joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ffc4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc98
push ebx
xor ecx, ecx
mov dword [ebp - 0x368], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048e0
xor eax, eax
push ebp
push 0x45010a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4500da
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20d]
mov edx, dword [ebp - 4]
call fcn.00408994
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402c38
lea eax, [ebp - 0x30d]
mov edx, dword [ebp - 0xc]
call fcn.00408994
lea eax, [ebp - 0x354]
xor ecx, ecx
mov edx, 0x44
call fcn.004030d4
mov dword [ebp - 0x354], 0x44
mov dword [ebp - 0x328], 1
mov word [ebp - 0x324], bx
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x354]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x20d]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4500ae
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x368]
mov ecx, 0x450124
mov edx, dword [0x453bd4]
call fcn.0040473c
mov eax, dword [ebp - 0x368]
call fcn.00408744
call fcn.00403ef0
jmp 0x4500e1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x364]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x364]
push eax
call sub.kernel32.dll_GetExitCodeProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4500e1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450111
lea eax, [ebp - 0x368]
call fcn.00404430
lea eax, [ebp - 0xc]
call fcn.00404430
lea eax, [ebp - 4]
call fcn.00404430
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x42870fd4
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6e62647c
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x44e288]
shl eax, 2
mov dword [0x44e28c], eax
push edi
push ecx
xor eax, eax
mov edi, 0x456818
mov ecx, 0x45bb1c
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push edx
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov edx, eax
call fcn.00441f34
pop edx
push 0
call fcn.00442f54
pop ecx
push 0x44e250
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x44e290], eax
push 0
jmp fcn.004484e4

Function at 0x401dac
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0x44e5b8
call sub.USER32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401dcf
push 0
push dword [ebp - 4]
call sub.USER32.dll_ShowWindow
pop ecx
pop ebp
ret

Function at 0x401dd4
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.Shell_TrayWnd
call sub.USER32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401df7
push 9
push dword [ebp - 4]
call sub.USER32.dll_ShowWindow
pop ecx
pop ebp
ret

Function at 0x402148
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.KERNEL32.dll_GlobalMemoryStatus
mov edx, dword [ebp - 0x18]
mov dword [0x44e550], edx
mov ecx, dword [ebp - 0x14]
mov dword [0x44e558], ecx
cmp dword [0x44e554], 0
je 0x402184
mov eax, dword [ebp - 0x14]
cmp eax, dword [0x44e554]
jae 0x40218d
mov edx, dword [ebp - 0x14]
mov dword [0x44e554], edx
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [0x44e55c]
jbe 0x4021a0
mov eax, dword [ebp - 0x14]
mov dword [0x44e55c], eax
cmp dword [0x44e548], 0xffffffff
je 0x4021b4
mov edx, dword [ebp - 0x1c]
cmp edx, dword [0x44e548]
jge 0x4021bd
mov ecx, dword [ebp - 0x1c]
mov dword [0x44e548], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [0x44e54c]
jbe 0x4021d1
mov edx, dword [ebp - 0x1c]
mov dword [0x44e54c], edx
mov esp, ebp
pop ebp
ret
Function at 0x40c7b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
push str.NVDPACKFILE
mov eax, dword [ebp + 8]
add eax, 0x2c
push eax
mov edx, dword [0x456554]
push dword [edx]
call sub.KERNEL32.dll_FindResourceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40c8c9
push dword [ebp - 8]
mov ecx, dword [0x456554]
push dword [ecx]
call sub.KERNEL32.dll_SizeofResource
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], eax
push dword [ebp - 8]
mov eax, dword [0x456554]
push dword [eax]
call sub.KERNEL32.dll_LoadResource
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x40c8c9
mov edx, dword [ebp + 8]
push dword [edx]
call sub.KERNEL32.dll_LockResource
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
push dword [ebp + 8]
call fcn.0040c73c
pop ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0x2000
push 0x44f06d
mov edx, dword [ebp + 8]
push dword [edx + 0x20]
call fcn.004022e8
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0
je 0x40c8c9
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], 0x1000
push 0x44f07b
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x18]
inc eax
push eax
call fcn.004022e8
add esp, 8
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x1c], 0
je 0x40c8c9
push str.LoadResources
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
call fcn.004022e8
add esp, 8
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xc], 0
je 0x40c8c9
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
push 0
mov edx, dword [ebp + 8]
push dword [edx + 0xc]
call fcn.00442020
add esp, 0xc
mov byte [ebp - 1], 1
cmp byte [ebp - 1], 0
jne 0x40c8da
push str.Error_Loading_Packed_Resources
call fcn.00401ec0
pop ecx
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret

Function at 0x40d78c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 1], 0
push str.NVDCASTFILE
push dword [ebp + 0xc]
mov eax, dword [0x456554]
push dword [eax]
call sub.KERNEL32.dll_FindResourceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40d7e6
push dword [ebp - 8]
mov edx, dword [0x456554]
push dword [edx]
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40d7e6
push dword [ebp - 0xc]
call sub.KERNEL32.dll_LockResource
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2c], eax
push dword [ebp + 8]
call fcn.0040d73c
pop ecx
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x40d910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 1], 0
push str.NVDPARMFILE
push dword [ebp + 0xc]
mov eax, dword [0x456554]
push dword [eax]
call sub.KERNEL32.dll_FindResourceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40d96a
push dword [ebp - 8]
mov edx, dword [0x456554]
push dword [edx]
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40d96a
push dword [ebp - 0xc]
call sub.KERNEL32.dll_LockResource
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x34], eax
push dword [ebp + 8]
call fcn.0040d8c0
pop ecx
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x40f490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
lea eax, [ebp - 8]
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegOpenKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40f4e8
mov dword [ebp - 0xc], 0x104
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 0x110]
push ecx
push 0
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegQueryValueA
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 0x10]
call sub.KERNEL32.dll_lstrcpyA
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x40f4f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 5
push dword [ebp - 8]
push 0
push 0
push dword [ebp + 8]
push str.open
push 0
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
jg 0x40f60f
lea edx, [ebp - 0x214]
push edx
push str..htm
push 0x80000000
call fcn.0040f490
add esp, 0xc
test eax, eax
jne 0x40f616
push str._shellopencommand
lea ecx, [ebp - 0x214]
push ecx
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x214]
push eax
lea edx, [ebp - 0x214]
push edx
push 0x80000000
call fcn.0040f490
add esp, 0xc
test eax, eax
jne 0x40f616
push 0x4508ff
lea ecx, [ebp - 0x214]
push ecx
call fcn.00442281
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40f5d4
push 0x450904
lea eax, [ebp - 0x214]
push eax
call fcn.00442281
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40f5cc
lea edx, [ebp - 0x214]
push edx
call sub.KERNEL32.dll_lstrlenA
lea ecx, [ebp - 0x215]
add eax, ecx
mov dword [ebp - 0xc], eax
jmp 0x40f5da
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
jmp 0x40f5da
mov edx, dword [ebp - 0xc]
mov byte [edx], 0
push 0x450907
push dword [ebp - 0xc]
call sub.KERNEL32.dll_lstrcatA
push dword [ebp + 8]
push dword [ebp - 0xc]
call sub.KERNEL32.dll_lstrcatA
push dword [ebp - 8]
lea ecx, [ebp - 0x214]
push ecx
call sub.KERNEL32.dll_WinExec
cmp eax, 0x1f
jbe 0x40f616
mov dword [ebp - 4], 1
jmp 0x40f616
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
setne al
and eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41b204
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x41b29f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4579e4
push 0x101
call sub.WSOCK32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x41b284
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0043b7c4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x41b2b4
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
lea edx, [ebp - 0x20]
mov eax, dword [0x456640]
call fcn.00441628
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x41aad0]
call fcn.0043c388
call fcn.00440134
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b2a6
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00440634
ret

