joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455410
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4555bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45559c
mov dl, 1
mov eax, dword [0x412990]
call fcn.00403bec
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404a2c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45558b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004432c0
test al, al
je 0x45557e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4555cc
lea eax, [ebp - 0x254]
call fcn.004098f4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45557e
xor eax, eax
push ebp
push 0x455577
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x455604
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x455560
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404c9c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x455560
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404c9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45557e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x455481
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00416550
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4555c2
lea eax, [ebp - 0x260]
call fcn.00404a2c
ret

Function at 0x455f4c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x468bb4]
cmp byte [eax + 0xa5], 0
jne 0x455fbd
cmp dword [0x468bcc], 0
jne 0x455f7e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x455f08
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x468bcc], eax
cmp dword [0x468bc8], 0
jne 0x455f99
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x468bc8], eax
cmp dword [0x468bd0], 0
jne 0x455fbd
push esp
push 0
push 0
push 0x455eac
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x468bd0], eax
pop edx
ret
Function at 0x456650
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x468bb4]
cmp dword [eax + 0x30], 0
je 0x4566fa
cmp dword [ebx + 0x94], 0
jne 0x4566f4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4565e0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4566f4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4566ba
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4566f4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004149c0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4566c9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x457258
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45728d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404b1c
jmp 0x45729a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404a80
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4583c4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x458405
mov eax, esi
call fcn.0043e8ec
test al, al
je 0x458405
mov eax, dword [ebx + 0x84]
call fcn.0043e5e8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x458405
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043e5e8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45a424
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x45a4d1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 4], eax
mov dl, 1
mov eax, dword [0x412c80]
call fcn.00403bec
mov esi, eax
mov dword [ebx + 0xc], esi
mov eax, dword [ebx + 8]
cdq
push edx
push eax
mov eax, esi
call fcn.00416684
mov esi, dword [ebx + 0xc]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, esi
call fcn.00416620
lea eax, [ebp - 4]
mov edx, 0x45a4e8
call fcn.00404ac4
mov eax, dword [ebp - 4]
call fcn.00404eec
mov edx, eax
mov ecx, 1
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov byte [ebx + 0x34], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a4d8
lea eax, [ebp - 4]
call fcn.00404a2c
ret
Function at 0x45a570
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
fild qword [ebp - 0x28]
fmul qword [ebp + 8]
call fcn.00402f14
push eax
push 0
push 0x400
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
fild qword [ebp - 0x30]
fmul qword [ebp + 8]
call fcn.00402f14
call fcn.00405828
pop edx
xchg edx, eax
sub eax, edx
cmp eax, 0x10000
jge 0x45a5cf
mov eax, 0x10000
mov esp, ebp
pop ebp
ret 8

Function at 0x45a5d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404a2c
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
push 0
call sub.kernel32.dll_GetTempPathA
mov ebx, eax
mov eax, ebx
call fcn.0040d770
mov eax, ebx
call fcn.00408660
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45a6ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_GetTempPathA
call fcn.0040d770
mov eax, pe_nt_image_headers32
call fcn.00408660
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45a68e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x45a6d8
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetTempFileNameA
call fcn.0040d770
mov eax, dword [ebp - 0xc]
call fcn.0040923c
mov ecx, eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00404b1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a695
mov eax, dword [ebp - 8]
call fcn.00402aa8
