joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007849a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x2c]
jae 0x10073a4a
xchg ebx, ecx
rol ch, 6
mov ebx, eax
test cx, 0x2c8e
mov edi, eax
bt cx, bp
movsx cx, cl
mov ecx, 0x104
pushfd
cmp cl, 0x4d
stc
cmc
xor al, al
mov byte [esp], 0xef
repne scasb al, byte es:[edi]
call fcn.1007195b
add byte [eax], al
inc ebp
js 0x10078541
je 0x1007852a
jb 0x1007854b
arpl word [ebp + 0x73], sp
jae 0x100784e1
aam 0x99
invalid
push edx
xchg dword [esi - 0x28], edi
cwde
int1
lock adc byte [edi + 0x742c6e6b], bl
outsb dx, byte [esi]
sub al, 0x74
mov ch, 0xc
mov ah, 0xb4
je 0x10078556
xchg esi, eax
xchg esi, eax
adc eax, 0xe9b03253
pop ebp
loop 0x10078572
dec esi
dec esp
mov dl, 0xb1
sti
scasb al, byte es:[edi]
test esi, esp
sbb esi, edx
sub al, 0x88
mov ebp, 0x8af566a0
jge 0x32eccee2
insb byte es:[edi], dx
dec ecx
in eax, 0x22
mov word [ebp - 3], gs
jae 0x1007859e
aad 0xd8
lodsd eax, dword [esi]
int 0xe5
out 0x80, eax
invalid
jne 0x100785bc
retf
jno 0x10078606
jne 0x100785d4
xchg ebx, ecx
xchg dword [0x510aec4f], ebx
salc
outsb dx, byte [esi]
arpl ax, cx
inc esi
nop
inc ebx
cmp bh, al
sub byte [esi - 0x3b5ef6ab], al
xor dword [ebx + 0x6a], 0x28
mov ebx, 0x514ad689
sub byte [ebx + 0x514ad689], bh
xchg esi, eax
dec eax
in eax, dx
pop esi
dec edi
hlt
scasb al, byte es:[edi]
sub al, 0x5e
dec dword [ebp - 0x2a]
out 0x7e, al
mov bl, 0x9f
ror byte [ecx], cl
stc
ja 0x10078588
dec ebp
pop edx
sub al, 0
pushfd
sbb al, byte [edi - 0x3b61f0e9]
and al, ch
rol eax, 0xff
jmp dword [esi + 0xf]
Function at 0x10079a74
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x30]
jne 0x1003ba5c
jae 0x10075132
pushfd
mov ecx, dword [ebp - 4]
pushfd
cmp dword [ebp + 0x14], ecx
push dword [esp + 4]
call fcn.1003aa5e
add byte [eax], al
add byte [eax], al
nop
stosb byte es:[edi], al
push es
push edx
add byte [eax], al
add byte [eax], al
mov esi, 0x100072f
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [eax - 0x6bfff8dd], cl
and eax, dword [edi]
add byte [eax - 0x5bfff8dd], dl
add byte ds:[eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
pushfd
and eax, dword [edi]
add byte [ecx + 0x73000723], ah
je 0x10072414
bound eax, qword [eax]
aam 0xf4
hlt
enter 0xe87, 0x22
rcr al, 0xf0
xor eax, 0x458065e9
jnp 0x1007244c
in eax, 0x46
mov esp, 0xad03de2e
fiadd word [ebx]
lodsd eax, dword [esi]
sub dword [eax - 0x33b38628], edi
inc esi
leave
int 0x58
loope 0x1007247c
insd dword es:[edi], dx
mov esi, dword [ecx + 0x17231e90]
push esi
push eax
add dword [edi - 0x5389a296], esp
push 0xcc344de2
and eax, 0xac98d9c1
rcr ecx, 0x98
lodsb al, byte [esi]
call 0x4dcadbf0
xor al, 0x8d
nop
pop ebx
jae 0x10072474
fcomp qword [edx]
fsub dword [esi - 0x29]
jg 0x1007240a
stc
pop ebp
push esi
push 0x68558d98
add al, ah
push ss
retf
mov ah, 0x53
mov cl, 0xed
jns 0x100723f8
pop ss
ret 0xc4a
add dword [edi - 0x58], 0x70f6c282
jae 0x10072483
push es
inc edx
dec ebp
push 0x28
scasd eax, dword es:[edi]
rcl byte [ebp + 0x7fa7eb45], cl
aas
sal ebx, 1
and eax, 0xd86194b2
sub edx, dword [edx + 0x24]
jne 0x1007245a
xchg ebp, eax
inc ebp
jmp 0x1007242e
wait
aam 0x7f
lea edi, [esi - 0x25c6d8f4]
add al, 0x55
sbb edx, dword [eax]
mov al, 0x33
push 0x57
and cl, bh
cmp al, bl
pop es
salc
mov ebp, 0xb282b44b
dec esp
adc eax, 0x3c781439
jbe 0x10072523
int 0xaa
not byte [esi - 0x32]
insd dword es:[edi], dx
push ebx
cmp dword [ecx], ebp
lahf
insb byte es:[edi], dx
or ah, byte [edx + 1]
pop ebp
ret
jge 0x1007257b
ljmp 0xcf97:0xa54ccee5
stosb byte es:[edi], al
popfd
call 0x7589156b
sbb dword [ecx - 0x29], ecx
inc esp
cmpsb byte [esi], byte es:[edi]
xchg byte [ebx], cl
inc ecx
pop esi
pop ss
cmp ch, byte [ebx + 0x74]
inc ebp
or byte [edi + 0x68c2b69e], al
invalid
movzx cx, cl
mov ecx, dword [ebp - 4]
pushal
cmp dword [ebp + 0x14], ecx
pushal
mov byte [esp + 4], dl
call int.10075823
shl eax, 1
pushal
lea esp, [esp + 0x40]
je 0x1003a418
call fcn.1007728d
jmp 0x1007233f

Function at 0x1007aaf9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [edi]
pop dword [esp + 0x4c]
cmp ah, dh
stc
test dl, ah
push edi
cmp edi, ebx
mov byte [esp], ch
jmp 0x100712dc
Function at 0x421d6b
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
adc eax, 0x2b991a9b
xchg esi, eax
arpl word [0xc7d7e55c], di
out dx, al
sub ebx, 0x99222c36
mov ebx, 0xec1241bf
cmp bl, byte [esi + 3]
shr dword [ebx - 0x6e], cl
xor esp, dword cs:[edi - 0x64]
lodsd eax, dword [esi]
push edi
and dword [esi - 0x16], ecx
xlatb
fadd qword [ecx]
cmp ebx, dword [esi]
push ecx
or al, 0x87
push edx
or al, 3
outsb dx, byte [esi]
sbb byte [edi + 0x61], bl
mov esi, 0xe4b3a04
add dword [edi + 0x65], ebp
in eax, dx
jne 0x421d6f
sub edx, dword [esi - 0x1aa3c29d]
xlatb
invalid
xchg ebx, eax
xchg ecx, eax
sub dword [ebp + 0x8faa4e1], ebp
or al, 0xe9
sti
cli
pushal
scasb al, byte es:[edi]
xor dword [ebp - 0x31205c8d], ebx
outsw dx, word [si]
push 0xffffffffffffffb1
retf 0xe1e

Function at 0x44b610
Capabilities:
Accept command line arguments

Disassembly:
push ecx
mov al, byte [0x66004e]
mov cl, byte [0x660043]
xor cl, al
push esi
mov byte [0x660043], cl
mov cl, byte [0x660041]
or cl, 0xc
shr cl, 2
and ecx, 0xff
mov dword [esp + 4], ecx
fild dword [esp + 4]
fdivr qword [0x6639b0]
fadd qword [0x663950]
fstp qword [0x6639b0]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDialogBaseUnits]
mov dl, byte [0x660042]
mov al, byte [0x660049]
mov ecx, dword [0x660030]
xor al, dl
mov byte [0x660049], al
mov eax, dword [0x660034]
mov edx, dword [0x660048]
and eax, 4
add ecx, eax
and edx, 0xff
mov dword [0x660030], ecx
mov ecx, dword [0x66003c]
and ecx, 0xc
lea eax, [esp + 4]
imul ecx, edx
mov edx, dword [0x660038]
push eax
xor edx, ecx
push esi
mov dword [0x660038], edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [0x663bb4], eax
mov eax, dword [0x663bb0]
test eax, eax
jne 0x44b72c
test esi, esi
je 0x44b70f
mov edx, dword [0x663a9c]
push 0x6637b8
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push str.comctl32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.LoadIconWithScaleDown
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov dword [0x663aa4], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x663a9c]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
xor eax, eax
mov dword [0x663bb0], 1
pop esi
pop ecx
ret 4
mov eax, dword [esp + 0xc]
pop esi
pop ecx
ret 4
Function at 0x659ab6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x662910
cmp edx, dword [eax]
je 0x659ad8
add eax, 8
inc ecx
cmp eax, 0x6629a0
jl 0x659ac9
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x662910]
jne 0x659c06
mov eax, dword [0xa65cf8]
cmp eax, 1
je 0x659be0
test eax, eax
jne 0x659b09
cmp dword [0x6602c4], 1
je 0x659be0
cmp edx, 0xfc
je 0x659c06
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659b40
lea eax, [ebp - 0x1a4]
push 0x65d860
push eax
call fcn.00656b30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00656cb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659b83
lea eax, [ebp - 0x1a4]
push eax
call fcn.00656cb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65d85c
push edi
call fcn.00656e40
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65d840
push eax
call fcn.00656b30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00656b40
lea eax, [ebp - 0xa0]
push 0x65d83c
push eax
call fcn.00656b40
push dword [esi + 0x662914]
lea eax, [ebp - 0xa0]
push eax
call fcn.00656b40
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65d814
push eax
call fcn.0065b45c
add esp, 0x2c
pop edi
jmp 0x659c06
lea eax, [ebp + 8]
lea esi, [esi + 0x662914]
push 0
push eax
push dword [esi]
call fcn.00656cb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x12388e7
Capabilities:
Parse pe header

Disassembly:
sub ecx, 1
rcl di, cl
not si
mov edi, ebx
mov dword [ebp - 4], ecx
shr cx, cl
mov ecx, dword [ebp - 8]
shld di, cx, 0xf
rol si, 5
sar si, cl
add ecx, dword [ebp - 4]
inc di
btr edi, esi
btc esi, eax
shr ecx, 1
jmp 0x1eb105b
jmp 0x1eaff44
push 0xdef8ac61
lea esp, [esp + 8]
jb 0x21672b6
cmp bl, 0x50
pushfd
pushal
stc
cmp byte [edi - 1], 0
push esi
pushfd
push 0xb59a998b
mov byte [esp], al
lea esp, [esp + 0x30]
jne 0x1eb107c
neg di
movsx di, dl
neg di
neg edi
mov edi, dword [edx + 0x24]
cmc
call fcn.0123246d
lahf
invalid
pushal
rcl si, 9
xadd di, si
mov edi, dword [ebx + ecx*4]
dec si
add si, cx
add edi, eax
bswap esi
movzx si, bl
mov esi, dword [ebp + 0xc]
lea esp, [esp + 0x20]
push edi
cmp sp, 0x7900
cmp ecx, dword [ebp - 8]
pushfd
pushfd
lea esp, [esp + 0xc]
jbe fcn.021835bf
sbb edi, edx
jmp 0x123133a
Function at 0x216a56f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
btc cx, 0xd
mov dword [ebp - 8], 0
dec cx
neg cx
adc ch, al
pushfd
mov ecx, dword [edx + 0x18]
lea esp, [esp + 4]
test eax, eax
pushfd
mov byte [esp + 8], al
lea esp, [esp + 0x18]
je fcn.021835bf
xadd esi, edx
xchg dx, si
shl edx, cl
bswap si
mov esi, dword [eax + 0x3c]
cmc
pushfd
pushfd
add esi, eax
bt di, 0xf
sbb dl, bh
sar dl, cl
shld dx, si, cl
mov edx, dword [esi + 0x78]
push edi
stc
clc
test edx, edx
lea esp, [esp + 0xc]
js 0x123306a
je fcn.021835bf
sub ch, 0x4a
add edx, eax
stc
mov ecx, dword [esi + 0x7c]
cmc
cmp cl, dh
push 0x9a1a3c21
add ecx, edx
pushal
clc
mov dword [ebp - 0x10], ecx
adc cx, di
bt si, 1
mov ecx, dword [ebp + 0xc]
stc
cmp ecx, 0xffff
jmp 0x216d8fe
sub ch, 0xdd
rcr ch, 7
sar cl, 6
add ebx, eax
cmp ax, si
mov dword [ebp - 8], 0
clc
adc cl, bl
call fcn.0216c2fe
pushfd
lea esp, [esp + 0x28]
jbe 0x1237df6
sal di, cl
bt ax, ax
cmc
mov edi, dword [edx + 0x24]
push 0x29b383b
inc ebx
cmp bl, al
rcl bh, cl
add edi, eax
clc
setbe bl
bts ecx, edi
lea ebx, [0xbfb4eaad]
mov ebx, dword [edx + 0x20]
cmc
sbb ch, 0x2a
lea esp, [esp + 4]
jae 0x216b0b4
stc
add ebx, eax
jmp 0x216729a
Function at 0x401cdb
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x401d15
push 6
call fcn.0053b7dd
add esp, 4
jmp 0x401d1a
mov esp, ebp
pop ebp
ret 4
Function at 0x48ad95
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 8
call fcn.0053b7c5
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov word [ebx], 1
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov word [ebx], 5
mov dword [ebp - 8], esp
push 4
mov eax, dword [ebp - 4]
push eax
push 4
call fcn.0053b7c5
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
push 0x80
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x48ae3e
push 6
call fcn.0053b7dd
add esp, 4
push eax
mov ebx, dword [ebp - 0xc]
push ebx
mov edi, dword [ebp - 0x10]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0053b7cb
add esp, 4
pop eax
jmp 0x48ae6a
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0053b7cb
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x48b42b
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 1
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x48b471
push 6
call fcn.0053b7dd
add esp, 4
jmp 0x48b476
mov esp, ebp
pop ebp
ret

Function at 0x48e1ac
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push dword [ebp + 8]
call fcn.0048d333
mov dword [ebp - 4], eax
fild dword [ebp + 8]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x84a94b]
fstp qword [ebp - 0x14]
mov dword [ebp - 0x18], esp
push 0
push dword [ebp + 8]
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 1
fld qword [ebp - 0x14]
call fcn.00401055
push eax
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_WSARecv]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x48e222
push 6
call fcn.0053b7dd
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x48e265
mov dword [ebp - 4], esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x48e24e
push 6
call fcn.0053b7dd
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e5
mov eax, 0
sete al
jmp 0x48e26f
mov eax, 1
jmp 0x48e26f
mov esp, ebp
pop ebp
ret 4
Function at 0x4a2e9f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x20], 0
jne 0x4a2eb9
mov dword [ebp + 0x1c], 1
cmp dword [ebp + 0x18], 0
jne 0x4a2ee1
mov eax, 0x9d6de3
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4a2edb
push ebx
call fcn.0053b7cb
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push dword [ebp + 0x1c]
push 0x564ba7
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4a2f1c
push 6
call fcn.0053b7dd
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x20
mov eax, 0
setg al
jmp 0x4a2f30
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4b56c6
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
call dword [sym.imp.IMM32.dll_ImmGetContext]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4b5706
push 6
call fcn.0053b7dd
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b5837
