joyce8/EMBER2024-capa huggingface dataset:
Function at 0x537d50
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
call fcn.00537df0
push 0x104
push dword [ebp + 8]
lea eax, [esi + 8]
push eax
call fcn.005d6f00
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov edx, 1
cmp edi, 2
jne 0x537d87
mov ecx, 0xc0000000
lea edx, [edi + 1]
jmp 0x537d8c
mov ecx, closesocket
xor eax, eax
cmp edi, 1
push 0
push 0x80
setne al
add eax, 3
push eax
push 0
push edx
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x110], eax
cmp eax, 0xffffffff
je 0x537dd4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 4], edi
mov dword [esi + 0x114], eax
mov eax, 1
pop edi
pop esi
pop ebp
ret 8
pop edi
mov dword [esi + 0x110], 0
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x540240
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61bbf1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6b64f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x4c]
mov dword [edi], vtable.CNetworkStream.0
call fcn.006043b0
lea ecx, [edi + 0x60]
mov dword [ebp - 4], 0
call fcn.0055e720
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
push 0x8000
lea ecx, [edi + 0x78]
mov byte [ebp - 4], 2
mov dword [edi + 0x5c], 0xffffffff
mov byte [edi + 0x48], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x70], 0
mov byte [edi + 0x74], 0
call fcn.00473010
push 0x8000
push 0x69e7c0
push dword [edi + 0x78]
call fcn.005db1f0
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x540530
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
call fcn.005404b0
mov eax, dword [ebp + 8]
lea esi, [edi + 0x60]
push 0
push 1
push 2
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi], xmm0
call sub.WS2_32.dll_socket
mov dword [edi + 0x5c], eax
cmp eax, 0xffffffff
je 0x5405a3
lea ecx, [ebp - 4]
mov dword [ebp - 4], 1
push ecx
push 0x8004667e
push eax
call sub.WS2_32.dll_ioctlsocket
mov ecx, esi
call fcn.004e87b0
push eax
push esi
push dword [edi + 0x5c]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x5405bb
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x5405bb
push str.error___WSAEWOULDBLOCK
call fcn.005328b0
add esp, 4
mov ecx, edi
call fcn.005404b0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
call fcn.005dc852
mov ecx, eax
add esp, 4
mov eax, dword [ebp + 0xc]
mov esi, edx
cdq
add ecx, eax
mov al, 1
mov dword [edi + 8], ecx
adc esi, edx
mov dword [edi + 0xc], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x5407e0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6b64f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
cmp eax, 0xffffffff
je 0x540928
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x214]
push eax
push 0
lea eax, [ebp - 0x108]
mov dword [ebp - 0x20c], 1
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x108], 1
push eax
push 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
je 0x540928
cmp byte [esi + 0x48], 0
lea eax, [ebp - 0x108]
push eax
push dword [esi + 0x5c]
jne 0x5408c7
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x540890
mov eax, dword [esi]
mov ecx, esi
mov byte [esi + 0x48], 1
call dword [eax + 4]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d67d1
mov esp, ebp
pop ebp
ret
push 0
call fcn.005dc852
add esp, 4
cmp edx, dword [esi + 0xc]
jl 0x540928
jg 0x5408aa
cmp eax, dword [esi + 8]
jbe 0x540928
mov ecx, esi
call fcn.005404b0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d67d1
mov esp, ebp
pop ebp
ret
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x5408ef
mov eax, dword [esi + 0x34]
cmp eax, dword [esi + 0x38]
jle 0x5408ef
mov ecx, esi
call fcn.00540c10
test al, al
jne 0x5408ef
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x54091a
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 0x5c]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x54090d
mov ecx, esi
call fcn.00540b70
test al, al
je 0x54091a
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x14]
call eax
test al, al
jne 0x540928
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov ecx, esi
call fcn.005404b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005d67d1
mov esp, ebp
pop ebp
ret
Function at 0x540b70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0x28]
test edx, edx
jle 0x540ba2
mov eax, dword [esi + 0x24]
sub eax, edx
test eax, eax
jle 0x540b95
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ecx + edx]
push eax
push ecx
call fcn.005d6840
add esp, 0xc
mov eax, dword [esi + 0x28]
sub dword [esi + 0x24], eax
mov dword [esi + 0x28], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
sub eax, ecx
test eax, eax
jle 0x540c00
push 0
push eax
mov eax, dword [esi + 0x1c]
add eax, ecx
push eax
push dword [esi + 0x5c]
call sub.WS2_32.dll_recv
mov edi, eax
test edi, edi
jns 0x540bd6
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x540bd8
pop edi
xor al, al
pop esi
ret
je 0x540bd1
mov ecx, esi
call fcn.00540730
test al, al
je 0x540bfd
mov edx, dword [esi + 0x1c]
add edx, dword [esi + 0x24]
cmp byte [esi + 0x4c], 0
je 0x540bfd
mov ecx, dword [esi + 0x54]
add ecx, 4
push edi
push edx
push edx
mov eax, dword [ecx]
call dword [eax + 0x1c]
add dword [esi + 0x24], edi
pop edi
mov al, 1
pop esi
ret

Function at 0x540c10
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00540b20
mov edi, eax
test edi, edi
jle 0x540c69
mov ecx, esi
call fcn.00540730
test al, al
je 0x540c44
mov edx, dword [esi + 0x38]
add edx, dword [esi + 0x2c]
cmp byte [esi + 0x4c], 0
je 0x540c44
mov ecx, dword [esi + 0x50]
add ecx, 4
push edi
push edx
push edx
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [esi + 0x2c]
add eax, dword [esi + 0x38]
push 0
push edi
push eax
push dword [esi + 0x5c]
call sub.WS2_32.dll_send
test eax, eax
jns 0x540c5f
pop edi
xor al, al
pop esi
ret
add dword [esi + 0x38], eax
mov ecx, esi
call fcn.00540b30
pop edi
mov al, 1
pop esi
ret
Function at 0x544920
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61bdf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6b64f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [0x70ae04], edi
mov dword [edi], vtable.CResourceManager.0
lea ecx, [edi + 4]
mov dword [ebp - 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.00463760
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 1
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.00463760
mov dword [edi + 0xc], eax
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 2
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.00467f00
mov dword [edi + 0x14], eax
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 3
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
call fcn.00463760
mov dword [edi + 0x1c], eax
lea ecx, [edi + 0x24]
mov byte [ebp - 4], 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
call fcn.00463760
mov dword [edi + 0x24], eax
lea ecx, [edi + 0x2c]
mov byte [ebp - 4], 5
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.00467f00
mov dword [edi + 0x2c], eax
lea ecx, [edi + 0x34]
mov byte [ebp - 4], 6
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
call fcn.00467f00
mov dword [edi + 0x34], eax
lea ecx, [edi + 0x3c]
mov byte [ebp - 4], 7
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
call fcn.00463760
mov dword [edi + 0x3c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x54a1d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov eax, dword [0x6b64f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x1c]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x19c], eax
call fcn.0054a310
push esi
push edi
push 0x54a3c0
push ebx
push dword [ebp - 0x1a8]
mov ebx, dword [ebp - 0x1a0]
mov ecx, ebx
call fcn.0054a430
push 0
push dword [0x7004a4]
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x19c]
push dword [ebp - 0x1a4]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebx + 4], eax
test eax, eax
jne 0x54a275
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d67d1
mov esp, ebp
pop ebp
ret 0x18
lea eax, [ebp - 0x198]
mov dword [ebp - 0x198], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x194], 6
jb 0x54a2ea
cmp dword [ebp - 0x190], 1
jb 0x54a2ea
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x62a334
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.0054a750
add esp, 0x10
push str.SetCurrentProcessExplicitAppUserModelID
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x54a2ea
lea ecx, [ebp - 0x104]
push ecx
call eax
test eax, eax
js 0x54a260
push ebx
push 0xffffffffffffffeb
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005d67d1
mov esp, ebp
pop ebp
ret 0x18

Function at 0x54a630
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
mov byte [ecx + 0x19], al
test al, al
je 0x54a64c
push 5
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
Function at 0x550880
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6b64f0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [0x70075c], eax
cmp dword [0x702484], eax
je 0x5509ca
push 8
lea ecx, [ebp - 0x18]
mov dword [0x702484], eax
push ecx
push 0x1004
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.00553660
add esp, 0xc
mov dword [0x702454], eax
cmp dword [0x6a683c], eax
je 0x5509ca
push 0x700760
mov dword [0x6a683c], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
movzx ecx, word [0x70075c]
mov eax, ecx
and eax, 0x3ff
sub eax, 4
je 0x550936
sub eax, 0xd
je 0x550923
dec eax
jne case.default.0x550948
mov byte [0x70076a], al
mov dword [0x701c34], 0x6a682e
jmp 0x5509af
mov byte [0x70076a], 1
mov dword [0x701c34], 0x6a6834
jmp 0x5509af
mov eax, ecx
mov byte [0x70076a], 1
shr eax, 0xa
dec eax
cmp eax, 4
ja case.default.0x550948
jmp dword [eax*4 + 0x5509d8]
mov byte [0x70076a], 0
mov dword [0x701c34], 0x6a6822
jmp 0x5509af
mov dword [0x701c34], 0x6a6828
jmp 0x5509af
push 0xa
lea eax, [ebp - 0x10]
mov dword [0x701c34], 0x6a681c
push eax
push 3
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, dword [0x701c34]
movsx cx, byte [ebp - 0x10]
mov word [eax], cx
movsx ax, byte [ebp - 0xf]
movzx eax, ax
push eax
call fcn.005de369
mov ecx, dword [0x701c34]
add esp, 4
mov word [ecx + 2], ax
cmp dword [0x702450], 0x4e8
je 0x5509ca
mov eax, dword [0x702454]
mov dword [0x702450], eax
call fcn.00550af0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d67d1
mov esp, ebp
pop ebp
ret
Function at 0x551220
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x6b64f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, 2
jae 0x55146d
mov ecx, dword [0x70075c]
cmp dword [0x702480], ecx
je 0x5514bb
cmp byte [0x700752], 0
mov eax, 0x404
mov dword [0x702480], ecx
je 0x55128b
cmp cx, ax
jne 0x55128b
mov dword [0x70080c], 0x7000404
mov eax, 0x7000404
mov dword [0x700810], 0
jmp 0x55146f
cmp ecx, 0xe0080404
je 0x5512b7
cmp ecx, 0xe0090404
je 0x5512b7
cmp ecx, 0xe00a0404
je 0x5512b7
cmp ecx, 0xe00b0404
je 0x5512b7
cmp ecx, 0xe00e0804
jne 0x551459
push 0x3ff
lea eax, [ebp - 0x404]
push eax
push ecx
call sub.IMM32.dll_ImmGetIMEFileNameA
test eax, eax
je 0x551459
cmp dword [0x700748], 0
jne 0x55137e
mov esi, dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x404]
push 0xffffffffffffffff
push str.TINTLGNT.IME
push 0xffffffffffffffff
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x55137e
push 0xffffffffffffffff
push str.CINTLGNT.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x55137e
push 0xffffffffffffffff
push str.MSTCIPHA.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x55137e
push 0xffffffffffffffff
push str.PINTLGNT.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x55137e
push 0xffffffffffffffff
push str.MSSCIPYA.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push 1
push 0x409
call esi
cmp eax, 2
jne 0x551459
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x404]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
movzx esi, word [0x70075c]
mov ebx, eax
test ebx, ebx
je 0x551459
call fcn.005de230
mov eax, esp
push eax
push ebx
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x404]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x551459
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x408]
push eax
push 0x670410
push dword [ebp - 0x40c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x551459
mov edx, dword [ebp - 0x408]
mov eax, dword [edx + 8]
movzx ecx, al
and eax, 0xffff0000
shl ecx, 8
or ecx, eax
shl ecx, 8
cmp dword [0x700748], 0
jne 0x5514aa
mov eax, 0x404
cmp si, ax
jne 0x551488
cmp ecx, 0x4020000
je 0x5514aa
cmp ecx, 0x4030000
je 0x5514aa
cmp ecx, 0x4040000
je 0x5514aa
cmp ecx, 0x5000000
je 0x5514aa
cmp ecx, 0x5010000
je 0x5514aa
cmp ecx, 0x5020000
je 0x5514aa
cmp ecx, 0x6000000
je 0x5514aa
mov dword [0x70080c], 0
mov dword [0x700810], 0
xor eax, eax
lea esp, [ebp - 0x420]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d67d1
mov esp, ebp
pop ebp
ret 4
mov eax, 0x804
cmp si, ax
jne 0x551459
cmp ecx, 0x4010000
je 0x5514aa
cmp ecx, 0x4020000
je 0x5514aa
cmp ecx, 0x5030000
jne 0x551459
mov eax, esi
or eax, ecx
mov dword [0x70080c], eax
mov eax, dword [edx + 0xc]
mov dword [0x700810], eax
mov eax, dword [edi*4 + 0x70080c]
jmp 0x55146f
Function at 0x551610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x6b64f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x70075c]
push ebx
cmp eax, 0xe00e0804
je 0x5517e2
cmp eax, 0xe0090404
je 0x5517e2
mov ebx, dword [0x70080c]
test ebx, ebx
je 0x5517e2
xor cl, cl
mov edx, 0x404
mov byte [ebp - 0x109], cl
cmp ax, dx
jne 0x5517d1
movdqu xmm0, xmmword [str.softwaremicrosoftwindowscurrentversion_]
mov ax, word [0x62a8ec]
and ebx, 0xffff0000
mov word [ebp - 0xe0], ax
cmp ebx, 0x5010000
mov al, byte [0x62a8ee]
mov edx, str.MSTCIPH
movdqu xmmword [ebp - 0x108], xmm0
mov byte [ebp - 0xde], al
mov eax, str.TINTLGNT
movdqu xmm0, xmmword [0x62a8d4]
push esi
cmovb edx, eax
movdqu xmmword [ebp - 0xf8], xmm0
mov esi, edx
movq xmm0, qword [0x62a8e4]
push edi
movq qword [ebp - 0xe8], xmm0
mov al, byte [edx]
inc edx
test al, al
jne 0x5516c8
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5516d8
mov ecx, edx
lea eax, [ebp - 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
push 0
mov ecx, edx
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
jne 0x5517bc
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 4
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push str.Keyboard_Mapping
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x551799
mov eax, dword [ebp - 0x118]
cmp ebx, 0x5000000
ja 0x551764
cmp al, 0x22
je 0x55177a
cmp al, 0x23
je 0x55177a
cmp ebx, 0x5010000
je 0x551774
cmp ebx, 0x5020000
jne 0x551799
sub al, 0x22
cmp al, 2
ja 0x551799
push dword [ebp - 0x110]
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d67d1
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x110]
mov bl, byte [ebp - 0x109]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d67d1
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x109]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d67d1
mov esp, ebp
pop ebp
ret
mov al, cl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d67d1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.005d67d1
mov esp, ebp
pop ebp
ret
Function at 0x551a90
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x6b64f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x700750], 0
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
jne 0x551c5b
cmp byte [0x702468], 0
mov dword [0x700758], eax
jne 0x551af2
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x551af2
push 0x702464
push 0x62a7f4
push 1
push 0
push 0x651410
mov byte [0x702468], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
push 0x700770
mov dword [0x700770], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x105
lea eax, [ebp - 0x10c]
mov byte [0x700751], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x551bda
lea ecx, [ebp - 0x10c]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x551b30
mov eax, dword [0x62a804]
mov dword [ecx], eax
mov eax, dword [0x62a808]
mov dword [ecx + 4], eax
mov ax, word [0x62a80c]
mov word [ecx + 8], ax
mov al, byte [0x62a80e]
mov byte [ecx + 0xa], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x70076c], eax
