joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d62a3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0051fafa
mov ebx, eax
test ebx, ebx
je 0x4d62c0
cmp dword [ebx + 0x6bc], 1
je 0x4d62cc
push 0
call fcn.0042c6cc
jmp 0x4d6512
push 0
push 0x46db42
push 0x28a
push dword [ebp + 8]
call fcn.0046a7c4
mov esi, eax
test esi, esi
jle 0x4d6512
push ebx
call fcn.0051fd59
test eax, eax
je 0x4d6512
test esi, 0x20
je 0x4d6356
push 0x581e7c
push 0x3e7
push 0x579f7a
push 0x56bc74
lea edi, [ebx + 8]
push edi
push 0x56bc6a
call fcn.004ac8c9
cmp byte [0x579f7a], 0
je 0x4d6356
push 0x2c
push 0x579f7a
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x4d6356
mov byte [eax], 0
push 0x581e7c
push 0x579f7a
push edi
push 0x56bc78
call fcn.004ac64e
test esi, 1
je 0x4d6362
xor edi, edi
jmp 0x4d639b
test esi, 2
je 0x4d6371
mov edi, 1
jmp 0x4d639b
test esi, 4
je 0x4d6380
mov edi, 2
jmp 0x4d639b
push 0x581e7c
push 0
lea eax, [ebx + 8]
push eax
push 0x56bc82
call fcn.004ac64e
mov edi, dword [0x56bc38]
test esi, 0x40
je 0x4d63ba
xor eax, eax
mov dword [0x56bc3c], eax
test esi, 0x20
je 0x4d63ba
xor edx, edx
mov dword [ebx + 0x6dc], edx
mov ecx, esi
and ecx, 0x10
test ecx, ecx
je 0x4d63ea
push 0x581e7c
push 0
lea eax, [ebx + 8]
push eax
push 0x56bc8c
call fcn.004ac64e
mov dword [0x56bc38], edi
mov edx, dword [ebx + 0x6dc]
mov dword [0x56bc3c], edx
mov dword [ebx + 0x6f4], edi
call fcn.004afe30
test esi, 8
jne 0x4d6498
and esi, 0x10
test esi, esi
jne 0x4d6498
push dword [ebp + 8]
call fcn.004d6223
mov esi, eax
cmp dword [ebx + 0x6f4], 0
jne 0x4d6432
push esi
mov esi, 0x56bc96
mov edi, 0x579f7a
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
jmp 0x4d645c
cmp dword [ebx + 0x6f4], 1
jne 0x4d644d
push esi
mov esi, 0x56bc9d
mov edi, 0x579f7a
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4d645c
push esi
mov esi, 0x56bca3
mov edi, 0x579f7a
mov eax, edi
movsd dword es:[edi], dword [esi]
pop esi
test esi, esi
je 0x4d6480
push esi
push 0x56bca8
push 0x579f7a
call fcn.0054e28c
pop ecx
add eax, 0x579f7a
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x581e7c
push 0x579f7a
add ebx, 8
push ebx
push 0x56bcad
call fcn.004ac64e
mov ebx, dword [0x56f010]
test ebx, ebx
je 0x4d6512
cmp dword [ebx + 0x6bc], 1
jne 0x4d6508
push dword [ebx]
call fcn.004d6120
push dword [ebx]
call fcn.004d6519
mov esi, eax
mov dword [ebx + 0x6f4], esi
cmp esi, 2
jne 0x4d64e2
push 0
push dword [ebx + 0x820]
call sub.USER32.dll_ShowWindow
push 0
push dword [ebx + 0x820]
call sub.USER32.dll_EnableWindow
jmp 0x4d64fc
push 1
push dword [ebx + 0x820]
call sub.USER32.dll_EnableWindow
push 8
push dword [ebx + 0x820]
call sub.USER32.dll_ShowWindow
push 0x80b8
push dword [ebx]
call fcn.005225d7
mov ebx, dword [ebx + 0xd3c]
test ebx, ebx
jne 0x4d64a2
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4e9502
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff41c
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
call fcn.0041261f
test eax, eax
je 0x4e971b
cmp dword [esi + 0x1c90], 0
jne 0x4e9538
xor eax, eax
mov dword [esi + 0x1c94], eax
jmp 0x4e971b
mov ebx, dword [esi + 0x1c90]
test ebx, ebx
je 0x4e96fe
push dword [ebx + 4]
push dword [0x56f018]
call sub.USER32.dll_KillTimer