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0053c430
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 0
push dword [ebp - 0x10]
push 0x800
push dword [ebp - 4]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4b5763
push 6
call fcn.0053b7dd
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4b5776
push ebx
call fcn.0053b7cb
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x184
call fcn.0053c140
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4b57af
push ebx
call fcn.0053b7cb
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x800
push dword [ebp - 4]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4b57e0
push 6
call fcn.0053b7dd
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4b5805
push 6
call fcn.0053b7dd
add esp, 4
lea eax, [ebp - 0xc]
push eax
call fcn.004b5859
test eax, eax
je 0x4b5837
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4b5832
push eax
mov ebx, eax
call fcn.004019e1
inc eax
push eax
call fcn.0053b7c5
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4b5841
mov eax, 0x564ba7
jmp 0x4b5841
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4b5852
push ebx
call fcn.0053b7cb
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4d0513
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x200
call fcn.00401cdb
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x200
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4d0561
push 6
call fcn.0053b7dd
add esp, 4
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x564b7c]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.00401055
push 0x80000301
push 0
push eax
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.0053bd80
add esp, 0x1c
mov dword [ebp - 0x1c], eax
push 0x9d9267
push dword [ebp - 0x1c]
mov ecx, 2
call fcn.0040235c
add esp, 8
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4d05cd
push ebx
call fcn.0053b7cb
add esp, 4
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
call fcn.004020d5
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x4d05f5
push ebx
call fcn.0053b7cb
add esp, 4
mov eax, dword [ebp - 0x28]
jmp 0x4d05fd
mov esp, ebp
pop ebp
ret 4
Function at 0x532c27
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 1
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x532c6d
push 6
call fcn.0053b7dd
add esp, 4
jmp 0x532c72
mov esp, ebp
pop ebp
ret

Function at 0x5330c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push dword [ebp + 8]
call fcn.00533189
mov dword [ebp - 4], eax
fild dword [ebp + 8]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x84a94b]
fstp qword [ebp - 0x14]
mov dword [ebp - 0x18], esp
push 0
push dword [ebp + 8]
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 1
fld qword [ebp - 0x14]
call fcn.00401055
push eax
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_WSARecv]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x533136
push 6
call fcn.0053b7dd
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x533179
mov dword [ebp - 4], esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x533162
push 6
call fcn.0053b7dd
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e5
mov eax, 0
sete al
jmp 0x533183
mov eax, 1
jmp 0x533183
mov esp, ebp
pop ebp
ret 4
Function at 0x53c450
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x53c490
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x53c522
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x53c514
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x53c50c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x53c4d5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x53e0b0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.00551bf6
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x53e11a
push esi
lea edi, [eax + 0x400]
call fcn.00551c1f
push edi
call fcn.00551bf6
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x53e0ea
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x53e136
push ecx
push esi
call fcn.005422c0
add esp, 8
mov ebx, eax
push esi
call fcn.00551c1f
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x53eaf0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x53eb0e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x53eb03
pop esi
ret