joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a630
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46a647
add esp, 0xfffffff0
call fcn.00403f38
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042488c
mov eax, dword [0x4fa330]
cmp word [eax + 2], 0
jne 0x46a66f
mov eax, dword [0x4fa330]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046bd0c
mov eax, dword [0x4fa518]
cmp word [eax + 2], 0
jne 0x46a689
mov eax, dword [0x4fa518]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046bf04
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x419198]
call fcn.00403ba4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x419198]
call fcn.00403ba4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4273bc]
call fcn.0042eef0
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x46a810
mov eax, dword [0x4fa114]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042f2c0
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x46c484
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4fa114]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040dca4
test eax, eax
je 0x46a77e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409a88
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040dccc
test eax, eax
je 0x46a792
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404c2c
mov eax, dword [0x4f9dd4]
cmp byte [eax], 0
jne 0x46a7c6
mov eax, ebx
call fcn.0046a938
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0046c660
mov eax, ebx
call fcn.0046d010
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46a806
call fcn.00403f90
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46abac
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4fbc38]
cmp dword [eax + 0x30], 0
je 0x46ac56
cmp dword [ebx + 0x94], 0
jne 0x46ac50
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46ab3c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46ac50
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46ac16
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46ac50
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041bc1c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46ac25
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46b734
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46b769
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404ab4
jmp 0x46b776
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404a18
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46c83c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46c87d
mov eax, esi
call fcn.004522c4
test al, al
je 0x46c87d
mov eax, dword [ebx + 0x84]
call fcn.00451fc0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46c87d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00451fc0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4723dc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00403230
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x4fa878]
cmp byte [edx + 0xc], 0
je 0x472440
mov edx, dword [0x4fa860]
cmp dword [edx], 2
jne 0x472440
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x472444
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4724fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004723dc
test al, al
je 0x4724de
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00404ab4
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x4724de
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404e74
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00404e74
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404bb4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x472497
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472503
lea eax, [ebp - 0x2c]
call fcn.004049c4
lea eax, [ebp - 0xc]
call fcn.004049c4
ret

Function at 0x47250c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4725c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004723dc
test al, al
je 0x4725a6
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00404ab4
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x4725a6
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404e74
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00404e74
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404bb4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x47255f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4725cb
lea eax, [ebp - 0x2c]
call fcn.004049c4
lea eax, [ebp - 0xc]
call fcn.004049c4
ret
Function at 0x472740
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00472100
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404e74
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x47279e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4fa384]
mov dl, 1
mov eax, dword [0x471ff8]
call fcn.0040cfe4
call fcn.004043a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4727a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404e74
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x472800
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4fa888]
mov dl, 1
mov eax, dword [0x471ff8]
call fcn.0040cfe4
call fcn.004043a0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00472130
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x47d720
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47d7f8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4fbcc0], 0
jne 0x47d7dc
lea eax, [ebp - 4]
mov edx, 0x47d810
call fcn.00404a5c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404e74
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x47d7dc
mov eax, ebx
call fcn.0040278c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47d7d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x47d7bf
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x47d820
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47d7bf
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4fbcc0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d7dc
mov eax, dword [ebp - 0xc]
call fcn.004027ac
ret
mov ebx, dword [0x4fbcc0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d7ff
lea eax, [ebp - 4]
call fcn.004049c4
ret

Function at 0x490f70
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x4fbce4], 0
jne 0x490f93
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x490ee4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4fbce4], eax
ret
Function at 0x492114
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.004522c4
test al, al
je 0x49216f
cmp bl, 7
jne 0x49214b
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [esp]
sub edi, 0x30
jmp 0x492150
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
je 0x49216f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, edi
call fcn.0043049c
mov byte [esi + 0x220], bl
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x495e14
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x496074
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x495e77
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0049592c
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d7d8
cmp al, 1
jne 0x495e77
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00495bf4
test al, al
je 0x496003
cmp dword [ebp - 8], 0
jge 0x495e95
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0049592c
mov eax, dword [ebp - 0x210]
call fcn.00404c7c
cmp ebx, eax
jge 0x495edf
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0049592c
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4fa848]
and eax, 0xff
bt dword [edx], eax
jae 0x495edf
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x495ef3
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00495df0
cmp ebx, dword [ebp - 8]
je 0x495ff5
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x495f1f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403dd0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4f82dc]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x495fe2
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403dd0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4f82dc]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00451fc0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403dd0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4f82dc]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00451fc0
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495fe9
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x496056
cmp dword [ebp - 8], 0
jge 0x49600e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0049592c
mov eax, dword [ebp - 0x218]
call fcn.00404c7c
cmp eax, dword [ebp - 8]
jg 0x496048
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0049592c
mov eax, dword [ebp - 0x21c]
call fcn.00404c7c
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00495df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49607b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004049e8
ret
Function at 0x4993cc
Capabilities:
Resume thread

Disassembly:
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_ResumeThread
ret

