joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a800
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc
push esi
push edi
mov esi, edx
call fcn.00542c90
mov edi, eax
test edi, edi
mov dword [esp + 0xc], edi
je 0x42aa40
push ebp
push 0x180
push 0x40
push 0x4301
push esi
call fcn.0057f36a
mov ebp, eax
add esp, 0x10
test ebp, ebp
jge 0x42a844
xor ecx, ecx
call fcn.0041d520
pop ebp
pop edi
pop esi
add esp, 0xc
ret
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x180
mov dword [esp + 0x18], eax
mov eax, dword [edi]
push 0x5aa640
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor edx, edx
mov ecx, 0x57c
call fcn.0041d620
push eax
push 0x5aa640
call fcn.00570b40
add esp, 8
test eax, eax
mov dword [esp + 0xc], eax
je 0x42a8c1
add eax, 4
mov ecx, eax
mov dword [esp + 0xc], eax
lea esi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x42a8a0
sub ecx, esi
push ecx
push eax
push ebp
call fcn.0057ad94
push 1
push 0x58445c
push ebp
call fcn.0057ad94
add esp, 0x18
mov edx, dword [edi + 0x874]
push ebx
lea ecx, [esp + 0x10]
push ecx
xor ebx, ebx
push ebx
push 0x189
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x42aa2a
jmp 0x42a8f0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42aa2a
mov edx, 0x5aa640
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x42a903
cmp byte [0x5aa640], 0x20
mov eax, 0x5aa640
mov dword [esp + 0x10], eax
jne 0x42a92a
nop
inc eax
mov dword [esp + 0x10], eax
cmp byte [eax], 0x20
je 0x42a920
cmp byte [eax], 0
je 0x42aa08
push 9
push eax
call fcn.00570260
mov esi, eax
add esp, 8
test esi, esi
je 0x42aa08
mov byte [esi], 0
mov edx, dword [esp + 0x10]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a954
sub eax, edi
push eax
push edx
push ebp
call fcn.0057ad94
mov al, byte [esi + 1]
add esp, 0xc
inc esi
test al, al
je 0x42a9f4
push 9
push esi
mov dword [esp + 0x18], esi
call fcn.00570260
mov esi, eax
add esp, 8
test esi, esi
je 0x42a98c
mov byte [esi], 0
push 1
push 0x5842b8
push ebp
call fcn.0057ad94
mov edx, dword [esp + 0x1c]
mov eax, edx
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a9a5
sub eax, edi
push eax
push edx
push ebp
call fcn.0057ad94
add esp, 0xc
test esi, esi
je 0x42a9f4
mov al, byte [esi + 1]
inc esi
test al, al
je 0x42a9f4
push 1
push 0x5842b8
push ebp
call fcn.0057ad94
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a9e0
sub eax, edx
push eax
push esi
push ebp
call fcn.0057ad94
add esp, 0xc
push 1
push 0x58445c
push ebp
call fcn.0057ad94
mov edi, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [edi + 0x874]
lea eax, [esp + 0x10]
push eax
inc ebx
push ebx
push 0x189
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x42a8f0
push ebp
call fcn.00577b9f
mov edx, dword [esp + 0x1c]
add esp, 4
push edx
call dword [sym.imp.USER32.dll_SetCursor]
pop ebx
pop ebp
pop edi
pop esi
add esp, 0xc
ret
Function at 0x42af20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3f0
push esi
mov esi, ecx
call fcn.004e2760
test eax, eax
je 0x42b137
mov eax, dword [esi + 0x1914]
push ebx
xor ebx, ebx
push ebp
xor ebp, ebp
cmp eax, ebx
push edi
mov dword [esi + 0x1918], 2
mov dword [esi + 0x1a34], ebx
mov dword [esi + 0x1c58], ebx
mov dword [esi + 0x1c5c], ebx
mov dword [esi + 0x1a28], ebx
mov dword [esi + 0x1a2c], ebx
mov dword [esi + 0x1a30], ebx
jne 0x42af92
push esi
push ebx
push ebx
mov edx, 4
mov ecx, 0x584af8
call fcn.00548f10
mov dword [esi + 0x1914], eax
mov ebp, 1
mov ecx, dword [esi + 0x1914]
call fcn.00542c90
mov edi, eax
cmp edi, ebx
je 0x42b134
mov eax, dword [edi + 0x874]
push ebx
push ebx
push 0x184
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [edi + 0x6cc]
call fcn.004c8280
lea ecx, [edi + 0x6b8]
mov dword [esp + 0x10], ecx