xor eax, eax
mov dword [ebx + 4], eax
push 0x7f8
push 0
lea edx, [ebp - 0xbe4]
push edx
call fcn.0054e10c
add esp, 0xc
lea ecx, [ebx + 0x74]
push ecx
push 0x3e7
lea eax, [ebp - 0xbbc]
push eax
call fcn.0042e5e3
cmp dword [ebx + 0x1f0], 0
je 0x4e967d
test edi, edi
jne 0x4e9608
push dword [ebx]
call fcn.0051fafa
test eax, eax
jne 0x4e95a4
mov edx, dword [esi]
mov dword [ebx], edx
push 0x588ce3
push 0x588be3
push 0x588ae3
push 0x588ae0
lea ecx, [ebx + 0x74]
push ecx
call fcn.0050e5fc
add esp, 0x14
push 0x588ce3
push 0x588be3
push 0
push 0x1136
call fcn.0042c771
push eax
lea eax, [ebp - 0x3ec]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
xor edx, edx
mov dword [0x56cd18], edx
push dword [0x5618ec]
lea ecx, [ebp - 0x3ec]
push ecx
push dword [ebx]
call fcn.004f0245
jmp 0x4e967d
cmp edi, 1
jne 0x4e967d
push dword [ebx]
call fcn.0051fafa
test eax, eax
jne 0x4e961c
mov eax, dword [esi]
mov dword [ebx], eax
push 0x588ce3
push 0x588be3
push 0x588ae3
push 0x588ae0
lea edx, [ebx + 0x74]
push edx
call fcn.0050e5fc
add esp, 0x14
push 0x588ce3
push 0x588be3
push 0
push 0x1137
call fcn.0042c771
push eax
lea ecx, [ebp - 0x3ec]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 0x10
xor eax, eax
mov dword [0x56cd18], eax
push dword [0x5618ec]
lea edx, [ebp - 0x3ec]
push edx
push dword [ebx]
call fcn.004f0245
cmp dword [ebx + 0x1f4], 0
je 0x4e968f
lea ecx, [ebx + 0x74]
push ecx
call sub.KERNEL32.dll_DeleteFileA
cmp dword [ebx + 0x1f8], 0
je 0x4e96a4
lea eax, [ebx + 0x1f8]
push eax
call fcn.004c6e49
mov edx, dword [ebx + 0x200]
mov dword [ebp - 4], edx
push ebx
call fcn.00559c5c
pop ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x1c90], ecx
cmp dword [0x56cdd8], 0
je 0x4e96e7
cmp edi, 5
je 0x4e96e7
lea eax, [ebp - 0xbe4]
push eax
push 0
push 0
push 0x31
push 0x56c8a7
push 0
push 0
push esi
call fcn.004fecf0
cmp edi, 5
je 0x4e9538
push esi
call fcn.004e936a
test eax, eax
jg 0x4e9538
cmp dword [esi + 0x1c90], 0
jne 0x4e970f
xor edx, edx
mov dword [esi + 0x1c94], edx
push esi
call fcn.004ea0c0
push esi
call fcn.004eacaa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ea6d1
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0041261f
test eax, eax
je 0x4ea8cf
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], 0xffffffff
mov ecx, dword [0x56c8f4]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x4ea8cf
push 0
push 0
push 0x18b
push 0x65
push dword [ebp - 0x18]
call sub.USER32.dll_SendDlgItemMessageA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4ea730
xor eax, eax
mov dword [ebp - 0xc], eax
xor edx, edx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0xc]
jge 0x4ea84d
push 0
push dword [ebp - 0x10]
push 0x187
push 0x65
push dword [ebp - 0x18]
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x4ea83e
test eax, eax
je 0x4ea83e
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4ea772
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0
push dword [ebp - 0x10]
push 0x199
push 0x65
push dword [ebp - 0x18]
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x4ea83e
xor esi, esi
mov ebx, dword [edi + 0x1c90]
test ebx, ebx
je 0x4ea7ab
cmp eax, ebx
je 0x4ea7ab
mov esi, ebx
mov ebx, dword [ebx + 0x200]
test ebx, ebx
jne 0x4ea79b
test ebx, ebx
je 0x4ea83e
cmp ebx, dword [edi + 0x1c90]
jne 0x4ea7c2
mov dword [ebp - 8], 1
cmp dword [ebx + 0x1f4], 0
je 0x4ea7d4
lea eax, [ebx + 0x74]
push eax
call sub.KERNEL32.dll_DeleteFileA
cmp dword [ebx + 0x1f8], 0
je 0x4ea7e9
lea edx, [ebx + 0x1f8]
push edx
call fcn.004c6e49
test esi, esi
je 0x4ea802
mov ecx, dword [ebx + 0x200]
mov dword [esi + 0x200], ecx
push ebx
call fcn.00559c5c
pop ecx
jmp 0x4ea81b
mov eax, dword [edi + 0x1c90]
mov ebx, dword [eax + 0x200]
push eax
call fcn.00559c5c
pop ecx
mov dword [edi + 0x1c90], ebx
mov dword [ebp - 4], 1
push 0
push dword [ebp - 0x10]
push 0x182
push 0x65
push dword [0x56c8f4]
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x4ea735
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4ea741
cmp dword [ebp - 4], 0
jne 0x4ea85c
push 0
call fcn.0042c6cc
jmp 0x4ea8cf
push 0xffffffffffffffff
push 0
push 0x185
push 0x65
push dword [ebp - 0x18]
call sub.USER32.dll_SendDlgItemMessageA
cmp dword [ebp - 0x14], 0
jl 0x4ea8ab
push 0
push dword [ebp - 0x14]
push 0x19e
push 0x65
push dword [ebp - 0x18]
call sub.USER32.dll_SendDlgItemMessageA
inc eax
je 0x4ea8a2
push dword [ebp - 0x14]
push 1
push 0x185
push 0x65
push dword [ebp - 0x18]
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x4ea8ab
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jge 0x4ea875
cmp dword [ebp - 8], 0
je 0x4ea8c3
push edi
call fcn.004e936a
test eax, eax
jle 0x4ea8c3
push edi
push 2
call fcn.004e9502
push edi
call fcn.004ea0c0
push edi
call fcn.004eacaa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f6ecc
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xfffffef4
mov byte [0x586624], 0
lea eax, [esp + 4]
push eax
push str.htmlfile_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4f6f28
mov dword [esp], 0x104
push esp
lea edx, [esp + 0xc]
push edx
push 0x56d22e
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x4f6f1f
push 0x586624
lea ecx, [esp + 0xc]
push ecx
call fcn.004f6e53
push dword [esp + 4]
call sub.ADVAPI32.dll_RegCloseKey
cmp byte [0x586624], 0
jne 0x4f6f80
lea eax, [esp + 4]
push eax
push str.http_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4f6f80
mov dword [esp], 0x104
push esp
lea edx, [esp + 0xc]
push edx
push 0x56d248
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x4f6f77
push 0x586624
lea ecx, [esp + 0xc]
push ecx
call fcn.004f6e53
push dword [esp + 4]
call sub.ADVAPI32.dll_RegCloseKey
add esp, 0x10c
ret

Function at 0x4f6ff3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
cmp byte [0x586520], 0
je 0x4f701e
push 1
push 0x586520
call fcn.0042cbc2
test eax, eax
jne 0x4f709d
mov byte [0x586520], 0
xor ebx, ebx
test ebx, ebx
jne 0x4f703a
lea eax, [esp + 4]
push eax
push str.mailto_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
jmp 0x4f704e
lea edx, [esp + 4]
push edx
push str..sta_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4f7089
mov dword [esp], 0x104
push esp
lea ecx, [esp + 0xc]
push ecx
push str.command
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x4f7080
push 0x586520
lea eax, [esp + 0xc]
push eax
call fcn.004f6e53
push dword [esp + 4]
call sub.ADVAPI32.dll_RegCloseKey
cmp byte [0x586520], 0
jne 0x4f709d
test ebx, ebx
jne 0x4f709d
mov ebx, 1
jmp 0x4f7020
add esp, 0x10c
pop ebx
ret
Function at 0x501d4c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, 0x56d938
push 1
push dword [ebx]
call sub.USER32.dll_ShowWindow
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
call sub.USER32.dll_SetWindowPos
push dword [ebx]
call sub.USER32.dll_SetActiveWindow
push dword [ebx]
call sub.USER32.dll_UpdateWindow
push dword [ebp + 8]
push 0x68
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call fcn.005124ce
push 0x12c
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
pop ebx
pop ebp
ret 4
Function at 0x50370a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor edx, edx
cmp dword [0x563c0c], 0
jne 0x50372c
mov eax, dword [esi + 0x348]
jmp 0x5038e2
xor ecx, ecx
mov eax, dword [0x56d9cc]
test eax, eax
je 0x50375c
mov ebx, dword [eax + 0x33c]
cmp ebx, 1
je 0x503747
cmp ebx, 2
jne 0x503752
mov ebx, dword [esi + 0x368]
add ebx, edx
mov edx, ebx
inc ecx
mov eax, dword [eax + 0x3cc]
test eax, eax
jne 0x503737
test ecx, ecx
jg 0x503765
mov ecx, 1
mov ebx, dword [0x563c0c]
mov dword [ebp - 0x18], ebx
fild dword [ebp - 0x18]
fild dword [0x563c0c]
fmul qword [0x5038ee]
fsubp st(1)
mov dword [ebp - 0x1c], edx
fild dword [ebp - 0x1c]
fcompp
fnstsw ax
sahf
jb 0x5037a2
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
cmp ebx, 0x200
jae 0x5037af
mov ebx, pe_nt_image_headers32
jmp 0x5037af
cmp ebx, 0x200
jae 0x5037af
mov ebx, pe_nt_image_headers32
cmp dword [esi + 0x3bc], 0
jne 0x5037c3
cmp dword [esi + 0x3b8], 0
ja 0x5037db
jmp 0x5037c5
jg 0x5037db
call fcn.0042e7ed
mov dword [esi + 0x3b8], eax
mov dword [esi + 0x3bc], edx
jmp 0x5038ce
call fcn.0042e7ed
sub eax, dword [esi + 0x3b8]
sbb edx, dword [esi + 0x3bc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x503800
cmp dword [ebp - 8], 0x64
ja 0x503809
jmp 0x503802
jg 0x503809
xor eax, eax
jmp 0x5038e2
cmp dword [ebp - 4], 0
jne 0x50381a
cmp dword [ebp - 8], 0x3e8
jae 0x50383e
jmp 0x50381c
jge 0x50383e
fild qword [ebp - 8]
fdivr dword [0x5038f6]
mov edx, dword [esi + 0x3b0]
mov dword [ebp - 0x1c], edx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
fild qword [ebp - 0x1c]
fmulp st(1)
fstp xword [ebp - 0x14]
wait
jmp 0x503860
mov eax, dword [esi + 0x3b0]
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 0x18], edx
fild qword [ebp - 0x1c]
fild qword [ebp - 8]
fld xword [0x5038fa]
fmulp st(1)
fdivp st(1)
fstp xword [ebp - 0x14]
wait
xor edi, edi
fld xword [ebp - 0x14]
call fcn.005569e8
cmp ebx, eax
ja 0x50388f
fld xword [ebp - 0x14]
call fcn.005569e8
mov ecx, eax
sub ecx, ebx
mov eax, ebx
push ecx
mov ecx, 0xb
xor edx, edx
div ecx
pop ecx
cmp ecx, eax
jb 0x5038b1
xor eax, eax
jmp 0x5038e2
fld xword [ebp - 0x14]
call fcn.005569e8
mov ecx, ebx
sub ecx, eax
mov eax, ebx
push ecx
mov ecx, 0xb
xor edx, edx
div ecx
pop ecx
cmp ecx, eax
jb 0x5038b1
mov edi, 1
test edi, edi
jne 0x5038ce
call fcn.0042e7ed
mov dword [esi + 0x3b8], eax
mov dword [esi + 0x3bc], edx
xor eax, eax
mov dword [esi + 0x3b0], eax
mov eax, dword [esi + 0x348]
cmp ebx, eax
jbe 0x5038da
mov ebx, eax
test ebx, ebx
ja 0x5038e0
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5042fc
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
push dword [ebx + 0x3c8]