Function at 0x49a370
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49a4ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x49a4c4
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0049b630
mov eax, dword [ebp - 4]
call fcn.0049aec0
xor edx, edx
push ebp
push 0x49a48f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
jne 0x49a42e
test si, si
jne 0x49a3e0
mov eax, dword [ebp - 8]
call fcn.00409a4c
mov esi, eax
cmp esi, 0xffff
jbe 0x49a3e0
call fcn.00403b14
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10290]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x49a42e
cmp eax, 0xffffffff
jle 0x49a40f
sub ebx, eax
jmp 0x49a41e
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0049b564
test ebx, ebx
je 0x49a42e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
je 0x49a3e3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
je 0x49a479
mov eax, dword [ebp - 4]
mov byte [eax + 0x10090], 0
mov ecx, 0x49a4dc
mov dl, 1
mov eax, dword [0x499890]
call fcn.0040ceec
call fcn.004043a0
mov eax, dword [ebp - 4]
cmp word [eax + 0x1028a], 0
je 0x49a479
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1028c]
call dword [ebx + 0x10288]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a496
mov eax, dword [ebp - 4]
call fcn.0049af18
ret
Function at 0x49a9dc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49ab8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x49aba0
mov dl, 8
mov eax, ebx
call fcn.0049b630
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0041e848
cmp byte [ebx + 0x10090], 0
jne 0x49ab36
xor eax, eax
mov dword [ebx + 0x1008c], eax
mov eax, dword [ebp - 4]
call fcn.0041e85c
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x49aa41
call fcn.00403b14
mov dword [ebx + 0x100b8], eax
mov eax, dword [ebp - 4]
call fcn.0041e85c
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041e828
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x49aa70
call fcn.00403b14
cmp eax, 0x10000
jle 0x49aa7c
mov eax, 0x10000
lea edx, [ebx + 0x30]
mov ecx, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 8]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0
push esi
mov eax, dword [ebp - 8]
sub eax, esi
cmp eax, 0x10000
jbe 0x49aaa3
call fcn.00403b14
lea eax, [ebx + eax + 0x30]
push eax
movzx eax, word [ebx + 0x10290]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x49ab74
test eax, eax
jle 0x49aae3
sub esi, eax
add dword [ebx + 0x1008c], eax
cmp word [ebx + 0x100ca], 0
je 0x49aaf1
mov edx, ebx
mov eax, dword [ebx + 0x100cc]
call dword [ebx + 0x100c8]
jmp 0x49aaf1
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.0049b564
mov eax, dword [0x4fa4ac]
mov eax, dword [eax]
call fcn.0046ba60
test esi, esi
je 0x49ab0a
cmp byte [ebx + 0x10090], 0
je 0x49aa8f
mov eax, dword [ebp - 4]
call fcn.0041e85c
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041e828
cmp edx, dword [esp + 4]
jne 0x49ab25
cmp eax, dword [esp]
pop edx
pop eax
je 0x49ab36
cmp byte [ebx + 0x10090], 0
je 0x49aa47
cmp byte [ebx + 0x10090], 0
je 0x49ab74
mov byte [ebx + 0x10090], 0
mov ecx, 0x49abb4
mov dl, 1
mov eax, dword [0x499890]
call fcn.0040ceec
call fcn.004043a0
cmp word [ebx + 0x1028a], 0
je 0x49ab74
mov edx, ebx
mov eax, dword [ebx + 0x1028c]
call dword [ebx + 0x10288]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ab91
lea eax, [ebp - 0xc]
call fcn.004049c4
ret
Function at 0x49b46c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x49b538
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x49b54c
mov dl, 4
mov eax, ebx
call fcn.0049b630
mov byte [ebx + 0x10298], 0
mov si, word [ebx + 0x10290]
cmp si, 0xffff
je 0x49b522
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x49b514
test byte [ebx + 0x1c], 8
jne 0x49b4d1
cmp word [ebx + 0x10052], 0
je 0x49b4d1
mov edx, ebx
mov eax, dword [ebx + 0x10054]
call dword [ebx + 0x10050]
cmp byte [ebx + 0x10091], 0
jne 0x49b522
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x49b4f4
call fcn.00403b14
mov word [ebx + 0x10290], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x10294]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x49b522
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.0049b564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b53f
lea eax, [ebp - 4]
call fcn.004049c4
ret

Function at 0x49b6d8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x49b714
mov dl, 8
mov eax, ebx
call fcn.0049b630
push 2
push 1
lea eax, [ebx + 0x30]
push eax
movzx eax, word [ebx + 0x10290]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x49b706
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x49b724
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x49b72b
mov eax, dword [esp + 0x10000]
mov ebx, eax
mov ecx, 0x49b778
mov dl, 8
mov eax, ebx
call fcn.0049b630
push 0
push 0x10000
lea eax, [esp + 8]
push eax
movzx eax, word [ebx + 0x10290]
push eax
call sub.wsock32.dll_recv
add esp, 0x10004
pop ebx
ret
Function at 0x4b87cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b88cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x20
call fcn.00403230
lea eax, [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x4b88b5
cmp dword [ebp - 0xc], 0
je 0x4b88b5
push 0x104
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b88ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4fa4ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, 0x4b88dc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x2c]
push eax
call sub.shell32.dll_SHBrowseForFolderA
mov ebx, eax
test ebx, ebx
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4b8893
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.shell32.dll_SHGetPathFromIDListA
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
lea eax, [esi + 0x7c]
mov edx, dword [ebp - 8]
call fcn.00404bb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b88b5
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b88d2
lea eax, [ebp - 0xc]
call fcn.00406870
ret
Function at 0x4f2a7c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e64
xor eax, eax
push ebp
push 0x4f2b14
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4f2b28
call fcn.00404fb8
test eax, eax
je 0x4f2ade
push 5
push 0
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x4f2b34
call fcn.00404cc8
mov eax, dword [ebp - 8]
call fcn.00404e74
push eax
push 0x4f2b3c
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4f2af9
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404e74
push eax
push 0x4f2b3c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2b1b
lea eax, [ebp - 8]
mov edx, 2
call fcn.004049e8
ret