call fcn.004c8280
cmp ebp, ebx
je 0x42afe5
mov ecx, dword [edi]
mov edx, 4
call fcn.004973e0
mov ecx, dword [edi]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x42afff
mov edx, dword [edi]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x42b00c
mov ecx, edi
mov dword [edi + 0x710], ebx
call fcn.00527d80
xor edx, edx
mov ecx, 0xdd0
call fcn.0041d620
push eax
mov eax, dword [edi]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, dword [0x5a5504]
mov ecx, dword [esi]
call fcn.00502b10
mov ecx, dword [0x5a550c]
push ecx
xor edx, edx
mov ecx, 0xdd1
call fcn.0041d620
mov ecx, dword [esi]
mov edx, eax
call fcn.00502c40
mov edx, dword [0x5a5504]
mov ecx, dword [esi]
call fcn.00502b10
cmp dword [esi + 0x1920], ebx
je 0x42b134
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esi + 0x1924]
push edx
push 0x5a3900
lea eax, [esp + 0x20]
push 0x583954
push eax
call edi
add esp, 0x10
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x191c], eax
je 0x42b134
push ebx
call fcn.00570bc6
add esp, 4
mov ecx, eax
call fcn.0052d0c0
push eax
lea edx, [esi + 0x1124]
push edx
lea eax, [esp + 0x20]
push 0x584610
push eax
call edi
mov edi, dword [esp + 0x20]
mov ecx, dword [edi]
add esp, 0x10
push ebx
lea edx, [esp + 0x1c]
call fcn.004c7e10
mov dword [edi], eax
lea edi, [esp + 0x18]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x42b0f0
mov cx, word [0x583b70]
mov dl, byte [0x583b72]
mov word [edi], cx
lea eax, [esp + 0x18]
mov byte [edi + 2], dl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x42b112
push ebx
sub eax, edx
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi + 0x191c]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x3f0
ret
Function at 0x42c300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x5a3a04]
test eax, eax
push esi
mov esi, ecx
jne 0x42c31f
call fcn.004e27f0
test eax, eax
je 0x42c31f
mov ecx, dword [eax + 0x1918]
test ecx, ecx
je 0x42c327
xor ecx, ecx
pop esi
jmp fcn.0041d520
test esi, esi
mov ecx, dword [0x5b4314]
jl 0x42c336
cmp esi, 3
jle 0x42c338
xor esi, esi
cmp esi, 1
mov dword [0x5aa5ec], esi
je 0x42c361
mov edx, dword [0x5b4320]
test edx, edx
je 0x42c361
cmp edx, dword [eax + 0x1914]
jne 0x42c361
mov ecx, edx
mov dword [0x5aa5ec], 2
push eax
push 0x42b6c0
mov edx, 0x8c
call fcn.004675d0
mov dword [0x5a3a04], 0
mov dword [0x5aa5ec], 0
pop esi
ret

Function at 0x42c640
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x5a3a48]
sub esp, 0x3e8
test eax, eax
push ebx
push esi
mov ebx, edx
mov esi, ecx
je 0x42c7bc
lea esp, [esp]
cmp esi, eax
je 0x42c679
mov eax, dword [eax + 0x88c]
test eax, eax
jne 0x42c660
pop esi
pop ebx
add esp, 0x3e8
ret 8
mov ecx, dword [esi]
push ebp
call fcn.004e2870
mov ebp, eax
test ebp, ebp
je 0x42c7bb
mov al, byte [esp + 0x3fc]
test al, 1
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x42c6e4
mov eax, dword [esi + 0x540]
test eax, eax
push ebx
je 0x42c6bb
lea eax, [esi + 0x3f0]
push eax
push str.NOTICE__s_:DCC_Fserve___s__n
lea ecx, [esp + 0x1c]
push ecx
jmp 0x42c6cc
lea edx, [esi + 0x3f0]
push edx
push str.NOTICE__s_:DCC_Chat___s__n
lea eax, [esp + 0x1c]
push eax
call edi
add esp, 0x10
push ebp
xor edx, edx
lea ecx, [esp + 0x14]
call fcn.0054b400
mov al, byte [esp + 0x400]
test al, 2
je 0x42c710
movzx ecx, word [esi + 0x51c]
mov edx, dword [esp + 0x3fc]
push ecx
push edx
lea eax, [esi + 0x3f0]
push eax
lea ecx, [esp + 0x1c]
push 0x584b30
push ecx
call edi
add esp, 0x14
jmp 0x42c789
test al, 4
je 0x42c74b
mov edx, dword [esi + 0x52c]
movzx eax, word [esi + 0x51c]
push edx
push eax
lea ecx, [esi + 0x4b8]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_addr]
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
push eax
lea edx, [esi + 0x3f0]
