joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5879c8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x5879e0
mov eax, ebx
call fcn.00587298
cmp dword [ebx + 0x68], 0
jne 0x5879ed
mov eax, ebx
call fcn.00587220
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.005870a0
lea eax, [esp + 0x10]
xor edx, edx
call fcn.005c5610
cmp eax, dword [esp]
je 0x587a5b
lea eax, [esp + 0x10]
xor edx, edx
call fcn.005c5624
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x587a37
adc edx, 0
push edx
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005c5610
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x587a50
adc edx, 0
push edx
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_InflateRect
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x587a76
push 3
mov eax, dword [esi + 0x10]
call fcn.0045a9dc
push eax
call sub.user32.dll_GetWindow
mov esi, eax
jmp 0x587a83
push 3
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x68]
call fcn.00453850
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00453874
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.0045389c
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.004538c0
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.0041e470
mov eax, ebp
mov edx, dword [0x6556c0]
mov byte [edx + 2], al
mov eax, dword [0x6556c0]
mov byte [eax], 0
mov eax, dword [0x6556c0]
mov byte [eax + 1], 0
mov eax, dword [0x6556c0]
mov byte [eax + 3], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0045a9dc
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0045a9dc
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0045a9dc
push eax
call sub.user32.dll_SetWindowLongA
push 2
mov eax, dword [0x6556c0]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042f970
call fcn.0042b4c8
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0045a9dc
push eax
mov eax, dword [0x65565c]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.0045a9dc
push eax
call sub.user32.dll_ShowWindow
push 0
push esi
call sub.user32.dll_ReleaseDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5a4b14
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.005a4b00
test eax, eax
jne 0x5a4b35
mov eax, esi
call fcn.00404574
jmp 0x5a4bc6
mov eax, ebx
call fcn.005a4c5c
test al, al
je 0x5a4b7b
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.00404664
test edi, edi
je 0x5a4b72
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
jmp 0x5a4bc6
mov eax, esi
call fcn.00404574
jmp 0x5a4bc6
mov ebp, dword [ebx + 0x70]
test ebp, ebp
je 0x5a4bbf
mov eax, dword [ebp + 0x208]
call fcn.004207c0
test eax, eax
jle 0x5a4bad
mov eax, dword [ebx + 0x70]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.00443a68
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.004045c8
jmp 0x5a4bc6
mov eax, esi
mov edx, dword [ebx + 0x70]
mov edx, dword [edx + 0x210]
call fcn.004045c8
jmp 0x5a4bc6
mov eax, esi
call fcn.00404574
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5c445c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffc4
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x5c460f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f970
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x70]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
call fcn.00466fe4
call fcn.00568e98
mov edx, dword [ebp + 8]
mov dword [edx - 0x4c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x4c], 0
je 0x5c44e0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov eax, dword [eax + 0x68]
call fcn.0042a6fc
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f970
mov eax, dword [eax + 0xc]
pop edx
call fcn.0042a704
mov eax, dword [ebp + 8]
mov dword [eax - 0x50], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042a5e4
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.0040a5fc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x50]
push eax
push 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f970
call fcn.0042b4c8
push eax
call sub.gdi32.dll_GetObjectA
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042a658
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042a694
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042a694
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042a694
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042a6fc
