joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439fe0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x439ffc
cmp dword [esi + 4], 0
je 0x43a029
test byte [ebx + 0x55], 1
jne 0x43a01b
mov eax, ebx
call fcn.00438c38
test eax, eax
jne 0x43a01b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x43a139
mov edx, esi
mov eax, ebx
call fcn.00439b00
jmp 0x43a139
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43a132
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043bdb0
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004368e4
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00439fe0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043bdb0
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a139
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4405d8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4704f8]
cmp byte [eax + 0xc], 0
je 0x440745
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44073e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x471bb8], 0
jne 0x44062c
push 0x44074c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x440754
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x471bb8], eax
cmp dword [0x46eaa8], 0
jne 0x440727
push 0x440764
call sub.kernel32.dll_LoadLibraryA
mov dword [0x46eaa8], eax
cmp dword [0x46eaa8], 0
je 0x440727
push 0x440770
mov eax, dword [0x46eaa8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x471bbc], eax
push 0x440780
mov eax, dword [0x46eaa8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x471bc0], eax
push 0x440794
mov eax, dword [0x46eaa8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x471bc4], eax
push 0x4407ac
mov eax, dword [0x46eaa8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x471bc8], eax
push 0x4407c4
mov eax, dword [0x46eaa8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x471bcc], eax
push 0x4407d8
mov eax, dword [0x46eaa8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x471bd0], eax
push 0x4407f0
mov eax, dword [0x46eaa8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x471bd4], eax
push 0x440808
mov eax, dword [0x46eaa8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x471bd8], eax
push 0x440824
mov eax, dword [0x46eaa8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x471bdc], eax
push 0x440830
mov eax, dword [0x46eaa8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x471be0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440745
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x444358
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404250
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4443a7
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004044b8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44c1e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44c238]
test si, 4
je 0x44c1fc
or bl, 1
test si, 8
je 0x44c206
or bl, 4
test si, 1
je 0x44c210
or bl, 8
test si, 2
je 0x44c21a
or bl, 0x10
test si, 0x10
je 0x44c224
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44c233
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44c23c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44c274]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44c255
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44c264
or bl, 4
test esi, 0x20000000
je 0x44c26f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x452878
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45288a
add esp, 0xfffffff0
call fcn.00403848
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d2a0
mov eax, dword [0x470214]
mov dword [eax + 4], ebx
mov dword [eax], 0x452c1c
mov eax, dword [0x470220]
mov dword [eax + 4], ebx
mov dword [eax], 0x452c28
mov eax, ebx
call fcn.00452c34
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41326c]
call fcn.004034b4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41326c]
call fcn.004034b4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41326c]
call fcn.004034b4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41326c]
call fcn.004034b4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41326c]
call fcn.004034b4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44f0fc
push eax
push 0
push 0
mov eax, dword [0x470340]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41ec68]
call fcn.0042033c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41ec68]
call fcn.0042033c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41ec68]
call fcn.0042033c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00453054
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x452f30
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x452f30
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x452f30
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4529c7
call fcn.004038a0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x452d14
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x452ebf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x452ea0
mov dl, 1
mov eax, dword [0x41375c]
call fcn.004034b4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404250
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x452e8f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00440938
test al, al
je 0x452e82
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x452ed0
lea eax, [ebp - 0x254]
call fcn.00408ffc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x452e82
xor eax, eax
push ebp
push 0x452e7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x452f08
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x452e64
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044b8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x452e64
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452e82
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x452d85
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004178a4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452ec6
lea eax, [ebp - 0x260]
call fcn.00404250
ret

Function at 0x4537f4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x471bfc]
cmp byte [eax + 0xa5], 0
jne 0x453865
cmp dword [0x471c14], 0
jne 0x453826
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4537b0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x471c14], eax
cmp dword [0x471c10], 0
jne 0x453841
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x471c10], eax
cmp dword [0x471c18], 0
jne 0x453865
push esp
push 0
push 0
push 0x453754
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x471c18], eax
pop edx
ret
Function at 0x45395c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x453973
add esp, 0xfffffff0
call fcn.00403848
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d2a0
mov eax, dword [0x470330]
cmp word [eax + 2], 0
jne 0x45399b
mov eax, dword [0x470330]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00455038
mov eax, dword [0x4703bc]
cmp word [eax + 2], 0
jne 0x4539b5
mov eax, dword [0x4703bc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00455230
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41326c]
call fcn.004034b4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41326c]
call fcn.004034b4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41f6e8]
call fcn.00426d4c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x453b3c
mov eax, dword [0x470270]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042711c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4557a0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x470270]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c5cc
test eax, eax
je 0x453aaa
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408944
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c5f4
test eax, eax
je 0x453abe
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004044b8
mov eax, dword [0x470178]
cmp byte [eax], 0
jne 0x453af2
mov eax, ebx
call fcn.00453c64
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045597c
mov eax, ebx
call fcn.004562bc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x453b32
call fcn.004038a0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453ed8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x471bfc]
cmp dword [eax + 0x30], 0
je 0x453f82
cmp dword [ebx + 0x94], 0
jne 0x453f7c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x453e68
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x453f7c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x453f42
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x453f7c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041590c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x453f51
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454a60
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x454a95
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404340
jmp 0x454aa2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004042a4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x455b58
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x455b99
mov eax, esi
call fcn.0043c0b4
test al, al
je 0x455b99
mov eax, dword [ebx + 0x84]
call fcn.0043bdb0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x455b99
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043bdb0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x459230
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x45925e
mov eax, ebx
call fcn.00459ce8
cmp dword [ebx + 0x3c], 0
je 0x459257
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4592cf
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x4592c1
cmp dword [ebx + 8], 0
je 0x459280
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x459292
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4592c1
cmp dword [ebx + 8], 0
je 0x459273
cmp eax, 3
je 0x4592a5
dec eax
jne 0x459273
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x459273
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x459273
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4592ed
cmp dword [ebx + 0x10], 0xcc
je 0x4592ed
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004592f8
pop ebx
ret
Function at 0x46aec4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46b000
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x46b018
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0046bf98
mov eax, dword [ebp - 4]
call fcn.0046b828
xor edx, edx
push ebp
push 0x46afe3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
jne 0x46af82
test si, si
jne 0x46af34
mov eax, dword [ebp - 8]
call fcn.00408908
mov esi, eax
cmp esi, 0xffff
jbe 0x46af34
call fcn.00403424
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10290]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x46af82
cmp eax, 0xffffffff
jle 0x46af63
sub ebx, eax
jmp 0x46af72
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0046becc
test ebx, ebx
je 0x46af82
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
je 0x46af37
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
je 0x46afcd
mov eax, dword [ebp - 4]
mov byte [eax + 0x10090], 0
mov ecx, 0x46b030
mov dl, 1
mov eax, dword [0x46a4ac]
call fcn.0040b93c
call fcn.00403cb0
mov eax, dword [ebp - 4]
cmp word [eax + 0x1028a], 0
je 0x46afcd
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1028c]
call dword [ebx + 0x10288]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46afea
mov eax, dword [ebp - 4]
call fcn.0046b880
ret
Function at 0x46bdd4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x46bea0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x46beb4
mov dl, 4
mov eax, ebx
call fcn.0046bf98
mov byte [ebx + 0x10298], 0
mov si, word [ebx + 0x10290]
cmp si, 0xffff
je 0x46be8a
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x46be7c
test byte [ebx + 0x1c], 8
jne 0x46be39
cmp word [ebx + 0x10052], 0
je 0x46be39
mov edx, ebx
mov eax, dword [ebx + 0x10054]
call dword [ebx + 0x10050]
cmp byte [ebx + 0x10091], 0
jne 0x46be8a
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x46be5c
call fcn.00403424
mov word [ebx + 0x10290], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x10294]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x46be8a
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.0046becc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bea7
lea eax, [ebp - 4]
call fcn.00404250
ret

