joyce8/EMBER2024-capa huggingface dataset:
Function at 0x26bfb8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00039d7c
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x26c00a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x26c003
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0003a9b8
jmp 0x26c00a
mov eax, esi
call fcn.00039d7c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x271a74
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x271bd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x2ac808], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x16c5cc]
call fcn.0016d718
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x271ba9
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0016d800
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0003a9b8
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x271bec
call fcn.0003ab68
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0016da8c
test al, al
je 0x271b93
lea ecx, [ebp - 4]
mov edx, 0x271c60
mov eax, dword [ebp - 0xc]
call fcn.0016e318
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0005dbfc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x271b93
xor edx, edx
push ebp
push 0x271b8c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x271c78
mov eax, dword [ebp - 8]
push eax
call fcn.00044ea4
test eax, eax
je 0x271b75
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x271b75
call fcn.00271a00
test eax, eax
je 0x271b65
mov eax, dword [ebx + 0x50]
jmp 0x271b68
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x2ac808]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x271b93
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x271bb0
mov eax, dword [ebp - 0xc]
call fcn.00037f10
ret

Function at 0x271cdc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x271d23
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x271d06
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x271d17
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x271d23
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x27f914
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x2b4430], 0
je 0x27fa55
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x2ad274]
mov edx, dword [edx]
xor al, byte [edx + 0xd4]
je 0x27fa55
mov eax, dword [0x2b4434]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x2b4430]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x27fa24
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x2b4430]
call fcn.000de2d8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x27fa1c
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x215], 0
je 0x27fa1c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x74]
test al, al
je 0x27fa1c
mov eax, dword [ebp - 0x14]
call fcn.0028b9f0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x27fa1c
push ebp
call fcn.0027f8d0
pop ecx
test al, al
jne 0x27fa1c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb8
call fcn.000382e8
test al, al
je 0x27fa1c
mov byte [ebp - 9], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 9]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb9
call fcn.000382e8
cmp byte [ebp - 9], 0
je 0x27fa1c
lea edx, [ebp - 8]
lea eax, [ebp - 0x28]
call fcn.000426ec
test al, al
je 0x27fa1c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x2b4434]
call fcn.0027f018
inc edi
dec ebx
jne 0x27f979
mov eax, dword [0x2b4434]
cmp dword [eax + 8], 0
jle 0x27fa3c
mov eax, dword [0x2b4434]
call fcn.0027f0cc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x27fa55
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0027f738
pop ecx
test al, al
jne 0x27fa55
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x28830c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00042bd4
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00281f64
test ebx, ebx
jne 0x28835f
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00288184
mov ebx, eax
test ebx, ebx
je SafeArrayPtrOfIndex
cmp esi, ebx
je reloc.advapi32.dll_RegEnumValueW
mov eax, dword [esp]
sub eax, dword [ebx + 0x50]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x54]
mov dword [esp + 0x118], eax
jmp 0x28839d
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x2883d5
add eax, 0xffffff5f
sub eax, 2
jb 0x2883ed
dec eax
sub eax, 2
jb 0x288401
dec eax
sub eax, 2
jb 0x2883f7
jmp 0x28840b
add eax, 0xfffffdff
sub eax, 2
jb 0x2883ed
dec eax
sub eax, 2
jb 0x288401
dec eax
sub eax, 2
jb 0x2883f7
jmp 0x28840b
mov byte [esp + RegCloseKeyx120], 0
jmp 0x288413
mov byte [esp + 0x120], 2
jmp 0x288413
mov byte [esp + 0x120], 1
jmp 0x288413
mov byte [esp + Sleepx120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0024fd68
mov esi, eax
call fcn.0027e9c4
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00283afc
mov dword [edi + 0xc], eax
mov al, 1
jmp SafeArrayPtrOfIndex
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x2942f8
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x294301
mov eax, dword [ebp - 4]
add esp, 0xffffffe0
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x2944a7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0003a1a4
push 0
push 0
push 0
push 0
push 0x2944b8
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x294485
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x1c], 0
je 0x29446a
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.0003a8fc
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x29446a
mov dl, 1
mov eax, dword [0xc28ec]
call fcn.00037ee0
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x294463
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4024]
xor ecx, ecx
mov edx, 0x4000
call fcn.0003784c
lea eax, [ebp - 0x10]
push eax
push 0x4000
lea eax, [ebp - 0x4024]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0x10], 0
jbe 0x2943ef
lea edx, [ebp - 0x4024]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [ebp - 0x10], 0
jne 0x2943ad
push 0
push 0
mov eax, dword [ebp - 0x24]
call fcn.000e2f0c
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx]
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.0003aa90
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx]
push eax
lea eax, [ebp - 0x18]
call fcn.0003a2b8
mov edx, eax
mov eax, dword [ebp - 0x24]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
push eax
call fcn.00117120
push 0
push 0
mov eax, dword [ebp - 0x24]
call fcn.000e2f0c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
call fcn.000e5a34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x29446a
mov eax, dword [ebp - 0x24]
call fcn.00037f10
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x29448c
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00117120
mov byte [ebp - 9], 1
ret

Function at 0x2944d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20e]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x20e]
call fcn.00055f28
mov esp, ebp
pop ebp
ret
Function at 0x2945dc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
xor edx, edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x294660
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x106
lea eax, [ebp - 0x210]
push eax
push 0x29466c
call sub.kernel32.dll_ExpandEnvironmentStringsW
cmp eax, 1
jbe 0x29463f
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x210]
mov ecx, 0x106
call fcn.0003a9b8
mov eax, dword [ebp - 0x214]
mov edx, dword [ebp - 4]
call fcn.0005c2b4
jmp 0x294647
mov eax, dword [ebp - 4]
call fcn.00039d7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x294667
lea eax, [ebp - 0x214]
call fcn.00039d7c
ret
Function at 0x402570
Capabilities:
Enumerate processes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov esi, dword [esp + 0x164]
mov edi, dword [esp + 0x168]
mov dword [esp + 4], 0
mov dword [esp + 8], edi
mov dword [esp], esi
call fcn.004129e4
mov dword [esp + 8], edi
mov dword [esp + 4], 0x422b80
mov dword [esp], esi
call fcn.00412548
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
test eax, eax
push ecx
push ecx
je 0x402624
lea ebp, [esp + 0x18]
mov dword [esp], eax
mov ebx, eax
mov dword [esp + 0x18], 0x128
mov dword [esp + 4], ebp
call sub.KERNEL32.dll_Process32First
test eax, eax
push edx
push edx
je 0x40261b
mov eax, dword [esp + 0x160]
cmp dword [esp + 0x20], eax
jne 0x40260d
lea eax, [esp + 0x3c]
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00412548
jmp 0x40261b
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32Next
jmp 0x4025e4
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
push eax
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404081
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push esi
push ebx
test byte [esp + 0x10], 3
mov ecx, dword [esp + 0x14]
jne 0x4040d7
xor eax, eax
xor esi, esi
jmp 0x4040bc
movzx edx, byte [edx + 0x422d80]
cmp dl, 0xff
je 0x4040d7
mov ebx, esi
and ebx, 3
cmp ebx, 2
je 0x4040ed
cmp ebx, 3
je 0x404101
dec ebx
movzx ebx, dl
je 0x4040db
shl ebx, 2
mov byte [ecx + eax], bl
inc esi
cmp esi, dword [esp + 0x10]
je 0x404107
mov edx, dword [esp + 0xc]
movzx edx, byte [edx + esi]
cmp dl, 0x3d
je 0x404107
lea ebx, [edx - 0x2b]
cmp bl, 0x4f
jbe 0x404094
xor eax, eax
jmp 0x404107
shr dl, 4
shl ebx, 4
and edx, 3
mov byte [ecx + eax + 1], bl
or byte [ecx + eax], dl
jmp 0x404104
mov bl, dl
shl edx, 6
shr bl, 2
mov byte [ecx + eax + 1], dl
and ebx, 0xf
or byte [ecx + eax], bl
jmp 0x404104
or byte [ecx + eax], dl
inc eax
jmp 0x4040bb
pop ebx
pop esi
ret

Function at 0x4051b5
Capabilities:
Resolve dns

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x28]
mov dword [esp], eax
call sub.WS2_32.dll_gethostbyname
mov esi, eax
xor eax, eax
push ecx
test esi, esi
je 0x40520e
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.004129e4
mov eax, dword [esi + 0xc]
mov word [ebx], 2
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx + 4], eax
movzx eax, word [esp + 0x24]
mov dword [esp], eax
call sub.WS2_32.dll_htons
push edx
mov word [ebx + 2], ax
mov al, 1
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x405214
Capabilities:
Set socket configuration