call fcn.0041261f
test eax, eax
jne 0x50432a
push 0x56da38
push 0
push ebx
call fcn.00505655
xor eax, eax
jmp 0x504511
mov dword [ebx + 0x33c], 1
xor edx, edx
mov dword [ebx + 0x39c], edx
lea ecx, [ebx + 0xcc]
push ecx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5043a8
cmp dword [0x565dc0], 0
je 0x504363
cmp dword [0x565dbc], 0
jne 0x5043a8
cmp dword [ebx + 0x374], 0
je 0x50438c
push 8
push 0
lea eax, [ebx + 0xcc]
push eax
lea edx, [ebx + 4]
push edx
push dword [ebx]
call fcn.00471001
mov eax, 1
jmp 0x504511
push 0
push 0x138d
call fcn.0042c771
push eax
push 0
push ebx
call fcn.00505655
xor eax, eax
jmp 0x504511
cmp dword [0x565dc0], 0
je 0x50440c
push 0
push 0x138e
call fcn.0042c771
push eax
push 1
push 0
push 1
push 1
push ebx
call fcn.00518a45
cmp dword [ebx + 0x340], 0
jne 0x5043e0
call fcn.0042e455
mov dword [ebx + 0x340], eax
push dword [ebx + 0x3c8]
push dword [ebx + 0x340]
push 0
mov dx, word [ebx + 0x350]
push edx
add ebx, 0xcc
push ebx
call fcn.004887dc
mov eax, 1
jmp 0x504511
lea eax, [ebp - 0xc]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x22], 4
mov word [ebp - 0x24], 2
lea esi, [ebp - 0x2c]
push 0x10
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0054e10c
add esp, 0xc
mov word [ebp - 0x1c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x18]
push eax
call fcn.0054e09c
add esp, 0xc
mov dx, word [ebx + 0x350]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x1a], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x18], edx
push 0
push 2
push 0
mov cx, word [0x563c12]
push ecx
mov ax, word [0x563c10]
push eax
call fcn.004f316d
mov esi, eax
mov dword [ebx + 0x3c4], esi
cmp esi, 0xffffffff
jne 0x5044b2
push 0
push 0x138f
call fcn.0042c771
push eax
push 0
push ebx
call fcn.00505655
xor eax, eax
jmp 0x504511
push dword [ebx + 0x3c4]
call fcn.005279f5
push 0x10
push 0x8014
push dword [0x56f018]
push dword [ebx + 0x3c4]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x1c]
push edx
push dword [ebx + 0x3c4]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x50450f
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x50450f
push 0
push 0x1390
call fcn.0042c771
push eax
push 0
push ebx
call fcn.00505655
xor eax, eax
jmp 0x504511
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x505264
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x50526d
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x50528b
xor eax, eax
jmp 0x505487
xor edx, edx
mov dword [ebx + 0x39c], edx
push 1
push 2
push dword [ebx + 0x3c4]
push 0x8017
call fcn.00528a48
test eax, eax
je 0x5052b2
xor eax, eax
jmp 0x505487
inc dword [ebx + 0x3c0]
cmp dword [ebx + 0x3c0], 0x14
jl 0x5052e8
xor edx, edx
mov dword [ebx + 0x3c0], edx
push 0
push 2
push dword [ebx + 0x3c4]
push 0x8017
call fcn.00528a48
test eax, eax
je 0x5052e8
xor eax, eax
jmp 0x505487
cmp dword [ebx + 0x33c], 2
je 0x5052f8
xor eax, eax
jmp 0x505487
cmp dword [0x56d9dc], 0
jne 0x50531f
cmp dword [0x56d9d0], 0
jne 0x50531f
mov edx, dword [ebx + 0x34c]
cmp edx, dword [ebx + 0x354]
jae 0x50531f
xor eax, eax
jmp 0x505487
mov esi, dword [ebx + 0x348]
cmp dword [ebx + 0x3ac], 0
je 0x50535e
push ebx
call fcn.0050370a
mov esi, eax
test esi, esi
jne 0x50535e
push 0