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectA
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f970
mov eax, dword [eax + 0xc]
pop edx
call fcn.0042a590
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f970
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x54], 0x23
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x94]
mov edx, dword [ecx + edx*4 + 0xc]
call fcn.0042a3d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c4616
lea eax, [ebp - 4]
call fcn.00404574
ret
Function at 0x5c59f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.004746e0
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, esi
jb 0x5c5a03
pop esi
pop ebx
ret

Function at 0x5c5f38
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00409f98
test al, al
je 0x5c5fbf
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00402f1c
or esi, 0x100
test esi, esi
jns 0x5c5f73
call fcn.004035e0
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404a44
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x5c5fbf
mov dl, 1
mov eax, dword [0x42956c]
call fcn.00430f3c
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.0043130c
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x5c5fbf
mov eax, esp
call fcn.004107bc
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret

Function at 0x5c62bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x658fec
test esi, esi
jne 0x5c62d6
xor eax, eax
jmp 0x5c63d8
cmp dword [ebp], 0
jne 0x5c62e1
call fcn.005c624c
xor ebx, 0xffffffff
cmp edi, 8
jb 0x5c63b1
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x5c62ed
test edi, edi
jbe 0x5c63d3
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x5c63b5
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5d5244
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5d53e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
mov dl, 6
mov eax, 0x5d53f8
call fcn.004f14f4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x2a0], 1
jg 0x5d52e5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov al, byte [eax + 0x2a4]
call fcn.004f6808
test al, al
je 0x5d5369
mov eax, dword [0x65589c]
cmp dword [eax], 6
jge 0x5d52ca
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005d48ec
mov eax, dword [ebp - 8]
mov edx, 0x5d5414
call fcn.00404990
jne 0x5d5369
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov al, byte [eax + 0x2a4]
mov dl, 1
call fcn.005460b8
mov byte [ebp - 1], al
jmp 0x5d5369
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2b0]
call fcn.00404844
mov esi, eax
test esi, esi
jle 0x5d5369
mov ebx, 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2b0]
mov al, byte [eax + ebx - 1]
call fcn.004f6808
test al, al
je 0x5d5365
mov eax, dword [0x65589c]
cmp dword [eax], 6
jge 0x5d534b
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2b0]
mov al, byte [eax + ebx - 1]
call fcn.00545704
mov eax, dword [ebp - 0xc]
mov edx, 0x5d5414
call fcn.00404990
jne 0x5d5365
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2b0]
mov al, byte [eax + ebx - 1]
mov dl, 1
call fcn.005460b8
mov byte [ebp - 1], al
inc ebx
dec esi
jne 0x5d5301
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
mov edi, eax
cmp edi, 0x7d0
jb 0x5d53b4
mov eax, edi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.00409a28
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x5d5424
call fcn.00404890
mov eax, dword [ebp - 0x14]
call fcn.00404a44
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.0040477c
mov eax, dword [ebp - 0x10]
mov dl, 6
call fcn.004f14f4
cmp byte [ebp - 1], 0
je 0x5d53c5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005d4964
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d53e7
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404598
ret

Function at 0x5d56e0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047f4
add esp, 0x108
pop ebx
ret

Function at 0x5d65f4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
test eax, esi
je 0x5d6634
mov eax, ebx
add al, 0x41
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 2
setb al
test al, al
jne 0x5d663c
inc ebx
cmp ebx, 0x1b
jne 0x5d660a
xor eax, eax
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5d8614
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5d875b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