Function at 0x41b66c
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00440a50
push eax
call sub.WSOCK32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.0043f88c
test ebx, ebx
je 0x41b6b7
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x41b7d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41b92c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x41b81e
lea edx, [ebp - 0x1c]
mov eax, dword [0x45664c]
call fcn.00441628
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x41aad0]
call fcn.0043c34c
call fcn.00440134
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x41b855
lea edx, [ebp - 0x1c]
mov eax, dword [0x456648]
call fcn.00441628
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x41aad0]
call fcn.0043c34c
call fcn.00440134
xor eax, eax
push ebp
push 0x41b8f9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.0043fca0
mov eax, dword [ebp + 0xc]
push eax
mov ax, word [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0041b6fc
mov eax, dword [ebp - 4]
call fcn.0041b5f4
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.0043fca0
push 0x10
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll_connect
mov edx, 0x41b944
call fcn.0041b138
mov eax, dword [ebp - 4]
test byte [eax + 0x28], 0x10
jne 0x41b8ef
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
setne al
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.0043fca0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41b916
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b933
lea eax, [ebp - 0x1c]
call fcn.00440610
ret
Function at 0x41bab0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041b454
xor edx, edx
push ebp
push 0x41bc12
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x41bbfc
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x41bafa
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x41bb04
call fcn.004401d4
jmp 0x41bc19
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00435f80
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 4]
mov ebx, eax
test ebx, ebx
jle 0x41bbf1
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x41bbad
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x41bb9d
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.0043fca0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0041ba68
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x41bc24]
cmp dl, byte [eax + 0x28]
je 0x41bbf8
call fcn.0043c2f0
jmp 0x41bbf8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.00435f90
jmp 0x41bbf8
cmp eax, ebx
jge 0x41bbc8
mov edx, ebx
sub edx, eax
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00435f90
jmp 0x41bb04
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00435f80
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00435f9c
cmp ebx, eax
jne 0x41bb04
push ebp
call fcn.0041ba68
pop ecx
jmp 0x41bbf8
push ebp
call fcn.0041ba68
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bc19
mov eax, dword [ebp - 4]
call fcn.0041b460
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bc28
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41bd5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0041b454
xor eax, eax
push ebp
push 0x41bd3a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x41bc7b
call fcn.004401d4
jmp 0x41bd41
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x41bd24
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x41bd24
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.0043fca0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x41bd24
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0043b7c4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x41bd74
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
lea edx, [ebp - 0x2c]
mov eax, dword [0x456640]
call fcn.00441628
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x41aad0]
call fcn.0043c388
call fcn.00440134
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bd41
mov eax, dword [ebp - 4]
call fcn.0041b460
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bd63
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00440634
ret
Function at 0x41bdc8
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41bf24
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0041b454
xor eax, eax
push ebp
push 0x41bf02
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x41be30
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x41be30
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll_ioctlsocket
jmp 0x41beec
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x41be43
call fcn.004401d4
jmp 0x41bf09
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x41beec
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x41beec
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.0043fca0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x41beec
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0043b7c4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x41bf3c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
lea edx, [ebp - 0x2c]
mov eax, dword [0x456640]
call fcn.00441628
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x41aad0]
call fcn.0043c388
call fcn.00440134
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bf09
mov eax, dword [ebp - 4]
call fcn.0041b460
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bf2b
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00440634
ret

Function at 0x41d2a4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00440610
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x41d305
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x41d305
cmp byte [ebp - 0x102], 0
je 0x41d305
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.0044083c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e6ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x28], 0
je 0x41e72d
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x41e6de
add word [ebp - 6], 0x2000
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x41e6f0
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x41e6fc
add word [ebp - 6], 0x8000
xor ebx, ebx
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.0041e538
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41e721
push ebp
mov eax, dword [ebp - 4]
call fcn.0041e61c
pop ecx
mov ebx, eax
cmp bl, 2
je 0x41e6fc
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41f9ec
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41f9f2
ret

Function at 0x4246ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x457c1c
cmp dword [edi], 0
jne 0x424768
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x457c18]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x452ea0
mov ecx, 2
call fcn.0043f70c
mov edx, 0x4246c4
lea eax, [esi + 5]
call fcn.004246e4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004246e4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42473d
mov dword [0x457c18], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x424884
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4248d4]
test si, 4
je 0x424898
or bl, 1
test si, 8
je 0x4248a2
or bl, 4
test si, 1
je 0x4248ac
or bl, 8
test si, 2
je 0x4248b6
or bl, 0x10
test si, 0x10
je 0x4248c0
or bl, 0x20
push 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4248cf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4248d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x424910]
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4248f1
or bl, 1
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x424900
or bl, 4
test esi, 0x20000000
je 0x42490b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret