ch, byte [esp + 9]
inc cx
jmp 0xaa00d4
btc edi, edi
lea edx, [ebp + 0xcf]
xchg bx, cx
xchg edx, ecx
lea edx, [ebx*4]
lea edi, [esp + edi]
jmp 0xaa0074
pop ax
setno ah
mov edi, ecx
xchg word [esp + 0x14], si
call fcn.00aa0346
pop dword [esp + 0x19]
xchg dword [esp + 0x1b], ebp
mov dx, 0x48d1
bswap ebx
setp ch
lea ecx, [edx*4]
jmp 0xaa00b8
jmp 0xaa0060

Function at 0xaa0602
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xaa16aa
mov bx, di
inc edx
mov di, word [esp + 2]
mov ebp, dword [esp + 3]
xchg ebp, ecx
add esp, 5
jmp 0xaa0f6b
sub esp, 0x16
pop edi
xchg word [esp + 5], dx
cpuid
pop dword [esp]
btr eax, esp
jmp 0xaa0669
mov ebp, ecx
mov byte [esp + 1], dh
btc ebp, ebx
mov cl, ch
xchg word [esp + 3], di
and ebp, ecx
jmp 0xaa068b
shl si, cl
pop bp
rol si, cl
push dword [esp + 6]
pop dword [esp]
xchg word [esp + 4], dx
jmp 0xaa06b8
bswap esi
push word [esp + 2]
mov si, 0xdb8f
xchg ah, bl
mov byte [esp + 7], ch
cpuid
jmp 0xaa0759
cpuid
lea ecx, [esp + esi]
mov edi, 0x14ee5ff6
lea ebp, [edi + edi]
mov di, word [esp]
xchg dword [esp], eax
jmp 0xaa0f44
pop word [esp + 9]
not dx
bsr cx, cx
xchg byte [esp + 6], dl
mov byte [esp + 9], ch
mov edx, eax
jmp 0xaa0607

Function at 0xaa0fee
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push eax
jmp 0xa9e063
call fcn.00a9e068
call 0xaa00ce
jmp 0xaa108b
movzx ebx, word [eax + 0x3c]
jmp 0xaa10b9
push esp
lea esp, [esp + 1]
jmp 0xaa1035
pop dword [esp + 0x12]
pop dword [esp + 1]
lea esp, [esp + 3]
mov dword [esp + 0xa8], edi
jmp 0xaa10a7
mov dword [esp + 0x98], esi
pushal
lea esp, [esp + 1]
mov word [esp + 0x1c], di
jmp 0xaa101a
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xaa10db
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0xaa10f7
lea esp, [esp + 0xa8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xaa1081
add ebx, eax
cmp word [ebx], 0x4550
je 0xa9deac
jne 0xaa10fd
add ecx, dword [ebx + 0x628d7e1b]
stosd dword es:[edi], eax
sub al, 0xa2
lds esi, [esp + edx*8]
mov edi, 0x3bc8a939
xlatb
cwde
push eax
jmp 0xaa00c9
je 0xaa010b
sub eax, 0x10000
jmp 0xaa108f
Function at 0x40cdf0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46e5db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00462de7
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40ce72
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00460aa7
mov eax, dword [eax]
push 0x48d1d0
push eax
call fcn.00453014
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00463072
test bl, bl
je 0x40ce72
push 0x48d1d0
lea ecx, [esp + 0xc]
call fcn.00463402
push 0x490d20
lea ecx, [esp + 0xc]
call fcn.00463402
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40ceae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00463072
jmp 0x40cf79
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40cf32
lea edx, [esp + 0x7c]
push 0x490d1c
push edx
call fcn.00453014
add esp, 8
test eax, eax
je 0x40cf32
lea eax, [esp + 0x7c]
push 0x490d18
push eax
call fcn.00453014
add esp, 8
test eax, eax
je 0x40cf32
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40cec2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00463072
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40d770
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40d7d2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40d7e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46e65b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x497500]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40d918
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40d846
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00463072
xor eax, eax
jmp 0x40d98f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004631af
push esi
lea ecx, [esp + 0xc]
call fcn.0046343e
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40d96d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push 0x80000000
call fcn.0040d770
test eax, eax
jne 0x40d96d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x80000000
mov ecx, edi
call fcn.0040d770
test eax, eax
jne 0x40d96d
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.00454120
mov esi, eax
add esp, 8
test esi, esi
jne 0x40d94c
lea ecx, [esp + 0x14]
push 0x490d30
push ecx
call fcn.004540a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40d94c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40d94f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046315f
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40d85e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00463072
xor eax, eax
jmp 0x40d98f
mov byte [esi], 0
push 0x490d2c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00463072
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41e260
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41e2ce
cmp si, 0x69
ja 0x41e2ce
add esi, 0xffd0
cmp si, 0x11
je 0x41e29e
push 0x11
call edi
test ax, ax
jge 0x41e29e
or esi, 0x2000
cmp si, 0x10
je 0x41e2b3
push 0x10
call edi
test ax, ax
jge 0x41e2b3
or esi, 0x4000
cmp si, 0x12
je 0x41e2c8
push 0x12
call edi
test ax, ax
jge 0x41e2c8
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41e2db
mov esi, 0xbd
jmp 0x41e28f
cmp si, 0x6e
jne 0x41e2e8
mov esi, 0xbe
jmp 0x41e28f
cmp si, 0x6f
jne 0x41e289
mov esi, 0xbf
jmp 0x41e28f

Function at 0x41f980
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4a7c10]
xor edx, edx
cmp eax, edx
jne 0x41f9a6
xor eax, eax
mov byte [eax + 0x4a7b10], al
inc eax
cmp eax, 0x100
jl 0x41f98e
mov dword [0x4a7c10], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4a7b10
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41fa37
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41fa0a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41f9d8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41fab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41fb03
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41faea
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret