joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d13b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x48d144
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x48d165
xor eax, eax
jmp 0x48d336
xor edx, edx
mov dword [ebx + 0x3a4], edx
push 1
push 1
push dword [ebx + 0x3a8]
push 0x8012
call fcn.00528a48
test eax, eax
je 0x48d18c
xor eax, eax
jmp 0x48d336
inc dword [ebx + 0x3ac]
cmp dword [ebx + 0x3ac], 0x14
jl 0x48d1c2
xor edx, edx
mov dword [ebx + 0x3ac], edx
push 0
push 1
push dword [ebx + 0x3a8]
push 0x8012
call fcn.00528a48
test eax, eax
je 0x48d1c2
xor eax, eax
jmp 0x48d336
push 0
push 0x2000
lea edx, [ebp - 0x2000]
push edx
push dword [ebx + 0x3a8]
call sub.WSOCK32.dll_recv
mov esi, eax
cmp dword [ebx + 0x33c], 4
je 0x48d1ed
xor eax, eax
jmp 0x48d336
cmp esi, 0xffffffff
jne 0x48d221
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x48d205
xor eax, eax
jmp 0x48d336
push 0
push 0xb67
call fcn.0042c771
push eax
push 0
push ebx
call fcn.0048d5ba
xor eax, eax
jmp 0x48d336
test esi, esi
jg 0x48d239
push 0x56648e
push 0
push ebx
call fcn.0048d5ba
xor eax, eax
jmp 0x48d336
mov edi, esi
add dword [ebx + 0x350], edi
add dword [ebx + 0x368], esi
cmp dword [ebx + 0x360], 0
jbe 0x48d262
push 2
push 0
push dword [ebx + 0x338]
call fcn.005522e4
add esp, 0xc
push edi
lea eax, [ebp - 0x2000]
push eax
push dword [ebx + 0x338]
call fcn.00553d2c
add esp, 0xc
cmp esi, eax
je 0x48d298
push 0
push 0xb65
call fcn.0042c771
push eax
push 0
push ebx
call fcn.0048d5ba
xor eax, eax
jmp 0x48d336
push dword [ebx + 0x350]
call sub.WSOCK32.dll_htonl
mov dword [ebx + 0x354], eax
push ebx
call fcn.0048d436
push ebx
call fcn.0048d33f
test eax, eax
jne 0x48d2bd
xor eax, eax
jmp 0x48d336
push ebx
call fcn.0048b997
test eax, eax
jne 0x48d2cb
xor eax, eax
jmp 0x48d336
mov eax, dword [ebx + 0x35c]
test eax, eax
jbe 0x48d2f4
cmp eax, dword [ebx + 0x350]
ja 0x48d2f4
mov dword [ebx + 0x350], eax
push 0x566492
push 0
push ebx
call fcn.0048d5ba
xor eax, eax
jmp 0x48d336
cmp dword [0x566358], 0
je 0x48d18c
cmp dword [ebx + 0x368], 0x7d000
jl 0x48d18c
push dword [ebx + 0x338]
call fcn.005516e4
pop ecx
cmp eax, 0xffffffff
je 0x48d329
push eax
call fcn.005516dc
pop ecx
xor edx, edx
mov dword [ebx + 0x368], edx
jmp 0x48d18c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48dd53
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
push 3
call sub.USER32.dll_GetAsyncKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
jne 0x48ddb1
push 0
push 0xaf3
call fcn.0042c771
mov edi, eax
mov esi, 0x5803c4
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
call fcn.0042c6cc
xor eax, eax
jmp 0x48df25
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x48ddcf
push 0
push 0
mov ecx, dword [ebp + 8]
push dword [ecx]
push 0
call fcn.00479438
jmp 0x48df25
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x48de4f
mov eax, dword [esi]
cmp byte [eax], 0x25
jne 0x48ddf0
push dword [ebp + 0x20]
push edi
push eax
call fcn.0051dafd
test eax, eax
jne 0x48de17
mov esi, dword [esi + 0x40]
jmp 0x48ddd2
mov edx, dword [esi]
push esi
push edi
mov esi, edi
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x20
push edi
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x48de2b
mov byte [ebx], 0
mov eax, dword [ebp + 8]
push dword [eax + 4]
push edi
call fcn.0054e450
add esp, 8
test eax, eax
jne 0x48de48
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi + 0x2c]
mov dword [edx], ecx
jmp 0x48de4f
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x48ddd6
test esi, esi
je 0x48df20
mov eax, dword [ebp + 0x14]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x48de6e
push dword [ebp + 0x10]
call fcn.004c6e49
mov eax, dword [esi + 0x2c]
push dword [eax + 0x24]
lea edx, [ebp - 4]
push edx
push edi
mov ecx, dword [esi + 0x2c]
push dword [ecx]
call fcn.004e5f99
mov ebx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
cmp dword [ebp - 4], 0
jne 0x48de97
xor eax, eax
jmp 0x48df25
test ebx, ebx
jne 0x48dea5
mov eax, 1
jmp 0x48df25
mov edi, ebx
test edi, edi
je 0x48defc
mov ebx, dword [edi]
jmp 0x48deb0
inc ebx
cmp byte [ebx], 0x20
je 0x48deaf
cmp byte [ebx], 0x3a
jne 0x48def5
inc ebx
jmp 0x48debe
inc ebx
cmp byte [ebx], 0x20
je 0x48debd
cmp byte [ebx], 0
je 0x48def5
push 0x20
push ebx
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x48deda
mov byte [eax], 0
push ebx
push dword [esi]
call fcn.0054e450
add esp, 8
test eax, eax
jne 0x48def5
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov eax, 1
jmp 0x48df25
mov edi, dword [edi + 0x40]
test edi, edi
jne 0x48deab
mov edx, dword [ebp + 8]
push dword [edx + 4]
push 0
push 0xaf4
call fcn.0042c771
push eax
push 0x5803c4
call sub.USER32.dll_wsprintfA
add esp, 0xc
xor eax, eax
jmp 0x48df25
mov eax, 4
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x1c
Function at 0x48df82
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc18
push ebx
push esi
mov ebx, dword [ebp + 8]
xor esi, esi
lea eax, [ebp - 0x3e8]
jmp 0x48df9f
mov byte [eax], dl
inc ebx
inc eax
inc esi
mov dl, byte [ebx]
test dl, dl
jne 0x48df9a
mov byte [eax], 0
lea ebx, [ebp - 0x3e8]
test esi, esi
ja 0x48dfb6
xor eax, eax
jmp 0x48dfd2
push esi
push ebx
call sub.USER32.dll_CharLowerBuffA
xor eax, eax
jmp 0x48dfcc
and edx, 0xff
xor eax, edx
add eax, eax
inc ebx
mov dl, byte [ebx]
test dl, dl
jne 0x48dfc1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49689c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x566898
cmp dword [0x56687c], 0
jne 0x4968bb
push 0
call fcn.00496812
jmp 0x49696f
cmp dword [0x566884], 0
je 0x4968db
push 0
call fcn.004127d6
test eax, eax
jne 0x4968db
push 0
call fcn.00496812
jmp 0x49696f
push 0
push dword [ebp + 8]
push 0x581d80
call fcn.004d92e9
test eax, eax
jne 0x4968fe
xor eax, eax
mov dword [0x56687c], eax
push 0
call fcn.00496812
jmp 0x49696f
cmp dword [esi], 0xffffffff
jne 0x49696f
mov dword [0x56689c], 0xffffffff
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
mov dword [esi], ebx
cmp ebx, 0xffffffff
jne 0x49692a
push 0
call fcn.00496812
jmp 0x49696f
mov ax, word [0x56688c]
push eax
push dword [esi]
call fcn.004f30ad
test eax, eax
jne 0x496945
push 0
call fcn.00496812
jmp 0x49696f
push 5
push dword [esi]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x49695b
push 0
call fcn.00496812
jmp 0x49696f
push 8
push 0x802a
push dword [0x56f018]
push dword [esi]
call sub.WSOCK32.dll_WSAAsyncSelect
pop esi
pop ebx
pop ebp
ret 4
Function at 0x496b1f
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffab0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edx, eax
shr edx, 0x10
test dx, 0xffff
jne 0x496d1a
cmp eax, 0x20
je 0x496d1a
mov eax, dword [0x56689c]
cmp eax, 0xffffffff
je 0x496d1a
push 0
push 0x103
lea ecx, [ebp - 0x168]
push ecx
push eax
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x496b83
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x496d3e
jmp 0x496d1a
cmp eax, 1
jle 0x496d1a
cmp eax, 0x19
jg 0x496d1a
mov byte [ebp + eax - 0x168], 0
push 0x2c
lea eax, [ebp - 0x168]
push eax
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x496d1a
mov byte [ebx], 0
inc ebx
cmp byte [ebx], 0
je 0x496d1a
lea eax, [ebp - 0x168]
push eax
call fcn.005570e0
pop ecx
mov esi, eax
push ebx
call fcn.005570e0
pop ecx
mov edi, eax
push 2
call fcn.004127d6
mov ebx, eax
test ebx, ebx
jne 0x496c08
cmp dword [0x566884], 0
jne 0x496d1a
call fcn.00412691
mov ebx, eax
test ebx, ebx
je 0x496d1a
jmp 0x496c10
xor eax, eax
mov dword [ebx + 0x444], eax
push 0x581d80
push 0x64
lea edx, [ebp - 0x64]
push edx
call fcn.0042e5e3
cmp dword [0x566888], 0
je 0x496c54
push 0x64
lea ecx, [ebp - 0x64]
push ecx
call fcn.0042e6b1
push 0
push ebx
lea eax, [ebp - 0x64]
push eax
call fcn.004d92e9
test eax, eax
jne 0x496c54
push 0x581d80
push 0x64
lea edx, [ebp - 0x64]
push edx
call fcn.0042e5e3
cmp dword [0x566880], 0
je 0x496ca5
lea ecx, [ebp - 0x64]
push ecx
push 0x581de4
push edi
push esi
push 0
push 0xc1f
call fcn.0042c771
push eax
lea eax, [ebp - 0x550]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x18
push dword [0x5618f8]
lea edx, [ebp - 0x550]
push edx
push dword [ebx]
call fcn.004ef55b
push dword [0x5618e8]
push dword [ebx]
call fcn.004ef455
push 0x22
push 0x802c
push dword [0x56f018]
push dword [0x56689c]
call sub.WSOCK32.dll_WSAAsyncSelect
lea ecx, [ebp - 0x64]
push ecx
push 0x581de4
push edi
push esi
push str._d___d_:_USERID_:__s_:__s_r_n
lea eax, [ebp - 0x168]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x18
lea edx, [ebp - 0x168]
push edx
call fcn.0054e28c
pop ecx
mov ebx, eax
push 0
push ebx
lea eax, [ebp - 0x168]
push eax
push dword [0x56689c]
call sub.WSOCK32.dll_send
cmp ebx, eax
jne 0x496d1a
mov dword [0x566890], 3
mov dword [0x566894], 1
jmp 0x496d3e
cmp dword [0x566884], 0
je 0x496d37
push 0
call fcn.004127d6
test eax, eax
jne 0x496d37
push 0
call fcn.00496812
jmp 0x496d3e
push 1
call fcn.00496812
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4984b8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
cmp dword [ebp + 0x20], 0
jne 0x4984d3
mov dword [ebp - 8], 1
jmp 0x498534
cmp dword [esi + 8], 0
jne 0x4984f4
push 1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call fcn.004e5890
jmp 0x4986a6
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x498505
mov eax, 2
jmp 0x4986a6
cmp dword [eax + 0x1c], 1
je 0x498515
mov eax, 1
jmp 0x4986a6
cmp dword [eax + 0xc], 0
jne 0x498674
push dword [eax]
call fcn.005570e0
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x498674
push dword [0x56f018]
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x498674
push 1
call sub.USER32.dll_GetClipboardData
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49866f
push dword [ebp - 4]
call sub.KERNEL32.dll_GlobalLock
mov edi, eax
test edi, edi
je 0x49866f
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
push edi
call fcn.0054e28c
pop ecx
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0xc], edx
push 0xa
push edi
call fcn.0054e1ec
add esp, 8
mov ebx, eax
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x4985e3
test ebx, ebx
je 0x4985a1
mov byte [ebx], 0
push 0x3e7
push 0
push dword [ebp + 0x14]
call fcn.0054e10c
add esp, 0xc
push 0x3b5
push edi
push dword [ebp + 0x14]
call fcn.0054e498
add esp, 0xc
test ebx, ebx
je 0x4985cb
mov byte [ebx], 0xa
push 0xd
push dword [ebp + 0x14]
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4985f7
mov byte [ebx], 0
jmp 0x4985f7
test ebx, ebx
je 0x4985f7
inc ebx
cmp byte [ebx], 0xd
jne 0x4985ee
inc ebx
cmp byte [ebx], 0
je 0x4985f7
mov edi, ebx
jmp 0x498582
cmp dword [ebp - 8], 0
jne 0x498610
push dword [ebp - 0xc]
push 0x566a77
push dword [ebp + 0x14]
call sub.USER32.dll_wsprintfA
add esp, 0xc
cmp dword [esi + 0x10], 0
je 0x498667
push 0x2e
push dword [esi]
call fcn.0054e574
add esp, 8
mov ebx, eax
test eax, eax
je 0x498667
push str..len
push ebx
call fcn.0054e450
add esp, 8
test eax, eax
jne 0x498661
cmp dword [ebp - 8], 0
je 0x49864c
push dword [ebp + 0x14]
call fcn.0054e28c
pop ecx
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0x566a81
push dword [ebp + 0x14]
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x498667
mov edx, dword [ebp + 0x14]
mov byte [edx], 0
push dword [ebp - 4]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
cmp dword [ebp + 0x20], 0
jne 0x498696
mov eax, 2
jmp 0x4986a6
push dword [esi + 0x40]
mov edx, dword [ebp + 0xc]
push dword [edx]
call fcn.004c6c7e
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
dec dword [esi + 8]
cmp dword [esi + 8], 0
jg 0x498681
xor eax, eax
mov dword [esi + 8], eax
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4ac518
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4ac552
cmp byte [ebx], 0
je 0x4ac552
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4ac552
test al, 0x10
jne 0x4ac552
test ah, 0x10
jne 0x4ac552
test al, 4
jne 0x4ac552
test ah, 1
jne 0x4ac552
and eax, 0xfffffffd
and eax, 0xfffffffe
push eax
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
pop ebx
pop ebp
ret 4
Function at 0x4ac8c9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff830
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp dword [ebp + 0x14], 0
je 0x4ac8f7
cmp dword [ebp + 0x18], 0
jle 0x4ac8f7
push dword [ebp + 0x18]
push 0
push dword [ebp + 0x14]
call fcn.0054e10c
add esp, 0xc
test esi, esi
je 0x4ac9c8
push 0x3e7
lea eax, [ebp - 0x3e8]
push eax
call fcn.0042e6b1
push esi
push edi
mov edi, esi
lea esi, [ebp - 0x3e8]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0xf
lea eax, [ebp - 0x3e8]
push eax
call fcn.0050e7f8
cmp byte [ebp - 0x3e8], 0
je 0x4acaaa
push 0x5b
lea edx, [ebp - 0x3e8]
push edx
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4ac970
mov byte [ebx], 0x7e
jmp 0x4ac954
push 0x5d
lea eax, [ebp - 0x3e8]
push eax
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4ac98f
mov byte [ebx], 0x7e
jmp 0x4ac970
mov byte [ebx], 0x20
push 0xa
lea eax, [ebp - 0x3e8]
push eax
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4ac98c
jmp 0x4ac9ab
mov byte [ebx], 0x20
push 0xd
lea edx, [ebp - 0x3e8]
push edx
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4ac9a8
lea esi, [ebp - 0x3e8]
test edi, edi
je 0x4aca97
push 0x3e7
lea eax, [ebp - 0x7d0]
push eax
call fcn.0042e6b1
push esi
push edi
lea esi, [ebp - 0x7d0]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0xf
lea eax, [ebp - 0x7d0]
push eax
call fcn.0050e7f8
cmp byte [ebp - 0x7d0], 0
je 0x4acaaa
push 0x5b
lea edx, [ebp - 0x7d0]
push edx
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4aca3f
mov byte [ebx], 0x7e
jmp 0x4aca23
push 0x5d
lea eax, [ebp - 0x7d0]
push eax
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4aca5e
mov byte [ebx], 0x7e
jmp 0x4aca3f
mov byte [ebx], 0x20
push 0xa
lea eax, [ebp - 0x7d0]
push eax
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4aca5b
jmp 0x4aca7a
mov byte [ebx], 0x20
push 0xd
lea edx, [ebp - 0x7d0]
push edx
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4aca77
lea edi, [ebp - 0x7d0]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call sub.KERNEL32.dll_GetPrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4ad20b
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff90c
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 1
xor ebx, ebx
mov dword [0x568248], 1
test eax, eax
je 0x4ad244
cmp byte [eax], 0
je 0x4ad244
cmp dword [ebp + 0xc], 0
je 0x4ad244
mov edx, dword [ebp + 0xc]
cmp byte [edx], 0
jne 0x4ad24e
mov eax, dword [0x568248]
jmp 0x4ad482
push eax
push 0x180
lea ecx, [ebp - 0x18c]
push ecx
call fcn.0042e5e3
lea eax, [ebp - 0x18c]
push eax
lea edx, [ebp - 0x18c]
push edx
call fcn.0042cf68
test eax, eax
jne 0x4ad281
mov eax, dword [0x568248]
jmp 0x4ad482
lea edx, [ebp - 0x18c]
push edx
call fcn.0042c88b
test eax, eax
je 0x4ad29b
mov eax, dword [0x568248]
jmp 0x4ad482
lea edx, [ebp - 0x18c]
push edx
call fcn.004ac518
push 0x40
push 0x5682e6
lea ecx, [ebp - 0x18c]
push ecx
call fcn.005541f4
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4ad2d0
mov eax, dword [0x568248]
jmp 0x4ad482
push 0x588ce3
push 0x588be3
push 0x588ae3
push 0x588ae0
lea edx, [ebp - 0x18c]
push edx
call fcn.0050e5fc
add esp, 0x14
push 0
call fcn.00553350
pop ecx
push eax
push 0x588ae3
push 0x588ae0
push 0x5682e9
lea ecx, [ebp - 0x30c]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 0x14
push 0x40
push 0x5682f1
lea eax, [ebp - 0x30c]
push eax
call fcn.005541f4
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x4ad349
push dword [ebp - 8]
call fcn.005516ec
pop ecx
mov eax, dword [0x568248]
jmp 0x4ad482
push 0x1000
push 0
push 0
push dword [ebp - 8]
call fcn.00552f84
add esp, 0x10
push 0x1000
push 0
push 0
push edi
call fcn.00552f84
add esp, 0x10
push dword [ebp + 0xc]
call fcn.0054e28c
pop ecx
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 0x3e7
lea edx, [ebp - 0x6f4]
push edx
call fcn.0055181c
add esp, 0xc
mov esi, eax
test esi, esi
je 0x4ad44c
test ebx, ebx
je 0x4ad3cc
push 0x5b
lea eax, [ebp - 0x6f4]
push eax
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x4ad3cc
push 0x3d
lea edx, [ebp - 0x6f4]
push edx
call fcn.0054e1ec
add esp, 8
test eax, eax
jne 0x4ad3cc
xor ebx, ebx
test ebx, ebx
jne 0x4ad37b
push dword [ebp - 0xc]
push dword [ebp + 0xc]
lea eax, [ebp - 0x6f4]
push eax
call fcn.0054e4e8
add esp, 0xc
test eax, eax
jne 0x4ad3f0
mov ebx, 1
jmp 0x4ad37b
cmp byte [esi], 0xa
jne 0x4ad404
mov dword [0x568248], 1
jmp 0x4ad37b
cmp dword [ebp - 4], 0
je 0x4ad413
xor eax, eax
mov dword [0x568248], eax
jmp 0x4ad432
cmp dword [0x568248], 0
je 0x4ad432
push edi
push 0x5682f4
call fcn.00551cc0
add esp, 8
xor edx, edx
mov dword [0x568248], edx
push edi
lea ecx, [ebp - 0x6f4]
push ecx
call fcn.00551cc0
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4ad37b
push edi
call fcn.005516ec
pop ecx
push dword [ebp - 8]
call fcn.005516ec
pop ecx
push 0
lea edx, [ebp - 0x18c]
push edx
lea ecx, [ebp - 0x30c]
push ecx
call sub.KERNEL32.dll_CopyFileA
lea eax, [ebp - 0x30c]
push eax
call sub.KERNEL32.dll_DeleteFileA
mov eax, dword [0x568248]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ad740
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 2
push ebx
call fcn.0042cbc2
test eax, eax
je 0x4ad75b
push ebx
call fcn.004ad48c
jmp 0x4ad77f
push dword [ebp + 0xc]
push 0x581f80
push 0x568313
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0
push ebx
call sub.KERNEL32.dll_CreateDirectoryA
push ebx
call fcn.004ad48c
pop ebx
pop ebp
ret 8

Function at 0x4b0654
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffffa8
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push ecx
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x18]
push edx
push 0x568f8b
push 0
call fcn.004ee38b
cmp dword [0x55f824], 0
je 0x4b06b2
push dword [0x56f018]
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x4b06b2
mov dword [esp + 0x10], 3
jmp 0x4b06ea
push dword [0x56f018]
call sub.USER32.dll_IsIconic
test eax, eax
je 0x4b06cb
mov dword [esp + 0x10], 1
jmp 0x4b06ea
push dword [0x56f018]
call sub.USER32.dll_IsZoomed
test eax, eax
je 0x4b06e4
mov dword [esp + 0x10], 2
jmp 0x4b06ea
xor ecx, ecx
mov dword [esp + 0x10], ecx
push 0x10
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
jne 0x4b071b
cmp dword [0x55f820], 0
je 0x4b0713
mov dword [esp + 0x10], 3
jmp 0x4b071b
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], 0
jne 0x4b0757
lea edx, [esp + 0x48]
push edx
push dword [0x56f018]
call sub.USER32.dll_GetWindowRect
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov edx, dword [esp + 0x50]
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x54]
sub edx, eax
mov dword [esp + 0xc], edx
jmp 0x4b0792
mov dword [esp + 0x1c], 0x2c
lea ecx, [esp + 0x1c]
push ecx
push dword [0x56f018]
call sub.USER32.dll_GetWindowPlacement
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov edx, dword [esp + 0x40]
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x44]
sub edx, eax
mov dword [esp + 0xc], edx
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x14]
push dword [esp + 0x1c]
push dword [esp + 0x18]
push 0x568f91
push 0x582856
call sub.USER32.dll_wsprintfA
add esp, 0x24
push 0x581e7c
push 0x582856
push str.main
push 0x568fa7
call fcn.004ac64e
add esp, 0x58
ret
Function at 0x4c61c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0x56a510
push 0x80000001
call sub.ADVAPI32.dll_RegCreateKeyA
mov ebx, eax
test ebx, ebx
je 0x4c61e6
xor eax, eax
jmp 0x4c6214
push esi
call fcn.0054e28c
pop ecx
inc eax
push eax
push esi
push 1
push dword [ebp + 8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegSetValueA
mov ebx, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x4c620f
xor eax, eax
jmp 0x4c6214
mov eax, 1
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4c621b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [esi], 0
lea eax, [ebp - 8]
push eax
push 0x56a51f
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
je 0x4c6246
xor eax, eax
jmp 0x4c6274
mov dword [ebp - 4], 0x3e7
lea edx, [ebp - 4]
push edx
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegQueryValueA
mov ebx, eax
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x4c626f
xor eax, eax
jmp 0x4c6274
mov eax, 1
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4c627c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push str.SoftwaremIRC
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
je 0x4c629e
xor eax, eax
jmp 0x4c62c0
push dword [ebp + 8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegDeleteKeyA
mov ebx, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x4c62bb
xor eax, eax
jmp 0x4c62c0
mov eax, 1
pop ebx
pop ecx
pop ebp
ret 4