Function at 0x46c040
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x46c07c
mov dl, 8
mov eax, ebx
call fcn.0046bf98
push 2
push 1
lea eax, [ebx + 0x30]
push eax
movzx eax, word [ebx + 0x10290]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x46c06e
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x46c2b4
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov dword [ebp - 4], edx
mov ecx, 0x46c374
mov dl, 8
call fcn.0046bf98
mov eax, 0xc8
call fcn.00408194
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46c35f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xc8
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_gethostname
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x28]
mov ecx, 3
mov eax, 0x46c390
call fcn.0040907c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c366
mov eax, dword [ebp - 8]
call fcn.0040273c
ret

Function at 0x46c934
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46c99e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.00408b00
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.0046c8ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c9a5
lea eax, [ebp - 0x104]
call fcn.00404250
ret
Function at 0x5cde0b
Capabilities:
Encode data using xor

Disassembly:
mov esi, ecx
lea esi, [esi + 0x10]
mov ecx, dword [esi]
pop esi
pushal
jmp 0x5cde02
rcr dh, 7
bsr dx, bp
jmp 0x5cdd30
push edi
mov edi, ecx
mov edx, dword [edi]
pop edi
call fcn.005cdd19
push dword [esp]
mov byte [esp + 5], ah
cmp edx, eax
push esp
pop word [esp]
call fcn.005cdd64
sub ebp, dword [edx + reloc.KERNEL32.dll_SetEndOfFile]
sbb byte [ebx + 0x52], bh
int 0x5c
lea esp, [esp + 4]
push esi
jmp 0x5cdc7b
push esi
jmp 0x588008
pop dword [esp + 4]
call 0x5cde66
lea esp, [esp + 4]
jmp 0x5cde45
jne 0x5cdc7b
mov esi, dword [esp]
pop esi
call 0x5cde71
call fcn.005cf7d6
call 0x956266b9
cld
ud1
xor al, 0x27
dec esi
fnstcw word [eax]
sbb ecx, dword [ebp - 0x7adbdb9c]
leave
call 0x5cde0b
push dword [esp]
mov dword [esp + 3], eax
jmp 0x5cdedb
lea esp, [esp + 8]
ret

Function at 0x6a5b03
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc ecx, edi
pop ebp
mov cx, word [esp]
push word [esp + 1]
mov bl, bh
jmp 0x6a5b2b
xchg word [esp + 3], ax
cpuid
jmp 0x6a5aed

Function at 0x6a5eb2
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 1], di
shr edi, 0x11
rcl bx, cl
xchg word [esp + 2], bx
cmc
setns bh
jmp 0x6a5eb4
xchg ebp, ecx
add esp, 0x18
cld
mov di, 0xa06f
push edx
mov ax, 0xf975
jmp 0x6a5e6d
jmp 0x6a5e8f
mov al, 0x1e
bsr dx, bp
mov ax, bx
pop word [esp + 1]
mov word [esp + 1], sp
rdtsc
jmp 0x6a5fab
bsf cx, si
mov edi, 0x81fe9594
bsr bp, bp
not bh
setae ch
mov byte [esp], ah
jmp 0x6a5ee8
lea esp, [esp]
bswap edi
mov byte [esp], ah
neg ecx
setg dh
cld
jmp 0x6a5f04
mov di, bx
mov byte [esp + 1], dh
push word [esp]
mov al, ah
mov di, word [esp + 2]
lea esp, [esp + 6]
jmp 0x6a5f22
push esp
pop word [esp + 2]
mov dword [esp], esi
xchg dh, al
mov di, 0x8a13
stc
jmp 0x6a5f58
not ecx
btc ecx, ebx
neg ax
pop bp
clc
neg bh
jmp 0x6a5f76