Disassembly:
push edi
push esi
push ebx
sub esp, 0x40
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x50]
test esi, 1
je 0x40524d
lea eax, [esp + 0x34]
mov dword [esp + 4], 0x8004667e
mov dword [esp], ebx
mov dword [esp + 0x34], 1
mov dword [esp + 8], eax
call sub.WS2_32.dll_ioctlsocket
sub esp, 0xc
test esi, 2
je 0x4052ec
lea edi, [esp + 0x33]
mov dword [esp + 0x10], 1
mov dword [esp + 8], 8
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
mov dword [esp + 0xc], edi
mov byte [esp + 0x33], 1
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
test eax, eax
jne 0x4052ec
lea eax, [esp + 0x34]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0x98000004
mov dword [esp], ebx
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0x2bf20
mov dword [esp + 0x3c], 0x1388
call sub.WS2_32.dll_WSAIoctl
sub esp, 0x24
and esi, 4
je 0x405321
lea eax, [esp + 0x34]
mov dword [esp + 0x10], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov byte [esp + 0x34], 1
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
add esp, 0x40
pop ebx
pop esi
pop edi
ret
Function at 0x405959
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call sub.WS2_32.dll_WSAStartup
test eax, eax
push edx
push edx
je 0x405985
mov dword [esp], 0
call sub.KERNEL32.dll_ExitProcess
mov dword [esp], 0x42b314
call sub.KERNEL32.dll_InitializeCriticalSection
push eax
add esp, 0x1ac
ret
Function at 0x405cc4
Capabilities:
Get socket status

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
mov edi, dword [esp + 0x154]
lea esi, [esp + 0x2c]
lea ebp, [ebx + 1]
test edi, edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0
jne 0x405d2c
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], ebp
call sub.WS2_32.dll_select
sub esp, 0x14
test eax, eax
je 0x405ce3
jmp 0x405d5b
lea eax, [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], ebp
mov dword [esp + 0x10], eax
call sub.WS2_32.dll_select
sub esp, 0x14
test eax, eax
jne 0x405d5b
xor eax, eax
jmp 0x405d72
test eax, eax
js 0x405d57
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
push edx
push edx
setne al
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x405d7d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
test esi, esi
je 0x405da4
cmp ebx, 0xffffffff
jne 0x405da6
mov ecx, ebx
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
mov ebx, ecx
dec ebx
jmp 0x405da6
xor ebx, ebx
mov dword [esp], 0x42b314
call sub.KERNEL32.dll_EnterCriticalSection
push edx
mov eax, dword [esp + 0x40]
mov dword [esp + 4], 0x2d
mov dword [esp], eax
call fcn.00405cc4
test al, al
jne 0x405dd5
xor ebx, ebx
or esi, 0xffffffff
jmp 0x405ec5
lea edi, [ebx + 5]
cmp edi, dword [0x42b310]
jbe 0x405e08
cmp dword [0x42b30c], 0
je 0x405df5
mov dword [esp], 0x42b30c
call fcn.00407f59
mov dword [esp], edi
call sub.msvcrt.dll_malloc
mov dword [0x42b310], edi
mov dword [0x42b30c], eax
mov eax, dword [0x42b30c]
test eax, eax
je 0x405dcb
test ebx, ebx
jle 0x405e5e
mov edx, dword [0x422844]
cmp dword [esp + 0x40], edx
lea eax, [eax + 5]
jne 0x405e4e
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0x42e280
mov dword [esp], 0x42e2a0
call fcn.00403cb2
jmp 0x405e5e
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00412aa3
mov eax, dword [0x42b30c]
mov edx, dword [esp + 0x44]
inc ebx
mov ebp, edi
or esi, 0xffffffff
mov dword [eax], ebx
mov byte [eax + 4], dl
xor ebx, ebx
cmp ebx, edi
jae 0x405ec5
mov eax, dword [0x42b30c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
add eax, ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
mov esi, eax
jne 0x405ebf
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x405ec5
mov dword [esp], 1
call fcn.00407ef4
jmp 0x405e74
add ebx, eax
sub ebp, eax
jmp 0x405e74
mov dword [esp], 0x42b314
call sub.KERNEL32.dll_LeaveCriticalSection
test ebx, ebx
push eax
je 0x405edc
inc esi
lea eax, [ebx - 5]
jne 0x405edf
or eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405ee7
Capabilities:
Get socket status

Disassembly:
push edi
push esi
push ebx
mov ebx, 3
sub esp, 0x130
lea edi, [esp + 0x24]
lea esi, [esp + 0x2c]
mov eax, dword [esp + 0x140]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], eax
inc eax
mov dword [esp + 0x24], 0x1e
mov dword [esp], eax
mov dword [esp + 0x28], 0
call sub.WS2_32.dll_select
sub esp, 0x14
test eax, eax
jne 0x405f96
test ebx, ebx
jne 0x405f90
mov eax, dword [esp + 0x140]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x98
mov dword [esp], eax
call fcn.00405d7d
inc eax
je 0x405f7d
mov ebx, 3
jmp 0x405efd
lea eax, [esp + 0x140]
mov dword [esp], eax
call fcn.00405999
xor eax, eax
jmp 0x405fb4
dec ebx
jmp 0x405efd
mov al, 0
js 0x405fb4
mov eax, dword [esp + 0x140]
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
push edx
push edx
setne al
add esp, 0x130
pop ebx
pop esi
pop edi
ret

