joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebp
push ebx
mov ebx, dword [esp + 0x18]
movaps xmm5, xmmword [ebx + 0x50]
movaps xmm3, xmmword [ebx + 0x40]
movaps xmm4, xmmword [ebx + 0x10]
sub esp, 0x18
lea esi, [ecx + ecx]
add esi, esi
lea ebp, [ecx + ecx]
add ebp, ebp
sub ebp, ecx
add ebp, ebp
lea ebx, [ecx + ecx]
movlps xmm0, qword [eax + esi*8]
movhps xmm0, qword [eax + ebp*8]
movaps xmm1, xmm0
shufps xmm0, xmm0, 0x94
shufps xmm1, xmm1, 0x3e
xorps xmm1, xmm5
addps xmm0, xmm1
movlps xmm1, qword [eax]
movhps xmm1, qword [eax + ebx*8]
movaps xmm2, xmm1
subps xmm1, xmm0
addps xmm2, xmm0
movlps qword [eax], xmm2
movhps qword [eax + ebx*8], xmm2
movlps qword [eax + esi*8], xmm1
movhps qword [eax + ebp*8], xmm1
dec ecx
mov edi, ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], ecx
mov ecx, eax
lea eax, [ecx + 8]
movlps xmm0, qword [ecx + esi*8 + 8]
movhps xmm0, qword [ecx + ebp*8 + 8]
movaps xmm1, xmm0
movaps xmm6, xmmword [edx]
movaps xmm7, xmmword [edx + 0x10]
mulps xmm0, xmm6
mulps xmm1, xmm7
shufps xmm1, xmm1, 0xb1
xorps xmm1, xmm3
addps xmm0, xmm1
movaps xmm1, xmm0
shufps xmm1, xmm1, 0x3c
shufps xmm0, xmm0, 0x96
xorps xmm1, xmm5
addps xmm0, xmm1
movlps xmm1, qword [ecx + 8]
movhps xmm1, qword [ecx + ebx*8 + 8]
movaps xmm2, xmm1
subps xmm2, xmm0
addps xmm1, xmm0
movlps qword [ecx + 8], xmm1
movhps qword [ecx + ebx*8 + 8], xmm1
movlps qword [ecx + esi*8 + 8], xmm2
movhps qword [ecx + ebp*8 + 8], xmm2
add edx, 0x20
mov ecx, eax
dec edi
jne 0x4891d3
mov ecx, dword [esp]
lea edi, [eax + 8]
movlps xmm0, qword [eax + esi*8 + 8]
movhps xmm0, qword [eax + ebp*8 + 8]
movaps xmm1, xmm0
shufps xmm1, xmm1, 0xb1
xorps xmm1, xmm3
addps xmm0, xmm1
mulps xmm0, xmm4
movaps xmm1, xmm0
shufps xmm1, xmm1, 0x49
shufps xmm0, xmm0, 0xe3
xorps xmm0, xmm5
subps xmm1, xmm0
movlps xmm0, qword [eax + ebx*8 + 8]
movhps xmm0, qword [eax + 8]
movaps xmm2, xmm0
subps xmm0, xmm1
addps xmm2, xmm1
movhps qword [eax + 8], xmm2
movlps qword [eax + ebx*8 + 8], xmm2
movhps qword [eax + esi*8 + 8], xmm0
movlps qword [eax + ebp*8 + 8], xmm0
add edx, 0xffffffe0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edx
lea eax, [edi + 8]
movlps xmm0, qword [edi + esi*8 + 8]
movhps xmm0, qword [edi + ebp*8 + 8]
movaps xmm1, xmm0
movaps xmm6, xmmword [edx + 0x10]
movaps xmm7, xmmword [edx]
mulps xmm0, xmm6
mulps xmm1, xmm7
shufps xmm1, xmm1, 0xb1
xorps xmm1, xmm3
addps xmm0, xmm1
movaps xmm1, xmm0
shufps xmm1, xmm1, 0x3c
shufps xmm0, xmm0, 0x96
xorps xmm1, xmm5
addps xmm0, xmm1
movlps xmm1, qword [edi + 8]
movhps xmm1, qword [edi + ebx*8 + 8]
movaps xmm2, xmm1
subps xmm2, xmm0
addps xmm1, xmm0
movlps qword [edi + 8], xmm1
movhps qword [edi + ebx*8 + 8], xmm1
movlps qword [edi + esi*8 + 8], xmm2
movhps qword [edi + ebp*8 + 8], xmm2
add edx, 0xffffffe0
mov edi, eax
dec ecx
jne 0x48929d
add esp, 0x18
pop ebx
pop ebp
pop esi
pop edi
pop ebp
ret 4
Function at 0x4917ac
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
add esp, 0xfffffff0
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x4917e5
mov byte [esi + 0x54c], dl
test dl, dl
je 0x4917d9
cmp byte [esi + 0x532], 1
jne 0x4917d9
xor edx, edx
mov eax, esi
call fcn.00491b68
jmp 0x491957
mov eax, esi
call fcn.00491ce8
jmp 0x491957
test byte [esi + 0x1c], 2
je 0x4917f6
mov byte [esi + 0x54c], dl
jmp 0x491957
mov al, byte [esi + 0x54c]
cmp dword [esi + 0x540], 0xffffffff
je 0x491826
test al, al
jne 0x491826
mov byte [esi + 0x54c], 0
mov ecx, 0x491964
mov dl, 1
mov eax, dword [0x490e14]
call fcn.0040eff4
call fcn.004046c4
cmp byte [esi + 0x532], 1
sete cl
test cl, dl
je 0x491851
mov byte [esi + 0x54c], 0
mov ecx, 0x49198c
mov dl, 1
mov eax, dword [0x490e14]
call fcn.0040eff4
call fcn.004046c4
mov ecx, edx
mov byte [esi + 0x54c], cl
test cl, cl
je 0x491942
test al, al
jne 0x491932
mov byte [esi + 0x54c], 1
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [esi + 0x540], eax
mov eax, esp
xor ecx, ecx
mov edx, 0x10
call fcn.0040356c
mov word [esp], 2
mov edx, dword [esi + 0x538]
mov eax, esi
call fcn.004934d8
mov word [esp + 2], ax
push 0
call sub.wsock32.dll_htonl
mov dword [esp + 4], eax
mov dl, byte [esi + 0x54d]
mov eax, esi
call fcn.00491a64
mov byte [esi + 0x54c], 0
push 0x10
lea eax, [esp + 4]
push eax
mov eax, dword [esi + 0x540]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x4918f3
mov ecx, 0x4919c0
mov dl, 1
mov eax, dword [0x490e14]
call fcn.0040eff4
call fcn.004046c4
push 5
mov eax, dword [esi + 0x540]
push eax
call sub.wsock32.dll_listen
test eax, eax
je 0x49191b
mov ecx, 0x4919e8
mov dl, 1
mov eax, dword [0x490e14]
call fcn.0040eff4
call fcn.004046c4
mov byte [esi + 0x54c], 1
mov ecx, 0x491a10
mov dl, 3
mov eax, esi
call fcn.00491c84
jmp 0x491957
mov ecx, 0x491a2c
mov dl, 3
mov eax, esi
call fcn.00491c84
jmp 0x491957
mov eax, esi
call fcn.00492868
mov ecx, 0x491a50
mov dl, 3
mov eax, esi
call fcn.00491c84
add esp, 0x10
pop esi
ret
Function at 0x491a64
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
push ecx
mov esi, eax
test byte [esi + 0x1c], 0x10
jne 0x491a80
test byte [esi + 0x1c], 2
je 0x491a80
mov byte [esi + 0x54d], dl
jmp 0x491b49
cmp dword [esi + 0x540], 0xffffffff
jne 0x491a94
mov byte [esi + 0x54d], dl
jmp 0x491b49
xor edi, edi
mov byte [esi + 0x54d], dl
cmp dword [esi + 0x30], 0
jne 0x491ac0
mov eax, dword [0x4fe0f0]
mov eax, dword [eax]
xor edx, edx
call fcn.0045db1c
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, esi
call fcn.004463a0
cmp byte [esi + 0x54d], 0
je 0x491b05
cmp byte [esi + 0x54c], 0
jne 0x491b05
xor eax, eax
mov dword [esp], eax
push edi
push 0x44b
mov eax, esi
call fcn.004463c4
push eax
mov eax, dword [esi + 0x540]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push esp
push 0x8004667e
mov eax, dword [esi + 0x540]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x491b49
cmp byte [esi + 0x54c], 0
je 0x491b15
mov edi, 8
jmp 0x491b2f
mov edi, 1
cmp byte [esi + 0x532], 0
jne 0x491b2f
or edi, 0x20
or edi, 0x10
or edi, 2
or edi, 1
push edi
push 0x44b
mov eax, esi
call fcn.004463c4
push eax
mov eax, dword [esi + 0x540]
push eax
call sub.wsock32.dll_WSAAsyncSelect
pop edx
pop edi
pop esi
ret
Function at 0x491d28
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x491d37
add esp, 0xfffffff0
call fcn.0040425c
mov ebx, edx
mov edi, eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x455d5c]
call fcn.0045887c
mov esi, eax
mov dword [edi + 0x598], esi
mov ecx, esi
xor edx, edx
mov eax, edi
call fcn.00447ed4
mov dl, 1
mov eax, dword [0x48c020]
call fcn.0048fc2c
mov dword [edi + 0x59c], eax
mov edx, dword [edi + 0x598]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x68]
push 0x50e6a8
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x491da4
mov ecx, 0x491f6c
mov dl, 1
mov eax, dword [0x490e14]
call fcn.0040eff4
call fcn.004046c4
mov dl, 1
mov eax, dword [0x4190f0]
call fcn.00403ec8
mov dword [0x50e6a0], eax
mov eax, dword [0x50e6a0]
mov edx, dword [eax]
call dword [edx + 0x44]
test byte [edi + 0x1c], 0x10
je 0x491e95
mov dl, 1
mov eax, dword [0x426554]
call fcn.0042c1c8
mov dword [edi + 0x238], eax
mov dl, 1
mov eax, dword [0x426554]
call fcn.0042c1c8
mov dword [edi + 0x23c], eax
mov dl, 1
mov eax, dword [0x426554]
call fcn.0042c1c8
mov dword [edi + 0x240], eax
push 0x491f98
mov eax, dword [0x4ff718]
push eax
call sub.user32.dll_LoadBitmapA
mov edx, eax
mov eax, dword [edi + 0x238]
call fcn.0042d2b0
push 0x491f9c
mov eax, dword [0x4ff718]
push eax
call sub.user32.dll_LoadBitmapA
mov edx, eax
mov eax, dword [edi + 0x23c]
call fcn.0042d2b0
push 0x491fa0
mov eax, dword [0x4ff718]
push eax
call sub.user32.dll_LoadBitmapA
mov edx, eax
mov eax, dword [edi + 0x240]
call fcn.0042d2b0
mov esi, dword [edi + 0x238]
mov dword [edi + 0x234], esi
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, edi
call fcn.0043f450
mov eax, dword [edi + 0x234]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, edi
call fcn.0043f474
mov dl, 1
mov eax, edi
mov si, 0xffce
call fcn.004040f4
jmp 0x491ebd
xor edx, edx
mov eax, edi
call fcn.0043f450
xor edx, edx
mov eax, edi
call fcn.0043f474
xor edx, edx
mov eax, edi
mov si, 0xffce
call fcn.004040f4
xor edx, edx
mov eax, edi
call fcn.0043fbdc
lea eax, [edi + 0x534]
call fcn.00404dac
lea eax, [edi + 0x538]
call fcn.00404dac
lea eax, [edi + 0x53c]
mov edx, 0x491fb0
call fcn.00404e00
mov dword [edi + 0x540], 0xffffffff
mov byte [edi + 0x533], 3
mov byte [edi + 0x230], 0
lea eax, [edi + 0x544]
call fcn.00404dac
lea eax, [edi + 0x548]
call fcn.00404dac
mov byte [edi + 0x54c], 0
mov byte [edi + 0x54d], 0
mov byte [edi + 0x54e], 0
mov byte [edi + 0x54f], 0
mov ecx, edi
mov dl, 1
mov eax, dword [0x491370]
call fcn.00491448
mov dword [edi + 0x554], eax
mov byte [edi + 0x558], 0
mov eax, edi
test bl, bl
je 0x491f5d
call fcn.004042b4
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x492608
Capabilities:
Connect socket
Connect udp socket
Create udp socket

Disassembly:
push ebx
push esi
add esp, 0xfffffff0
mov ebx, eax
cmp dword [ebx + 0x540], 0xffffffff
jne 0x4927b8
cmp byte [ebx + 0x532], 0
jne 0x49262c
mov esi, 1
jmp 0x492631
mov esi, 2
push 0
push esi
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0x540], eax
mov dl, byte [ebx + 0x54d]
mov eax, ebx
call fcn.00491a64
mov word [esp], 2
mov eax, dword [ebx + 0x53c]
mov edx, 0x4927cc
call fcn.004051c4
jne 0x49267a
mov edx, dword [ebx + 0x538]
mov eax, ebx
call fcn.004934d8
mov word [esp + 2], ax
jmp 0x49268c
mov edx, dword [ebx + 0x53c]
mov eax, ebx
call fcn.004934d8
mov word [esp + 2], ax
push 0
call sub.wsock32.dll_htonl
mov dword [esp + 4], eax
mov word [ebx + 0x210], 2
mov edx, dword [ebx + 0x538]
mov eax, ebx
call fcn.004934d8
mov word [ebx + 0x212], ax
mov edx, dword [ebx + 0x534]
mov eax, ebx
call fcn.00493384
mov dword [ebx + 0x214], eax
cmp byte [ebx + 0x532], 0
jne 0x49275d
push 0x10
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x540]
push eax
call sub.wsock32.dll_bind
mov esi, eax
push 0x10
lea eax, [ebx + 0x210]
push eax
mov eax, dword [ebx + 0x540]
push eax
call sub.wsock32.dll_connect
add esi, eax
mov eax, esi
cmp byte [ebx + 0x54d], 0
je 0x4927b8
test eax, eax
jne 0x492746
mov byte [ebx + 0x54f], 1
mov ecx, 0x4927d8
mov dl, 1
mov eax, ebx
call fcn.00491c84
cmp word [ebx + 0x562], 0
je 0x4927b8
mov edx, ebx
mov eax, dword [ebx + 0x564]
call dword [ebx + 0x560]
jmp 0x4927b8
mov ecx, 0x4927fc
mov dl, 2
mov eax, ebx
call fcn.00491c84
mov eax, ebx
call fcn.00492868
jmp 0x4927b8
push 0x10
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x540]
push eax
call sub.wsock32.dll_bind
test eax, eax
jne 0x4927a3
mov byte [ebx + 0x54f], 1
mov ecx, 0x492824
mov dl, 1
mov eax, ebx
call fcn.00491c84
cmp word [ebx + 0x562], 0
je 0x4927b8
mov edx, ebx
mov eax, dword [ebx + 0x564]
call dword [ebx + 0x560]
jmp 0x4927b8
mov ecx, 0x492848
mov dl, 2
mov eax, ebx
call fcn.00491c84
mov eax, ebx
call fcn.00492868
mov al, byte [ebx + 0x54f]
add esp, 0x10
pop esi
pop ebx
ret
Function at 0x492fd8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405268
mov eax, dword [ebp - 8]
call fcn.00405268
xor eax, eax
push ebp
push 0x49309a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x540], 0xffffffff
jne 0x493025
mov ecx, 0x4930b4
mov dl, 1
mov eax, dword [0x490e14]
call fcn.0040eff4
call fcn.004046c4
cmp byte [esi + 0x532], 0
jne 0x493044
mov ecx, 0x4930e0
mov dl, 1
mov eax, dword [0x490e14]
call fcn.0040eff4
call fcn.004046c4
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0049159c
cmp dword [ebp - 4], 0
je 0x49307f
push 0x10
lea eax, [esi + 0x210]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405080
push eax
lea eax, [ebp - 4]
call fcn.004052d0
push eax
mov eax, dword [esi + 0x540]
push eax
call sub.wsock32.dll_sendto
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4930a1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404dd0
ret
Function at 0x493120
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4932c8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x540], 0xffffffff
jne 0x49316c
mov ecx, 0x4932e0
mov dl, 1
mov eax, dword [0x490e14]
call fcn.0040eff4
call fcn.004046c4
cmp byte [ebx + 0x532], 0
jne 0x49318b
mov ecx, 0x493310
mov dl, 1
mov eax, dword [0x490e14]
call fcn.0040eff4
call fcn.004046c4
mov eax, 0x104
call fcn.00402a38
mov esi, eax
mov dword [esi], 1
mov eax, dword [ebx + 0x540]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
call fcn.00404dac
mov eax, dword [ebp - 4]
call fcn.00404dac
cmp dword [ebx + 0x550], 0
jl 0x4931d5
mov eax, 8
call fcn.00402a38
mov edi, eax
mov eax, dword [ebx + 0x550]
mov dword [edi], eax
jmp 0x4931d7
xor edi, edi
push edi
push 0
push 0
push esi
mov eax, dword [ebx + 0x540]
push eax
call sub.wsock32.dll_select
test eax, eax
jle 0x493295
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebx + 0x220]
push eax
push 0
push 0x2ee
lea eax, [ebx + 0x244]
push eax
mov eax, dword [ebx + 0x540]
push eax
call sub.wsock32.dll_recvfrom
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x493264
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x14]
lea edx, [ebx + 0x244]
mov ecx, 0x2ee
call fcn.00404e9c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov edx, 1
call fcn.004052d8
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00491c64
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00404e00
jmp 0x493295
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x20]
call fcn.0040b168
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x49335c
call fcn.004050cc
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x490e14]
call fcn.0040eff4
call fcn.004046c4
mov edx, 0x104
mov eax, esi
call fcn.00402a58
mov edx, 8
mov eax, edi
call fcn.00402a58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4932cf
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404dd0
ret
Function at 0x493384
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405268
xor eax, eax
push ebp
push 0x4934ad
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x49348f
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x4934c8
call fcn.004050cc
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, ebx
call fcn.00491c84
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, 4
call fcn.0040356c
mov bl, 1
mov eax, dword [ebp - 4]
call fcn.00405080
test eax, eax
jle 0x493410
mov esi, 1
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi - 1]
sub dl, 0x2e
je 0x49340c
add dl, 0xfe
sub dl, 0xa
jb 0x49340c
xor ebx, ebx
jmp 0x493410
inc esi
dec eax
jne 0x4933f4
test bl, bl
je 0x49342d
mov eax, dword [ebp - 4]
call fcn.00405278
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x49348f
mov edx, dword [ebp - 4]
mov eax, dword [0x50e6a0]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov ebx, eax
test ebx, ebx
jl 0x493451
mov edx, ebx
mov eax, dword [0x50e6a0]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov dword [ebp - 8], eax
jmp 0x49348f
cmp dword [ebp - 4], 0
je 0x493485
mov eax, dword [ebp - 4]
call fcn.00405278
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x49348f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [0x50e6a0]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
jmp 0x49348f
push 0
call sub.wsock32.dll_htonl
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4934b4
lea eax, [ebp - 0xc]
call fcn.00404dac
lea eax, [ebp - 4]
call fcn.00404dac
ret

Function at 0x495930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x495946
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x49593f
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x495958
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x495951
mov eax, esp
lea esi, [edx + 1]
dec esi
test esi, esi
jl 0x495974
inc esi
mov edx, ecx
mov ecx, dword [ebp + 0xc]
mov bl, byte [eax]
xor bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
inc eax
dec esi
jne 0x495968
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a4c44
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x4fdc08]
cmp byte [eax], 0
jne 0x4a4c72
mov ecx, 0xaf
mov edx, 0x4a4cc0
mov eax, 0x4a4d08
call fcn.00404d08
mov eax, ebx
call fcn.004054ec
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4a4cb1
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405698
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a4d1c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x4fdc08]
cmp byte [eax], 0
jne 0x4a4d3f
mov ecx, 0xbd
mov edx, 0x4a4d80
mov eax, 0x4a4dc8
call fcn.00404d08
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4a4d72
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x4a4d72
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x4a4d72
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4a973c
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x4fe118]
cmp dword [eax], 2
je 0x4a975a
mov ecx, 0x35f
mov edx, 0x4a978c
mov eax, 0x4a97d4
call fcn.00404d08
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x4a96dc
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x50f0e8], eax
cmp dword [0x50f0e8], 0
jne 0x4a9781
call fcn.004105e0
ret

Function at 0x4aa150
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4aa1ac
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4aa17b
call fcn.004105e0
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402c64
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4aa1ac
call fcn.004105e0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x4aa3c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4aa459
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov edx, dword [ebp - 4]
call fcn.00405858
je 0x4aa43e
cmp dword [0x50f398], 0
je 0x4aa416
mov eax, dword [ebp - 4]
call fcn.00405730
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne al
neg al
sbb eax, eax
mov dword [ebp - 8], eax
jmp 0x4aa443
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405048
mov eax, dword [ebp - 0xc]
call fcn.00405278
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
neg al
sbb eax, eax
mov dword [ebp - 8], eax
jmp 0x4aa443
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa460
lea eax, [ebp - 0xc]
call fcn.00404dac
ret

Function at 0x4aa660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4aa6d7
cmp dword [ebp - 8], 0
je 0x4aa6d0
cmp dword [ebp - 0xc], 0
jbe 0x4aa6d0
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x4aa6c7
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jne 0x4aa6be
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4aa6de
mov dword [ebp - 0x10], 0xfffffffc
jmp 0x4aa6de
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x4aa6de
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4aa6de
mov dword [ebp - 0x10], 0xfffffffe
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8

Function at 0x4aa73c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 2
lea eax, [ebp - 2]
push eax
push 0xf
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4aa763
mov al, byte [ebp - 2]
mov byte [0x4fc00c], al
jmp 0x4aa76a
mov byte [0x4fc00c], 0x2c
push 2
lea eax, [ebp - 6]
push eax
push 0xf
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4aa78d
mov ax, word [ebp - 6]
mov word [0x4fc010], ax
jmp 0x4aa796
mov word [0x4fc010], 0x2c
pop ecx
pop ecx
pop ebp
ret