push 2
push dword [ebx + 0x3c4]
push 0x8017
call fcn.00528a48
test eax, eax
je 0x505359
xor eax, eax
jmp 0x505487
mov esi, pe_nt_image_headers32
cmp esi, 0x2000
jle 0x50536b
mov esi, 0x2000
push dword [ebx + 0x338]
call fcn.00553338
pop ecx
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebx + 0x338]
call fcn.00552388
add esp, 0xc
mov esi, eax
test esi, esi
jge 0x5053b2
push 0
push 0x1397
call fcn.0042c771
push eax
push 0
push ebx
call fcn.00505655
xor eax, eax
jmp 0x505487
test esi, esi
jne 0x5053bd
xor eax, eax
jmp 0x505487
push 0
push esi
lea edx, [ebp - 0x2004]
push edx
push dword [ebx + 0x3c4]
call sub.WSOCK32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x505418
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x5053ff
push 0
push dword [ebp - 4]
push dword [ebx + 0x338]
call fcn.005522e4
add esp, 0xc
xor eax, eax
jmp 0x505487
push 0
push 0x139a
call fcn.0042c771
push eax
push 0
push ebx
call fcn.00505655
xor eax, eax
jmp 0x505487
cmp esi, edi
jle 0x505434
push 0
mov edx, dword [ebp - 4]
add edx, edi
push edx
push dword [ebx + 0x338]
call fcn.005522e4
add esp, 0xc
mov esi, edi
mov eax, esi
add dword [ebx + 0x354], eax
add dword [ebx + 0x3b0], eax
push ebx
call fcn.00504ff0
mov edx, dword [ebx + 0x354]
sub edx, dword [ebx + 0x34c]
mov ecx, dword [ebx + 0x348]
add ecx, ecx
lea ecx, [ecx + ecx*4]
cmp edx, ecx
setb al
and eax, 1
cmp dword [0x56d9dc], 0
jne 0x5052b2
cmp dword [0x56d9d0], 0
je 0x505485
test eax, eax
jne 0x5052b2
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x505490
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x5054a3
xor eax, eax
jmp 0x5055c0
cmp dword [ebx + 0x33c], 2
je 0x5054b3
xor eax, eax
jmp 0x5055c0
xor edx, edx
mov dword [ebx + 0x39c], edx
push 0
push 4
lea ecx, [ebp - 4]
push ecx
push dword [ebx + 0x3c4]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x505502
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x5054e6
xor eax, eax
jmp 0x5055c0
push 0
push 0x139a
call fcn.0042c771
push eax
push 0
push ebx
call fcn.00505655
xor eax, eax
jmp 0x5055c0
test eax, eax
jg 0x50551a
push 0x56db5e
push 0
push ebx
call fcn.00505655
xor eax, eax
jmp 0x5055c0
push dword [ebp - 4]
call sub.WSOCK32.dll_ntohl
cmp eax, dword [ebx + 0x34c]
ja 0x50553e
push 0x56db62
push 0
push ebx
call fcn.00505655
xor eax, eax
jmp 0x5055c0
mov edx, eax
mov dword [ebx + 0x34c], edx
mov eax, dword [ebx + 0x360]
cmp edx, eax
jb 0x505567
mov dword [ebx + 0x34c], eax
push 0x56db66
push 0
push ebx
call fcn.00505655
xor eax, eax
jmp 0x5055c0
push ebx
call fcn.00504ff0
mov eax, dword [ebx + 0x354]
cmp eax, dword [ebx + 0x360]
jae 0x5055be
sub eax, dword [ebx + 0x34c]
mov edx, dword [ebx + 0x348]
add edx, edx
lea edx, [edx + edx*4]
cmp eax, edx
setb cl
and ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 0x34c]
cmp eax, dword [ebx + 0x354]
jae 0x5055b4
cmp dword [0x56d9d0], 0
je 0x5055be
cmp dword [ebp - 4], 0
je 0x5055be
push ebx
call fcn.00505264
xor eax, eax
jmp 0x5055c0
xor eax, eax
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x5080f2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x57cddf
push 0x3e7
push 0xd
push 0x480
push esi
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x57cddf], 0
je 0x508189
