joyce8/EMBER2024-capa huggingface dataset:
Function at 0x96b250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x97f808
push 0x96f288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x96b329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x96b329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0096e1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x96b329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x96b329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x96b32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0096b351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x96bd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x96bd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x96bd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x96bd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x96bd94
push eax
push esi
call fcn.0096e20b
add esp, 8
pop esi
ret 0x10

Function at 0x96bda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x96be22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x96be15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x984320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0096ddff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x96bdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x96be30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x96bec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x96beb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x984320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0096ddff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x96beab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x96be6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x96c000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x96c131
push esi
call fcn.0096f145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0095e080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x96c131
push 0
push ebp
call fcn.0095e3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0095e260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x96c08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0095e2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x96c121
push 0x984918
push edi
call fcn.0096d3f0
push eax
push ebx
push esi
call fcn.0096bf60
push 0x9848f8
push edi
call fcn.0096d3f0
push eax
push ebx
push esi
call fcn.0096bf60
push 0x9848d8
push edi
call fcn.0096d3f0
push eax
push ebx
push esi
call fcn.0096bf60
push 0x9848c0
push edi
call fcn.0096d3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0096bf60
push 0x9848a0
push edi
call fcn.0096d3f0
push eax
push ebx
push esi
call fcn.0096bf60
push 0x984888
push edi
call fcn.0096d3f0
push eax
push ebx
push esi
call fcn.0096bf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x96d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0096d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0096d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0096d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0096d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x96dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x96dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x97f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x96dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x96dc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x438cbe
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x438a14
pop eax
or esi, esi
call fcn.00438cf9
sub edx, 0xcea7a204
or edx, edx
xor dword [ebx], eax
inc edx
sub edx, 0xd7166bfa
add edx, esi
inc ebx
sub edx, esi
cmp ebx, edi
jne fcn.00438cbe
push esi
pop esi
sub edx, 0x5bd0f40a
sub edx, edx
ret
Function at 0x88c000
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1d6000]
push edi
or ebp, 0xffffffff
jmp 0x88c022
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x88c029
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x88c018
mov eax, 1
add ebx, ebx
jne 0x88c03b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x88c04c
jne 0x88c06b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x88c06b