Function at 0x405fbe
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
cmp eax, 0xffffffff
je 0x406003
test eax, eax
mov edx, eax
jne 0x406020
lea eax, [esp + 0x20]
mov dword [esp], eax
call fcn.00405999
xor edx, edx
jmp 0x406020
call sub.WS2_32.dll_WSAGetLastError
xor edx, edx
cmp eax, 0x2733
je 0x406020
lea eax, [esp + 0x20]
mov dword [esp], eax
call fcn.00405999
or edx, 0xffffffff
mov eax, edx
add esp, 0x1c
ret
Function at 0x406304
Capabilities:
Get disk information

Disassembly:
push edi
push esi
mov eax, 0x1010
push ebx
call fcn.0041f3f0
sub esp, eax
lea esi, [esp + 0x10]
mov dword [esp], 0x1000
mov edi, dword [esp + 0x1020]
mov dword [esp + 4], esi
mov ebx, esi
call sub.KERNEL32.dll_GetLogicalDriveStringsA
test eax, eax
push ecx
push ecx
jne 0x406350
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xa5
jmp 0x40637e
mov eax, ebx
sub eax, esi
cmp byte [ebx], 0
je 0x40636e
mov dword [esp], ebx
add ebx, 4
call sub.KERNEL32.dll_GetDriveTypeA
push edx
mov byte [ebx - 2], al
mov byte [ebx - 1], 7
jmp 0x406350
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0xa4
mov dword [esp], edi
call fcn.00405d7d
add esp, 0x1010
pop ebx
pop esi
pop edi
ret
Function at 0x406b2b
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8cc
mov ebx, dword [esp + 0x8e4]
mov eax, dword [esp + 0x8e8]
mov dword [esp + 4], 0x422f41
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.00412548
mov eax, dword [esp + 0x8e0]
mov dword [esp + 4], 0x422f44
mov dword [esp], eax
call sub.msvcrt.dll__wfopen
test eax, eax
je 0x406c1f
lea edi, [esp + 0x28]
lea ebp, [esp + 0xc0]
mov esi, eax
mov dword [esp], edi
call fcn.0040adea
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x800
mov dword [esp + 4], 1
mov dword [esp], ebp
call sub.msvcrt.dll_fread
test eax, eax
je 0x406bc6
cmp dword [0x42b32c], 0
je 0x406bc6
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], edi
call fcn.0040ae18
jmp 0x406b8b
lea ebp, [esp + 0x18]
mov dword [esp + 4], edi
mov dword [esp], ebp
call fcn.0040aec6
xor eax, eax
mov dl, byte [ebp + eax]
mov cl, dl
and edx, 0xf
shr cl, 4
cmp cl, 0xa
mov edi, ecx
sbb ecx, ecx
and ecx, 0xfffffff9
cmp dl, 0xa
lea ecx, [ecx + edi + 0x37]
mov byte [ebx + eax*2], cl
sbb ecx, ecx
and ecx, 0xfffffff9
lea edx, [ecx + edx + 0x37]
mov byte [ebx + eax*2 + 1], dl
inc eax
cmp eax, 0x10
jne 0x406bd8
mov eax, dword [esp + 0x8e8]
mov byte [ebx + eax - 1], 0
mov dword [esp], esi
call sub.msvcrt.dll_fclose
add esp, 0x8cc
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x406c2a
Capabilities:
Create process on windows

Disassembly:
push esi
push ebx
sub esp, 0x834
mov eax, dword [esp + 0x840]
lea ebx, [esp + 0x20]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x204
mov dword [esp + 4], 0
mov dword [esp + 0x10], ebx
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov eax, dword [esp + 0x844]
lea esi, [esp + 0x428]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x204
mov dword [esp + 4], 0
mov dword [esp + 0x10], esi
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov eax, dword [esp + 0x848]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x14], eax
call sub.SHELL32.DLL_ShellExecuteW
sub esp, 0x18
add esp, 0x834
pop ebx
pop esi
ret

Function at 0x406e04
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
sub esp, 0x438
mov eax, dword [esp + 0x440]
lea ebx, [esp + 0x28]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x204
mov dword [esp + 4], 0
mov dword [esp + 0x10], ebx
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
push edx
je 0x406e69
test al, 6
je 0x406e69
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], ebx
call sub.KERNEL32.dll_SetFileAttributesW
push ecx
push ecx
mov dword [esp], ebx
call sub.KERNEL32.dll_DeleteFileW
push edx
test eax, eax
setne al
add esp, 0x438
pop ebx
ret