push 0x57c9f8
push 0x3e7
call sub.KERNEL32.dll_GetCurrentDirectoryA
push 0x57c9f8
call fcn.0042e6d8
push 0x57cddf
push 0x57c9f8
call fcn.0054e1b0
add esp, 8
push 0x57c9f8
call fcn.00556250
pop ecx
push 0x56dd5f
push 0x57c9f8
call fcn.0054e5a0
add esp, 8
test eax, eax
je 0x508185
mov ebx, 1
cmp dword [ebp + 0xc], 0
je 0x50818b
call fcn.00412691
push eax
push 0x63
push 0x57c9f8
call fcn.0050d13a
jmp 0x50818b
xor ebx, ebx
jmp 0x50818b
xor ebx, ebx
push ebx
push 9
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_EnableWindow
push ebx
push 9
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
pop esi
pop ebx
pop ebp
ret 8

Function at 0x508245
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.dll_GetParent
mov ebx, eax
push 0x461
push ebx
call sub.USER32.dll_GetDlgItem
mov edi, eax
call sub.USER32.dll_GetFocus
cmp edi, eax
jne 0x508275
xor eax, eax
jmp 0x508302
push 0x57cddf
push 0x3e7
push 0xd
push 0x480
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x57cddf], 0
je 0x5082bb
push 0x2a
push 0x57cddf
call fcn.0054e1ec
add esp, 8
test eax, eax
jne 0x5082bb
push 0x3f
push 0x57cddf
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x5082bf
xor eax, eax
jmp 0x508302
test esi, esi
jne 0x5082c7
xor eax, eax
jmp 0x508302
push 0x12
call sub.USER32.dll_GetKeyState
movsx edx, ax
and edx, 0x8000
cmp edx, 0x8000
jne 0x508300
mov ebx, dword [esi + 0x1c]
test ebx, ebx
je 0x508300
cmp byte [ebx], 0
je 0x508300
call fcn.00412691
push eax
push 0
push ebx
call fcn.0050d13a
mov eax, 1
jmp 0x508302
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x5083b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x57c9f8
push edi
call sub.USER32.dll_GetParent
mov ebx, eax
mov eax, dword [0x56dd0c]
test eax, eax
je 0x5083dd
push eax
call sub.GDI32.dll_DeleteObject
xor edx, edx
mov dword [0x56dd0c], edx
mov eax, dword [0x56dd08]
test eax, eax
je 0x5083f4
push eax
call sub.GDI32.dll_DeleteObject
xor edx, edx
mov dword [0x56dd08], edx
push 0x57cddf
push 0x3e7
push 0xd
push 0x480
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x57cddf], 0
je 0x5084e8
push esi
push 0x3e7
call sub.KERNEL32.dll_GetCurrentDirectoryA
push esi
call fcn.0042e6d8
push 0x57cddf
push esi
call fcn.0054e1b0
add esp, 8
push esi
call fcn.0042f6ec
test eax, eax
je 0x50845f
push 0x56dd08
push 0x56dd0c
push edi
push esi
call fcn.0042f73c
jmp 0x5084e8
xor ebx, ebx
test ebx, ebx
jne 0x508475
push str..bmp
push esi
call fcn.0054e1b0
add esp, 8
jmp 0x5084c4
push 0x2e
push esi
call fcn.0054e574
add esp, 8
test eax, eax
je 0x508487
mov byte [eax], 0
cmp ebx, 1
jne 0x50849c
push str..jpg
push esi
call fcn.0054e1b0
add esp, 8
jmp 0x5084c4
cmp ebx, 2
jne 0x5084b1
push str..png
push esi
call fcn.0054e1b0
add esp, 8
jmp 0x5084c4
cmp ebx, 3
jne 0x5084c4
push str..gif
push esi
call fcn.0054e1b0
add esp, 8
push 0x56dd08
push 0x56dd0c
push edi
push esi
call fcn.0042f73c
cmp dword [0x56dd0c], 0
jne 0x5084e8
inc ebx
cmp ebx, 4
jl 0x508461
mov eax, dword [0x56dd0c]
test eax, eax
je 0x50850b
push 0
push 1
push 1
push dword [0x56dd08]
push eax
push 0x8b
push edi
call fcn.0042fabe
jmp 0x508520
push 0
push 1
push 2
push 0
push 0
push 0x8b
push edi
call fcn.0042fabe
pop edi
pop esi
pop ebx
pop ebp
ret 4