dec eax
add ebx, ebx
jne 0x88c058
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x88c030
add ebx, ebx
jne 0x88c067
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x88c0bd
xor ecx, ecx
sub eax, 3
jb 0x88c083
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x88c0f2
sar eax, 1
mov ebp, eax
jmp 0x88c08e
add ebx, ebx
jne 0x88c08e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x88c05c
inc ecx
add ebx, ebx
jne 0x88c09c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x88c05c
add ebx, ebx
jne 0x88c0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x88c09e
jne 0x88c0ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x88c09e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x88c0dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x88c0ce
jmp 0x88c01e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x88c0dc
add edi, ecx
jmp 0x88c01e
pop esi
mov edi, esi
mov ecx, 0x6997
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x88c0fa
cmp byte [edi], 0xa
jne 0x88c0fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x88c0ff
lea edi, [esi + 0x483000]
mov eax, dword [edi]
or eax, eax
je 0x88c177
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x490b94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x490cd4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x88c12c
mov ecx, edi
jns 0x88c15b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x490cd8]
or eax, eax
je 0x88c171
mov dword [ebx], eax
add ebx, 4
jmp 0x88c149
call dword [esi + 0x490ce8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x88c1a8
cmp al, 0xef
ja 0x88c19b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x88c17d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x88c18a
mov ebp, dword [esi + 0x490cdc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x88c1dc
sub esp, 0xffffff80
jmp 0x4aebc0
Function at 0x5e15df
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
or eax, 0x94e87df3
or byte [ebx], dl
in eax, dx
mov dword [ebp + 0x7e], esp
call 0xa3554284
add byte [ebx + 0x22], dh
call 0xe8d98577
adc al, 0xf3
cmp cl, byte [edi]
add eax, 0x941d62c7
pop es
inc edx
in eax, dx
mov byte [esi + 0x7e], bl
call 0xcd8088a0
jmp [edi + 0x72]
lodsd eax, dword [esi]
sub eax, 0x2f1d6627
out 0x22, al
invalid
inc edi
xor dword [edx - 0x18], esp
adc al, 0xf3
jge 0x5e155f
mov esi, dword [ecx]
bound ebp, qword [edi]
push edx
out dx, al
jge 0x5e159b
invalid
mov ebx, 0x13fcd18d
in al, dx
bnd jge 0x5e15d0
invalid
mov ah, 0xaf
clc
inc ebx
cli
invalid

Function at 0x5e19a4
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebx + 0x7e], esp
call 0x1a46e1a4
das
inc ecx
insb byte es:[edi], dx
adc byte [edi - 0x76e29d35], al
jbe 0x5e1a07
adc al, 0xf3
jge 0x5e1988
dec ebp
mov ah, 0x8d
call 0x61b68741
cdq
insd dword es:[edi], dx
pop eax
popal
cdq
insd dword es:[edi], dx
pop eax
popal
and dl, dh
imul byte [edx - 0x12428df4]
mov byte [ecx], cl
jle 0x5e199c
adc al, 0x7c
cli
pop esi
test al, 0x3c
nop
imul edx, dword [edi + esi*8 - 7], 0xffffffcc
adc al, 0xf3
jge 0x5e1a33
leave
retf 0xe7f6
call 0x65550d20
cmp eax, 0x89f23852
jbe 0x5e1a80
bound esp, qword [esi + 0x7e]
call 0x234b8ba9
das
invalid
fst qword [eax + edi*8]
stc
in eax, 0x14
jge 0x5e1a88
sub eax, 0x2f1d62b5
xchg edx, eax
invalid
xchg esp, eax
pop es
inc edx
in eax, dx
mov byte [edi + 0x7e], bl
call 0xcd808d68
jmp [edi + 0x73]
movsb byte es:[edi], byte [esi]
invalid
sub al, 0x8a
pushal
sbb eax, 0x69bd712f
mov dword [esi], esi
popal
sbb eax, 0xf0f8f72f
adc al, 0xf3
jge 0x5e1aa7
das
jno 0x5e1a48
imul ecx, dword [ecx + 0x2f1d6136], 0x14f0f8f7
jge 0x5e1aa7
push es
jge 0x5e1a84
mov esi, dword [ecx - 0x13]
and ch, byte [edi]
invalid
sbb al, 0x2f
invalid
Function at 0x5e19f6
Capabilities:
Encode data using xor

Disassembly:
dec eax
outsd dx, dword [esi]
sub ebp, esp
push ecx
js 0x5e1a0f
jge 0x5e1a69
leave
out dx, al
clc
daa
jmp [edi - 0x63]
mov dword [esi], esp
jbe 0x5e1a80
xor al, 0xc7
bound ebx, qword [0x737def46]
out dx, eax
jge 0x5e1adf
mov dword [edx + 0x61], eax
sbb eax, 0x6843a72f
mov esp, 0xf46c7366
jge 0x5e1a64
stosb byte es:[edi], al
hlt
daa