ret
Function at 0x45b780
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b8c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x45b8e0
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0045cf40
mov eax, dword [ebp - 4]
call fcn.0045c93c
xor edx, edx
push ebp
push 0x45b8ab
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10098], 0
jne 0x45b84a
test si, si
jne 0x45b7f0
mov eax, dword [ebp - 8]
call fcn.0040923c
mov esi, eax
cmp esi, 0xffff
jbe 0x45b7f0
call fcn.00403b58
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10110]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x45b84a
cmp eax, 0xffffffff
jle 0x45b81f
sub ebx, eax
jmp 0x45b82e
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0045ce74
test ebx, ebx
je 0x45b84a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10098], 0
jne 0x45b84a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x100bd], 0
je 0x45b7f3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10098], 0
je 0x45b895
mov eax, dword [ebp - 4]
mov byte [eax + 0x10098], 0
mov ecx, 0x45b8f8
mov dl, 1
mov eax, dword [0x45a938]
call fcn.0040c25c
call fcn.004043bc
mov eax, dword [ebp - 4]
cmp word [eax + 0x1010a], 0
je 0x45b895
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1010c]
call dword [ebx + 0x10108]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b8b2
mov eax, dword [ebp - 4]
call fcn.0045c9a0
ret
Function at 0x45bd74
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404edc
xor eax, eax
push ebp
push 0x45bf43
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x45bf58
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.0045cf40
push 0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x412b90]
call fcn.00416ab4
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x45bed3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10098], 0
jne 0x45be8f
mov eax, dword [ebp - 4]
lea edx, [eax + 0x30]
mov ecx, 0x10000
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
push 0
push ebx
mov eax, dword [ebp - 0x10]
sub eax, ebx
cmp eax, 0x10000
jbe 0x45be0b
call fcn.00403b58
mov edx, dword [ebp - 4]
lea eax, [edx + eax + 0x30]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10110]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x45be8f
cmp eax, 0xffffffff
jle 0x45be60
sub ebx, eax
mov edx, dword [ebp - 4]
add dword [edx + 0x10094], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x100da], 0
je 0x45be56
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x100dc]
call dword [esi + 0x100d8]
mov eax, dword [ebp - 4]
call fcn.0045c93c
jmp 0x45be6f
lea ecx, [ebp - 0x14]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0045ce74
mov eax, dword [0x467d34]
mov eax, dword [eax]
call fcn.00457508
test ebx, ebx
je 0x45be8f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10098], 0
je 0x45bdf7
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 0xc]
call fcn.00416600
cmp edx, dword [esp + 4]
jne 0x45bea9
cmp eax, dword [esp]
pop edx
pop eax
je 0x45bebd
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10098], 0
je 0x45bdce
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45beda
mov eax, dword [ebp - 0xc]
call fcn.00403c1c
ret
Function at 0x45bf80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45c12b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x45c140
mov dl, 8
mov eax, ebx
call fcn.0045cf40
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00416620
cmp byte [ebx + 0x10098], 0
jne 0x45c0d7
xor eax, eax
mov dword [ebx + 0x10094], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x45bfe4
call fcn.00403b58
mov dword [ebx + 0x100c4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.00416600
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x45c012
call fcn.00403b58
cmp eax, 0x10000
jle 0x45c01e
mov eax, 0x10000
lea edx, [ebx + 0x30]
mov ecx, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0
push esi
mov eax, dword [ebp - 8]
sub eax, esi
cmp eax, 0x10000
jbe 0x45c045
call fcn.00403b58
lea eax, [ebx + eax + 0x30]
push eax
movzx eax, word [ebx + 0x10110]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x45c115
test eax, eax
jle 0x45c085
sub esi, eax
add dword [ebx + 0x10094], eax
cmp word [ebx + 0x100da], 0
je 0x45c093
mov edx, ebx
mov eax, dword [ebx + 0x100dc]
call dword [ebx + 0x100d8]
jmp 0x45c093
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.0045ce74
mov eax, dword [0x467d34]
mov eax, dword [eax]
call fcn.00457508
test esi, esi
je 0x45c0ac
cmp byte [ebx + 0x10098], 0
je 0x45c031
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.00416600
cmp edx, dword [esp + 4]
jne 0x45c0c6
cmp eax, dword [esp]
pop edx
pop eax
je 0x45c0d7
cmp byte [ebx + 0x10098], 0
je 0x45bfea
cmp byte [ebx + 0x10098], 0
je 0x45c115
mov byte [ebx + 0x10098], 0
mov ecx, 0x45c154
mov dl, 1
mov eax, dword [0x45a938]
call fcn.0040c25c
call fcn.004043bc
cmp word [ebx + 0x1010a], 0
je 0x45c115
mov edx, ebx
mov eax, dword [ebx + 0x1010c]