test eax, eax
je 0x551bd3
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmLockIMC
push eax
call esi
push str.ImmUnlockIMC
push dword [0x70076c]
mov dword [0x700738], eax
call esi
push str.ImmLockIMCC
push dword [0x70076c]
mov dword [0x70073c], eax
call esi
push str.ImmUnlockIMCC
push dword [0x70076c]
mov dword [0x700740], eax
call esi
push str.ImmDisableTextFrameService
push dword [0x70076c]
mov dword [0x700744], eax
call esi
pop esi
test eax, eax
je 0x551bda
push 0xffffffffffffffff
call eax
jmp 0x551bda
mov byte [0x700751], 1
push dword [0x700758]
mov byte [0x700750], 1
call sub.IMM32.dll_ImmGetContext
push eax
mov dword [edi + 4], eax
push dword [0x700758]
call sub.IMM32.dll_ImmReleaseContext
call fcn.00550880
call fcn.00550850
push 2
call fcn.00552a90
add esp, 4
call fcn.00552e50
test eax, eax
setne byte [0x700752]
call fcn.005509f0
cmp byte [0x700752], 0
je 0x551c5b
mov eax, dword [0x70075c]
and eax, 0x3ff
cmp eax, 4
jne 0x551c4a
call fcn.00550c60
mov byte [0x700755], 1
test eax, eax
jne 0x551c51
mov byte [0x700755], 0
push 0
call fcn.00552ff0
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.005d67d1
mov esp, ebp
pop ebp
ret 4
Function at 0x5522b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c4eb
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x6b64f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x20], 0
je 0x552399
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x552399
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
lea ecx, [ebp - 0x828]
call fcn.0045bdb0
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0x818]
test ecx, ecx
je 0x552382
cmp dword [ebp - 0x814], 0x10
lea edx, [ebp - 0x810]
push 0x400
push edx
push ecx
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
push 0
push dword [0x702454]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
lea eax, [ebp - 0x810]
mov ecx, edi
push eax
call fcn.00551c70
mov ecx, dword [0x701c38]
test ecx, ecx
je 0x552382
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x814], 0x10
jb 0x552399
push dword [ebp - 0x828]
call fcn.004e41e0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d67d1
mov esp, ebp
pop ebp
ret

Function at 0x556a10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c5ee
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x6b64f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x7024b4]
test al, 1
jne 0x556a6b
or eax, 1
mov dword [0x7024b4], eax
mov ecx, 0x7024b0
mov dword [ebp - 4], 0
call fcn.00546210
push 0x625c00
call fcn.005d757c
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x70ed64]
push 0xffffffffffffffff
push 0x3c
call fcn.005493c0
movdqu xmm0, xmmword [esi + 0x1c]
sub esp, 0x40
mov ecx, 0x7024b0
mov eax, esp
sub esp, 0x18
movdqu xmmword [eax], xmm0
movdqu xmm0, xmmword [esi + 0x2c]
movdqu xmmword [eax + 0x10], xmm0
movdqu xmm0, xmmword [esi + 0x3c]
movdqu xmmword [eax + 0x20], xmm0
movdqu xmm0, xmmword [esi + 0x4c]
movdqu xmmword [eax + 0x30], xmm0
movups xmm0, xmmword [esi + 0xc]
movups xmmword [esp + 8], xmm0
movss xmm0, dword [esi + 8]
movss dword [esp + 4], xmm0
movss xmm0, dword [esi + 4]
movss dword [esp], xmm0
call fcn.00547200
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x558970
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00533620

Function at 0x55e7a0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x55e7b9
xor al, al
pop esi
pop ebp
ret 4
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 4], eax
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x564e10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x564e20
mov edx, dword [ecx]
jmp 0x564e22
mov edx, ecx
mov ecx, dword [ecx + 0x10]
xor eax, eax
push ebx
push esi
add ecx, edx
xor ebx, ebx
push edi
mov edi, ecx
xor esi, esi
sub edi, edx
cmp edx, ecx
cmova edi, ebx
test edi, edi
je 0x564e53
lea ecx, [ecx]
movzx ecx, byte [edx]
lea edx, [edx + 1]
imul eax, eax, 0x1000193
inc esi
xor eax, ecx
cmp esi, edi
jb 0x564e40
pop edi
pop esi
pop ebx
pop ebp
ret 4