in al, dx
into
rcr dword [edi + ebp], cl
sub dword [ebx + 0x51], esi
hlt
mov dword [esi], esp
jbe 0x5e1b34
mov edi, 0x8be87e66
xor dword [esi + 0x73], esi
aam 0x6a
cmc
stosb byte es:[edi], al
cld
lahf
bound ebx, qword [ebx + 0x1fe8c7f8]
sub al, 0xa9
push 0xf8a72f1d
daa
sbb eax, 0x27f8a72f
push dword [edx + 0x14]
call 0x1da90e00
jns 0x5e1ab0
bound ebx, qword [ebx + 0x1b88cefc]
das
mov dword [edx + 0x6b], 0x3f8f754
adc al, 0xf3
jge 0x5e1b1d
jns 0x5e1ac4
push ebp
cmp edi, edi
jge 0x5e1b2d
leave
ret 0xe87d
push ebx
jge 0x5e1aa3
mov esi, dword [ecx]
push 0x2f
xor dword [edx + 0x2f], ebp
push edx
out dx, al
jge 0x5e1adf
invalid
jle 0x5e1b18
adc al, 0x7c
cmp al, dh
mov esp, dword [esi - 0x8ab9487]
stc
popal
adc al, 0xf3
jge 0x5e1ba9
leave
out dx, al
mul byte [edi - 0x12428d28]
mov dword [edx + 0x7e], eax
call 0xf0969764
mov esp, dword [esi - 0x16a7987]
xor byte [edx - 0x18218d01], bh
adc al, 0xf3
idiv byte [edi + 0x67c666f0]
mov esp, 0x14e83896
clc
clc
mov cl, 0x14
jge 0x5e1bd9
pushfd
add dh, ch
ret 0x7bf8
clc
invalid
adc al, 0x13
jle 0x5e1b88
das
inc ecx
mov dl, byte [eax + ecx*8]
or bl, dl
jmp 0x5e1bc4
sbb dl, byte [eax + 0x762689bd]
insb byte es:[edi], dx
add ebx, esi
jge 0x5e1b9c
mov ebp, dword [ecx + 0x62d36f75]
mov ebx, 0x7e6504ab
call 0xab5561d8
add al, 0xad
mov edi, 0xf4a214ec
or dl, byte [ebx + 0x478889da]
xor dword [edx - 0x18], edx
adc al, 0xf3
jge 0x5e1c41
leave
out dx, al
idiv byte [edi + 0x1c406ed8]
mov esp, dword [esi + 0xa9c6979]
jge 0x5e1c28
lea esi, [ecx]
outsb dx, byte [esi]
imul edx, esp, 0xfcaaf4a2
lahf
xlatb
jmp 0x5e1ba1
das
fild word [eax]
add al, 0xe1
popal
inc ebx
imul edx, dword [edi + esi*8 - 7], 0xffffffe4
adc al, 0xf3
jge 0x5e1c5d
leave
fidivr dword [eax + ebp*8 + 0x14]
fsubr qword [eax - 0x37]
fidiv dword [edx + 0x6f48f308]
sub dword [ebx + 0x51], esi
clc
mov ah, 0x7b
cmp al, dh
mov ebx, dword [esi - 0x412e9077]
mul byte [edi + 0x1c386e08]
mov ebx, dword [esi + 0x791ce721]
sahf
and edi, esp
sbb al, 0x79
inc ebp
add byte [eax], al
xor byte [0x72bc15fc], 0x55
int3

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x668ed0
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00668f4f
jae 0x668edc
xor ecx, ecx
call fcn.00668f4f
jae 0x668f06
xor eax, eax
call fcn.00668f4f
jae 0x668f17
mov al, 0x10
call fcn.00668f4f
adc al, al
jae 0x668ef8
jne 0x668f44
stosb byte es:[edi], al
jmp 0x668edd
call fcn.00668f5b
dec ecx
loop 0x668f23
mov eax, ebp
call fcn.00668f59
jmp 0x668f45
lodsb al, byte [esi]
shr eax, 1
je 0x668f6b
adc ecx, 2
mov ebp, eax
jmp 0x668f45
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00668f59
cmp eax, 0x7d00
jae 0x668f43
cmp eax, 0x500
jae 0x668f44
cmp eax, 0x7f
ja 0x668f45
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x668edd
pop ebp
ret 8
Function at 0x401970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16420
call fcn.00442e60
mov eax, dword [0x479d28]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1641c], 0
mov dword [ebp - 0x16418], 0
mov dword [ebp - 0xb20c], 0
mov dword [ebp - 0xb20c], 0
jmp 0x4019c0
mov eax, dword [ebp - 0xb20c]
add eax, 1
mov dword [ebp - 0xb20c], eax
cmp dword [ebp - 0xb20c], 0xb1fb
jge 0x4019fe
mov ecx, dword [ebp - 0xb20c]
mov dl, byte [ebp - 0xb20c]
mov byte [ebp + ecx - 0x16410], dl
mov eax, dword [ebp - 0xb20c]
cdq
idiv dword [ebp + 0x14]
mov eax, dword [ebp - 0xb20c]
mov ecx, dword [ebp + 0x10]
mov dl, byte [ecx + edx]
mov byte [ebp + eax - 0xb208], dl
jmp 0x4019b1
mov dword [ebp - 0xb20c], 0
jmp 0x401a19
mov eax, dword [ebp - 0xb20c]
add eax, 1
mov dword [ebp - 0xb20c], eax
cmp dword [ebp - 0xb20c], 0xb1fb
jge 0x401a9c
mov ecx, dword [ebp - 0xb20c]
movzx eax, byte [ebp + ecx - 0x16410]
add eax, dword [ebp - 0x1641c]
mov edx, dword [ebp - 0xb20c]
movzx ecx, byte [ebp + edx - 0xb208]
add eax, ecx
cdq
mov ecx, 0xb1fb
idiv ecx
mov dword [ebp - 0x1641c], edx
mov edx, dword [ebp - 0x1641c]
mov al, byte [ebp + edx - 0x16410]
mov byte [ebp - 0x16411], al
mov ecx, dword [ebp - 0x1641c]
mov edx, dword [ebp - 0xb20c]
mov al, byte [ebp + edx - 0x16410]
mov byte [ebp + ecx - 0x16410], al
mov ecx, dword [ebp - 0xb20c]