push edx
push 0x584b08
lea eax, [esp + 0x24]
push eax
jmp 0x42c784
test al, 8
je 0x42c795
mov ecx, dword [esi + 0x530]
movzx edx, word [esi + 0x51c]
push ecx
push edx
lea eax, [esi + 0x4b8]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
push eax
lea ecx, [esi + 0x3f0]
push ecx
push 0x584b08
lea edx, [esp + 0x24]
push edx
call edi
add esp, 0x18
lea ecx, [esp + 0x10]
xor edx, edx
push ebp
call fcn.0054b400
mov eax, dword [0x5a5500]
push eax
xor edx, edx
mov ecx, 0x517
mov dword [0x59bcec], 0
call fcn.0041d620
mov ecx, dword [esi]
mov edx, eax
call fcn.00502c40
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x3e8
ret 8
Function at 0x42d500
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x3e8
push esi
push edi
mov edi, edx
test edi, edi
mov esi, ecx
je 0x42d639
cmp byte [edi], 0
je 0x42d639
call fcn.0042c530
test eax, eax
je 0x42d62e
mov edx, 0x3e7
lea ecx, [esp + 8]
call fcn.0041ef30
lea edx, [esp + 8]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x42d540
mov eax, dword [0x5b1218]
test eax, eax
je 0x42d575
mov ecx, dword [esi]
call fcn.00542c90
test eax, eax
je 0x42d575
cmp dword [eax + 0x9e4], 0x80
jne 0x42d575
mov ecx, dword [esi]
lea edx, [esp + 8]
call fcn.0051aad0
lea eax, [esp + 8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d580
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x884]
cmp eax, 0xffffffff
mov dword [esi + 0x878], 0
mov dword [esi + 0x87c], 0
je 0x42d62e
push 0
push edi
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, edi
je 0x42d639
mov eax, dword [esi + 0x540]
test eax, eax
jne 0x42d62e
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x42d619
mov ecx, dword [esi + 0x874]
push 0
lea edx, [esp + 0xc]
call fcn.004c7e10
test eax, eax
je 0x42d5f3
mov dword [esi + 0x874], eax
mov edx, dword [0x5b4314]
mov eax, dword [esi + 0x884]
push 0x23
push 0x801d
push edx
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
pop edi
xor eax, eax
pop esi
add esp, 0x3e8
ret
xor edx, edx
mov ecx, 0x528
call fcn.0041d620
mov edx, eax
mov ecx, esi
call fcn.0042cb60
pop edi
xor eax, eax
pop esi
add esp, 0x3e8
ret
pop edi
mov eax, 1
pop esi
add esp, 0x3e8
ret
Function at 0x42e280
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x3e8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
je 0x42e41c
cmp dword [esi + 0x520], 3
je 0x42e2aa
cmp dword [esi + 0x534], 2
jne 0x42e41c
mov edx, dword [esi + 0x884]
push 1
push 1
mov ecx, 0x801d
mov dword [esi + 0x878], ebx
mov dword [esi + 0x87c], ebx
call fcn.0054c250
test eax, eax
jne 0x42e41c
push ebp
push edi
mov ecx, dword [esi + 0x880]
inc ecx
mov eax, ecx
cmp eax, 0x14
mov dword [esi + 0x880], ecx
jl 0x42e309
mov edx, dword [esi + 0x884]
push ebx
push 1
mov ecx, 0x801d
mov dword [esi + 0x880], ebx
call fcn.0054c250
test eax, eax
jne 0x42e41a
mov ecx, dword [esi + 0x884]
push ebx
push 0x3e6
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x42e3df
cmp edi, ebx
jle 0x42e40e
xor ebp, ebp
cmp edi, ebx
mov byte [esp + edi + 0x10], bl
jle 0x42e3b3
mov edi, edi
mov al, byte [esp + ebp + 0x10]
cmp al, 9
je 0x42e38d
cmp al, 0xd
je 0x42e38d
cmp al, 0xa
jne 0x42e35c
mov edx, dword [esi + 0x3ec]
mov byte [edx + esi + 4], bl
jmp 0x42e380
mov ecx, dword [esi + 0x3ec]
mov byte [ecx + esi + 4], al
mov edx, dword [esi + 0x3ec]
inc edx
mov eax, edx
cmp eax, 0x3b5
mov dword [esi + 0x3ec], edx
jl 0x42e38d
mov byte [eax + esi + 4], bl
mov ecx, esi
mov dword [esi + 0x3ec], ebx
call fcn.0042df30
mov eax, dword [0x5a3a48]
cmp eax, ebx
je 0x42e3b3
cmp esi, eax
je 0x42e3a6
mov eax, dword [eax + 0x88c]
cmp eax, ebx
jne 0x42e396
jmp 0x42e3b3
cmp dword [esi + 0x520], ebx
je 0x42e3b3
inc ebp
cmp ebp, edi
jl 0x42e340
mov eax, dword [0x5a3a48]
cmp eax, ebx