mov edx, dword [ebp - 0xc]
call fcn.00404990
jne 0x5d867e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc4]
mov edx, dword [ebp - 8]
call fcn.00404990
jne 0x5d867e
call fcn.004cd230
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0xc8]
cmp eax, 0xdbba0
jae 0x5d867e
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x5d8711
mov eax, dword [ebp - 4]
cmp word [eax + 0x6a], 0
je 0x5d86fd
xor eax, eax
push ebp
push 0x5d86d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 0xc]
call fcn.004e6660
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.0040477c
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x6c]
call dword [ebx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5d8711
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp + 8]
mov edx, 0x5d8778
call fcn.004045c8
cmp dword [ebp - 0x10], 0
jne 0x5d8745
mov eax, dword [ebp - 4]
add eax, 0xc0
mov edx, dword [ebp - 0xc]
call fcn.004045c8
mov eax, dword [ebp - 4]
add eax, 0xc4
mov edx, dword [ebp - 8]
call fcn.004045c8
call fcn.004cd230
mov edx, dword [ebp - 4]
mov dword [edx + 0xc8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d8762
lea eax, [ebp - 0x14]
call fcn.00404574
ret
Function at 0x5da840
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5da953
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov byte [ebp - 0xd], 0
mov dl, 1
mov eax, dword [0x41d08c]
call fcn.00403670
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov ecx, 0x5da96c
mov edx, dword [ebp - 8]
call fcn.00404890
mov eax, dword [ebp - 0x14]
call fcn.0040a1d0
lea eax, [ebp - 0x18]
mov ecx, 0x5da984
mov edx, dword [ebp - 8]
call fcn.00404890
mov eax, dword [ebp - 0x18]
call fcn.0040a1d0
xor eax, eax
push ebp
push 0x5da931
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
mov dl, 9
mov eax, dword [ebp - 0xc]
call fcn.005da2c4
test al, al
je 0x5da8d6
push ebp
call fcn.005da708
pop ecx
mov ebx, eax
test ebx, ebx
jle 0x5da910
push 0x5da998
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0040993c
push dword [ebp - 0x20]
push 0x5da9b4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404904
mov eax, dword [ebp - 0x1c]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5da938
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.005da368
mov eax, dword [ebp - 4]
call fcn.004036a0
ret

Function at 0x5dac04
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff4c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov eax, dword [ebp - 4]
call fcn.00404a34
lea ebx, [ebp - 0xac]
xor eax, eax
push ebp
push 0x5dad25
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 4]
call fcn.0040956c
cmp dword [ebp - 0xb0], 0
je 0x5dacff
lea eax, [ebp - 0xb4]
mov ecx, dword [ebp - 4]
mov edx, 0x5dad3c
call fcn.00404890
mov eax, dword [ebp - 0xb4]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, ebx
xor ecx, ecx
mov edx, 0xa8
call fcn.00402f1c
mov dword [ebx], 0xfffffffe
mov byte [ebx + 4], 1
mov byte [ebx + 5], 3
mov byte [ebx + 6], 1
xor eax, eax
mov dword [ebx + 7], eax
xor eax, eax
mov dword [ebx + 0xb], eax
mov byte [ebx + 0xf], 4
mov word [ebx + 0x10], 0
mov word [ebx + 0x12], 0
mov byte [ebx + 0x14], 2
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.wsock32.dll_inet_addr
push eax
call sub.wsock32.dll_ntohl
mov dword [ebx + 0x15], eax
mov dword [ebx + 0x19], 0xffffffff
mov byte [ebx + 0x1d], 4
mov word [ebx + 0x1e], 0
mov word [ebx + 0x20], 0
mov byte [ebx + 0x22], 2
mov byte [ebx + 0x23], 0
mov edx, ebx
mov ecx, 0xa8
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dad2c
lea eax, [ebp - 0xb4]
mov edx, 2
call fcn.00404598
lea eax, [ebp - 4]
call fcn.00404574
ret
Function at 0x5dc1e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x41d08c]
call fcn.00403670
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5dc2a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5dc2b8
call sub.kernel32.dll_OutputDebugStringA
mov ecx, dword [ebp - 0xc]
mov dl, 0xa
mov eax, dword [ebp - 4]
call fcn.005da2c4
test al, al
je 0x5dc285
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0041f9f4
mov esi, eax
lea ecx, [ebp - 0x23c]
movsx edx, word [esi + 6]
lea eax, [esi + 8]
call fcn.0050938c
test al, al
je 0x5dc27c
mov eax, 0x230
call fcn.0040280c
mov esi, eax
mov edx, esi
lea eax, [ebp - 0x23c]
mov ecx, 0x230