mov dl, byte [ebp - 0x16411]
mov byte [ebp + ecx - 0x16410], dl
jmp 0x401a0a
mov dword [ebp - 0x1641c], 0
mov dword [ebp - 0x16420], 0
jmp 0x401ac1
mov eax, dword [ebp - 0x16420]
add eax, 1
mov dword [ebp - 0x16420], eax
mov ecx, dword [ebp - 0x16420]
cmp ecx, dword [ebp + 0xc]
jge 0x401bbf
mov eax, dword [ebp - 0xb20c]
add eax, 1
cdq
mov ecx, 0xb1fb
idiv ecx
mov dword [ebp - 0xb20c], edx
mov edx, dword [ebp - 0xb20c]
movzx eax, byte [ebp + edx - 0x16410]
add eax, dword [ebp - 0x1641c]
cdq
mov ecx, 0xb1fb
idiv ecx
mov dword [ebp - 0x1641c], edx
mov edx, dword [ebp - 0x1641c]
mov al, byte [ebp + edx - 0x16410]
mov byte [ebp - 0x16411], al
mov ecx, dword [ebp - 0x1641c]
mov edx, dword [ebp - 0xb20c]
mov al, byte [ebp + edx - 0x16410]
mov byte [ebp + ecx - 0x16410], al
mov ecx, dword [ebp - 0xb20c]
mov dl, byte [ebp - 0x16411]
mov byte [ebp + ecx - 0x16410], dl
mov eax, dword [ebp - 0xb20c]
movzx eax, byte [ebp + eax - 0x16410]
mov ecx, dword [ebp - 0x1641c]
movzx edx, byte [ebp + ecx - 0x16410]
add eax, edx
cdq
mov ecx, 0xb1fb
idiv ecx
mov dword [ebp - 0x16418], edx
push 0x408d40
push str.i83h5L2N301W31B0E2duB65c6oxlhPbcW6kqN6zEUFvWkFeESfHnXwFMu6T
push 0x47dee0
call fcn.004058f0
add esp, 8
mov ecx, eax
call fcn.00403b90
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x16420]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x16418]
movzx edx, byte [ebp + ecx - 0x16410]
xor eax, edx
mov ecx, dword [ebp + 0x18]
add ecx, dword [ebp - 0x16420]
mov byte [ecx], al
jmp 0x401ab2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442a34
mov esp, ebp
pop ebp
ret
Function at 0x40e7c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e575
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x479d28]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0x64
call fcn.00403b70
movzx eax, al
test eax, eax
je 0x40e8a9
mov ecx, dword [ebp - 0x20]
add ecx, 0x60
call fcn.00403b70
movzx ecx, al
test ecx, ecx
je 0x40e819
mov dword [ebp - 0x24], 0
jmp 0x40e827
mov ecx, dword [ebp - 0x20]
add ecx, 0x60
call fcn.00411200
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x70]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x20]
add ecx, 0x6c
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x20]
add eax, 0x68
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.0040e9e0
add esp, 0xc
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040e9e0
add esp, 0xc
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.00411200
push eax
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x14]
call fcn.004014d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004014d0
jmp 0x40e959
mov ecx, dword [ebp - 0x20]
add ecx, 0x60
call fcn.00403b70
movzx edx, al
test edx, edx
je 0x40e8c4
mov dword [ebp - 0x34], 0
jmp 0x40e8d2
mov ecx, dword [ebp - 0x20]
add ecx, 0x60
call fcn.00411200
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x70]
push ecx
push 0
mov edx, dword [ebp - 0x20]
add edx, 0x6c
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x68
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.0040e9e0
add esp, 0xc
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.0040e9e0
add esp, 0xc
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
call fcn.00411200
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x64
call fcn.00411200
push eax
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x1c]
call fcn.004014d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004014d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x415d10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x415d2d
xor eax, eax
jmp 0x415db7
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x415d40
xor eax, eax
jmp 0x415db7
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0x194]
call eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x415d65
xor eax, eax
jmp 0x415db7
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
call eax
movzx ecx, al
test ecx, ecx
je 0x415d91
xor eax, eax
jmp 0x415db7
movzx edx, byte [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0xc]
call edx
mov esp, ebp
pop ebp
ret 0x14