je 0x42e41a
lea esp, [esp]
cmp esi, eax
je 0x42e2d4
mov eax, dword [eax + 0x88c]
cmp eax, ebx
jne 0x42e3c0
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x3e8
ret
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x42e41a
xor edx, edx
mov ecx, 0x527
call fcn.0041d620
mov edx, eax
mov ecx, esi
call fcn.0042cb60
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x3e8
ret
mov edx, 0x583b74
mov ecx, esi
call fcn.0042cb60
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x3e8
ret
Function at 0x42ff30
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, ecx
push 1
mov dword [esi], 0
call edi
test ah, ah
jns 0x42ff4b
or dword [esi], 1
push 2
call edi
test ah, ah
jns 0x42ff56
or dword [esi], 2
push 4
call edi
test ah, ah
jns 0x42ff61
or dword [esi], 0x10
push 0x11
call edi
test ah, ah
jns 0x42ff6c
or dword [esi], 8
push 0x10
call edi
test ah, ah
jns 0x42ff77
or dword [esi], 4
pop edi
pop esi
ret

Function at 0x42ff80
Capabilities:
Log keystrokes via polling

Disassembly:
movzx eax, dx
shr edx, 0x10
cmp ecx, 7
mov dword [0x59b4f8], eax
mov dword [0x59b4fc], edx
mov dword [0x5a40d4], 0
ja 0x42ffa7
mov dword [0x5a40d4], ecx
ret
mov ecx, 0x5a40d4
jmp fcn.0042ff30
Function at 0x435500
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5a5664]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5a5664]
test eax, eax
je 0x43551e
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x5a5664], 0
ret

Function at 0x436720
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5a5664]
test eax, eax
push esi
push edi
mov edi, edx
mov esi, ecx
je 0x436734
pop edi
xor eax, eax
pop esi
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
call ebx
mov eax, dword [0x5a5664]
test eax, eax
je 0x436751
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x435530
push esi
mov dword [0x5a5664], 0
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [0x5b4310]
push 0xb4
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp edi, 1
mov ecx, eax
mov dword [0x5a5664], ecx
jne 0x436791
mov edx, esi
call fcn.004352f0
jmp 0x43679b
mov edx, 0x1e
call fcn.004231d0
mov ecx, dword [0x5a5664]
push 8
push ecx
call ebx
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop ebx
pop edi
mov dword [0x5a5668], esi
mov eax, 1
pop esi
ret
Function at 0x44a450
Capabilities:
Get hostname
Set socket configuration

Disassembly:
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 4]
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, edx
je 0x44a479
cmp byte [eax], 0x2d
jne 0x44a539
push 0x68
push eax
call fcn.00570260
add esp, 8
test eax, eax
je 0x44a4d3
push 0x5a
push edi
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x44a5ee
mov esi, dword [esp + 0x14]
lea ebp, [esi + 0x840]
mov edx, ebp
mov dword [esi + 0x908], ebx
mov byte [esi + 0x8a4], bl
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x44a4a6
mov ecx, ebp
call fcn.00524fb0
mov ecx, dword [esi]
push 0x33
push ebx
push ebp
mov edx, 0x583b74
call fcn.00470c10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
mov eax, dword [ebp + 4]
push 0x75
push eax
call fcn.00570260
add esp, 8
test eax, eax
je 0x44a539
mov esi, dword [esp + 0x14]
mov ecx, esi
call fcn.004e29b0
test eax, eax
jne 0x44a508
mov edx, dword [ebp]
push 0xc
push ebx
xor ecx, ecx
call fcn.00479790
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov edx, dword [esi + 0xf28]
mov ecx, dword [esi]
imul edx, edx, 0x64
push ebx
push ebx
push 0xa
push ebx
push ecx
push ebx
push 5
push ebx
lea ecx, [edx + esi + 0xdfc]
push ebx
xor edx, edx
call fcn.0053c4d0
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
ret 4
mov edx, dword [ebp + 4]
cmp edx, ebx
je 0x44a5ee
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x44a550
sub eax, esi
cmp eax, 0x5a
jbe 0x44a561
mov byte [edx + 0x5a], bl
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + 4]
lea ecx, [edi + 0x840]
mov esi, ecx
mov al, byte [edx]
inc edx
mov byte [esi], al
inc esi
cmp al, bl
jne 0x44a570
call fcn.00524fb0
mov edx, dword [ebp + 8]
cmp edx, ebx
je 0x44a5ee
mov eax, edx
lea esi, [eax + 1]
jmp 0x44a590
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x44a590
sub eax, esi
cmp eax, 0x5a
jbe 0x44a5a1
mov byte [edx + 0x5a], bl
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [edi + 0x908], eax
jne 0x44a5ce
mov dword [edi + 0x908], ebx
mov byte [edi + 0x8a4], bl
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov dword [edi + 0x908], eax
mov ecx, dword [ebp + 8]
lea edx, [edi + 0x8a4]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x44a5e4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x451250
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x451496
cmp byte [eax], 0x2d
jne 0x451496
push 0x6f
push eax
call fcn.00570260
add esp, 8
test eax, eax
je 0x45127d
mov edx, 1
jmp 0x451291
mov eax, dword [esi + 4]
push 0x70
push eax
call fcn.00570260
add esp, 8
test eax, eax
je 0x45129c
xor edx, edx
mov ecx, dword [0x5b4314]
call fcn.00543030
mov ecx, dword [esi + 4]
push 0x6d
push ecx
call fcn.00570260
add esp, 8
test eax, eax
je 0x4512c3
mov edx, dword [0x5b3c04]
test edx, edx
sete dl
dec dl
and dl, 6
add dl, 0x6e
mov byte [eax], dl
mov eax, dword [esi + 4]
push 0x6e
push eax
call fcn.00570260
add esp, 8
test eax, eax
je 0x451323
mov ecx, dword [0x5b4314]
mov esi, dword [0x5b3c04]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 7
push ecx
mov dword [0x5b3c04], 0
call edi
mov eax, dword [0x5b3c00]
test eax, eax
je 0x451315
mov ecx, 2
call fcn.00537e30
mov edx, dword [0x5b4314]
push 8
push edx
call edi
pop edi
mov dword [0x5b3c04], esi
mov eax, 1
pop esi
ret
mov eax, dword [esi + 4]
push 0x78
push eax
call fcn.00570260
add esp, 8
test eax, eax
je 0x45137b
mov ecx, 2
call fcn.00537e30
mov ecx, dword [0x5b4314]
push 3
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x5b4314]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x5b4314]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov ecx, dword [0x5b4314]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
pop esi
ret
mov edx, dword [esi + 4]
push 0x73
push edx
call fcn.00570260
add esp, 8
test eax, eax
je 0x4513d2
mov ecx, 2
call fcn.00537e30
mov eax, dword [0x5b4314]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x5b4314]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x5b4314]
push edx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5b4314]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 4]
push 0x72
push ecx
call fcn.00570260
add esp, 8
test eax, eax
je 0x451436
mov ecx, 2
call fcn.00537e30
mov edx, dword [0x5b4314]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 8
push edx
call esi
mov eax, dword [0x5b4314]
push 9
push eax
call esi
mov ecx, dword [0x5b4314]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x5b4314]
push edx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5b4314]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 4]
push 0x74
push ecx
call fcn.00570260
add esp, 8
test eax, eax
je 0x451496
mov esi, dword [0x5b3c04]
mov ecx, 1
mov dword [0x5b3c04], 1
call fcn.00537e30
test eax, eax
je 0x451482
mov edx, dword [0x5b4314]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x5b3c04], esi
mov eax, 1
pop esi
ret
mov eax, dword [0x5b4314]
push 7
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x5b3c04], esi
mov eax, 1
pop esi
ret
Function at 0x452570
Capabilities:
Get graphical window text

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
test ecx, ecx
mov esi, edx
je 0x4526cf
cmp byte [ecx], 0x40
jne 0x452677
mov edx, dword [esp + 0x14]
call fcn.004e2e60
mov ebp, eax
test ebp, ebp
jne 0x4525ac
mov edx, dword [edi]
push 7
push eax
xor ecx, ecx
call fcn.00479790
pop edi
pop esi
pop ebp
ret 8
mov ecx, dword [ebp + 0x74c]
test ecx, ecx
lea eax, [ebp + 8]
je 0x4525ba
inc eax
push eax
push 0x58459c
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
mov edx, esi
mov ecx, 2
call fcn.004f4660
mov edx, 0xf
mov ecx, esi
call fcn.00524b30
mov dl, 0xa
mov ecx, esi
call fcn.00524d40
mov dl, 0xd
mov ecx, esi
call fcn.00524d40
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x452600
sub eax, edx
mov edi, eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, edi
jne 0x452661
mov edi, dword [esp + 0x10]
mov ecx, dword [ebp]
push 0x3b5
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, esi
nop
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x452654
test cl, cl
je 0x452650
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x452654
add eax, 2
add edi, 2
test cl, cl
jne 0x452630
xor eax, eax
jmp 0x452659
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4526ea
mov eax, dword [ebp]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
push 0x585984
push ecx
call fcn.005809c6
add esp, 8
neg eax
sbb eax, eax
mov ecx, dword [edi + eax*4 + 8]
add eax, 2
test ecx, ecx
je 0x4526cf
push edi
mov edx, esi
mov ecx, eax
mov byte [esi], 0
call fcn.004f4660
mov dl, 0xa
mov ecx, esi
mov byte [esi + 0xfa], 0
call fcn.00524d40
mov dl, 0xd
mov ecx, esi
call fcn.00524d40
mov edx, 0x5ad0f8
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4526c3
jmp 0x4526d6
mov byte [0x5ad0f8], 0
mov ecx, dword [0x5b4314]
call fcn.0048ae30
test eax, eax
jne 0x4526ea
call fcn.0041dc00
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
Function at 0x456040
Capabilities:
Extract resource via kernel32 functions
Get hostname
Log keystrokes via polling
Set socket configuration

Disassembly:
push esi
mov esi, ecx
call fcn.004e2760
test eax, eax
jne 0x45605f
call fcn.004e27f0
mov esi, eax
test esi, esi
jne 0x45605f
xor ecx, ecx
pop esi
jmp fcn.0041d520
mov ecx, esi
call fcn.004e29b0
test eax, eax
jne 0x45607f
mov ecx, esi
call fcn.004e2a60
test eax, eax
jne 0x45607f
mov edx, esi
xor ecx, ecx
pop esi
jmp fcn.00455d20
push esi
mov edx, 0xf
mov ecx, 0x583b74
call fcn.00455150
pop esi
ret
Function at 0x457000
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0x1000
call fcn.00571390
push esi
push edi
push 0x5845a4
push ecx
or esi, 0xffffffff
call fcn.00570b2c
mov edi, eax
add esp, 8
test edi, edi
je 0x457094
push edi
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
call fcn.005718d3
add esp, 0x10
test eax, eax
jbe 0x457085
lea esp, [esp]
xor ecx, ecx
test eax, eax
jbe 0x457065
xor edx, edx
mov dl, byte [esp + ecx + 8]
xor edx, esi
and edx, 0xff
mov edx, dword [edx*4 + 0x59b510]
shr esi, 8
xor esi, edx
inc ecx
cmp ecx, eax
jb 0x457046
cmp eax, 0x1000
jb 0x457085
push edi
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
call fcn.005718d3
add esp, 0x10
test eax, eax
ja 0x457040
test byte [edi + 0xc], 0x20
push edi
je 0x45709f
call fcn.005709f9
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0x1000
ret
call fcn.005709f9
add esp, 4
mov eax, esi
pop edi
not eax
pop esi
add esp, 0x1000
ret

Function at 0x4570c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
push edi
mov edi, ecx
jg 0x4570cb
xor eax, eax
pop edi
ret
push esi
or eax, 0xffffffff
xor esi, esi
test edx, edx
jle 0x4570f3
xor ecx, ecx
mov cl, byte [esi + edi]
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x59b510]
shr eax, 8
xor eax, ecx
inc esi
cmp esi, edx
jl 0x4570d5
pop esi
not eax
pop edi
ret