call fcn.00402a14
mov edx, esi
mov eax, edi
call fcn.0041f898
inc dword [ebp - 8]
inc ebx
mov eax, dword [ebp - 0xc]
cmp ebx, dword [eax + 8]
jl 0x5dc230
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dc2ad
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005da368
mov eax, dword [ebp - 0xc]
call fcn.004036a0
ret

Function at 0x5dd16c
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
mov ebx, eax
push 0x5dd220
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [ebx + 0x28], esi
test esi, esi
je 0x5dd21d
push 0x5dd230
push esi
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx + 4], eax
push 0x5dd244
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx + 8], eax
push 0x5dd254
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx + 0xc], eax
push 0x5dd26c
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx + 0x10], eax
push 0x5dd280
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx + 0x14], eax
push 0x5dd290
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx + 0x18], eax
push 0x5dd29c
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx + 0x1c], eax
push 0x5dd2ac
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx + 0x20], eax
push 0x5dd2bc
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx + 0x24], eax
pop esi
pop ebx
ret
Function at 0x5de994
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5deb32
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
call fcn.00404574
mov eax, dword [ebp - 8]
call fcn.00404574
xor esi, esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.iphlpapi.dll_GetAdaptersInfo_1
cmp eax, 0x6f
jne 0x5dea06
mov eax, dword [ebp - 0x14]
call fcn.0040280c
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.iphlpapi.dll_GetAdaptersInfo_1
xor edx, edx
push ebp
push 0x5deb10
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x5deafa
cmp dword [ebp - 0x14], 0
jbe 0x5deafa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x5deafa
lea eax, [ebp - 0x24]
lea edx, [ebx + 8]
mov ecx, 0x104
call fcn.004047f4
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.005de670
test al, 4
je 0x5deaf0
test al, 0x80
je 0x5deaf0
mov eax, dword [ebx + 0x19c]
call fcn.005de4cc
cmp eax, 5
jne 0x5deae5
cmp dword [ebp + 0xc], 0
je 0x5dea85
mov eax, dword [ebp + 0xc]
push esi
mov esi, ebx
mov edi, eax
mov ecx, 0xa0
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [ebp - 4]
lea edx, [ebx + 8]
mov ecx, 0x104
call fcn.004047f4
mov eax, dword [ebp - 8]
lea edx, [ebx + 0x1c0]
mov ecx, 0x10
call fcn.004047f4
mov eax, dword [ebp - 0xc]
lea edx, [ebx + 0x1d8]
mov ecx, 0x10
call fcn.004047f4
mov byte [ebp - 0xd], 1
cmp dword [ebp + 8], 0
je 0x5deae4
lea ecx, [ebx + 0x1c0]
lea edx, [ebx + 0x1b0]
mov eax, dword [ebp + 8]
call fcn.005de944
test al, al
je 0x5deae4
call fcn.00403f9c
jmp 0x5deb17
inc esi
cmp esi, 1
jle 0x5deaf0
mov byte [ebp - 0xd], 0
jmp 0x5deafa
mov ebx, dword [ebx]
test ebx, ebx
jne 0x5dea31
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5deb17
mov eax, dword [ebp - 0x18]
call fcn.0040282c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5deb39
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404598
ret
Function at 0x5e0470
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e0587
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00404a44
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x5e055b
cmp dword [ebp - 4], 7
jne 0x5e0543
mov eax, dword [ebp - 8]
call fcn.0040280c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5e053c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, edi
call fcn.00404a44
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, dword [ebp - 0xc]
jmp 0x5e0521
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.0040477c
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push ebx
call sub.kernel32.dll_lstrlenA_1
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x5e0504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e0571
mov eax, dword [ebp - 0xc]
call fcn.0040282c
ret
mov ecx, 0x5e05a0
mov dl, 1
mov eax, dword [0x43e43c]
call fcn.0040e550
call fcn.00403ef0
jmp 0x5e0571
mov ecx, 0x5e05c0
mov dl, 1
mov eax, dword [0x408468]
call fcn.0040e550
call fcn.00403ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e058e
lea eax, [ebp - 0x10]
call fcn.00404574
ret