call dword [ebx + 0x10108]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c132
lea eax, [ebp - 0xc]
call fcn.00404a2c
ret
Function at 0x45c9d4
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45cadd
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x45caf4
mov dl, 8
mov eax, ebx
call fcn.0045cf40
test byte [ebx + 0x1c], 0x10
setne al
xor al, 1
and al, byte [0x468be8]
je 0x45cac7
xor eax, eax
push ebp
push 0x45caa7
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x45ca3d
call fcn.00403b58
mov word [ebx + 0x10110], si
mov word [ebp - 4], 0
mov word [ebp - 2], 0
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xff7f
movzx eax, si
push eax
call sub.wsock32.dll_setsockopt
cmp word [ebx + 0x10110], 0xffff
jne 0x45ca82
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, ebx
call fcn.0045ce74
push 0x3f
push 0x465
mov eax, dword [ebx + 0x10114]
push eax
movzx eax, word [ebx + 0x10110]
push eax
call sub.wsock32.dll_WSAAsyncSelect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45cac7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cae4
lea eax, [ebp - 8]
call fcn.00404a2c
ret

Function at 0x45cdc0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov ecx, 0x45ce5c
mov dl, 4
mov eax, ebx
call fcn.0045cf40
mov byte [ebx + 0x10118], 0
mov ax, word [ebx + 0x10110]
cmp ax, 0xffff
je 0x45ce4e
movzx eax, ax
push eax
call sub.wsock32.dll_closesocket
test byte [ebx + 0x1c], 8
jne 0x45ce0d
cmp word [ebx + 0x1005a], 0
je 0x45ce0d
mov edx, ebx
mov eax, dword [ebx + 0x1005c]
call dword [ebx + 0x10058]
cmp byte [ebx + 0x10099], 0
jne 0x45ce4e
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x45ce30
call fcn.00403b58
mov word [ebx + 0x10110], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x10114]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
pop esi
pop ebx
ret
Function at 0x45cfe8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100b8]
cmp dword [eax + 4], 0
setg byte [ebp - 5]
cmp byte [ebp - 5], 0
jne 0x45d0ac
push 2
push 1
lea eax, [ebp - 6]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10110]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x45d039
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.0045cd6c
jmp 0x45d0ac
test eax, eax
jne 0x45d0ac
mov byte [ebp - 5], 1
xor eax, eax
push ebp
push 0x45d075
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10118], 0
je 0x45d06b
mov eax, dword [ebp - 4]
call fcn.0045d0b8
mov eax, dword [ebp - 4]
call fcn.0045cdc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45d07f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10034]
call fcn.0042709c
mov eax, dword [ebp - 4]
cmp word [eax + 0x1005a], 0
je 0x45d0ac
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1005c]
call dword [ebx + 0x10058]
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x45d0b8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x45d0bf
mov eax, dword [esp + 0x10000]
mov ebx, eax
mov ecx, 0x45d10c
mov dl, 8
mov eax, ebx
call fcn.0045cf40
push 0
push 0x10000
lea eax, [esp + 8]
push eax
movzx eax, word [ebx + 0x10110]
push eax
call sub.wsock32.dll_recv
add esp, 0x10004
pop ebx
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x43227f87
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x11d95dd7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x601870b5
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2cfd4cdb
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
lea edi, [ebp - 0x1c]
push ebx
mov ebx, eax
sub esp, 0x5c
mov eax, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [esp], 0xfffffff5
mov dword [ebp - 0x2c], eax
call eax
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x401058
mov edx, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], ecx
call ecx
mov dword [esp + 0x1c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [ebp - 0x3c], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x30], eax
mov ecx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x40], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x38]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x34], eax
je 0x40104b
mov ecx, dword [ebp - 0x44]
call ecx
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov ebx, dword [ebp - 0x3c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
mov esi, dword [ebp - 0x2c]
sub esp, 0x20
mov dword [esp], 0xfffffff5
call esi
mov edx, dword [ebp - 0x30]
sub esp, 4
mov dword [esp + 0xc], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 8], edx
mov dword [esp + 0x10], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov ecx, dword [ebp - 0x40]
sub esp, 0x14
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x401048
Function at 0x4017f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40184b
cmp byte [esi + ebx - 1], 0xa
je 0x40181f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4060a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x402290
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit