joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f7f8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4956c8]
cmp byte [eax + 0xc], 0
je 0x44f965
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44f95e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x499578], 0
jne 0x44f84c
push 0x44f96c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44f974
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x499578], eax
cmp dword [0x4936ac], 0
jne 0x44f947
push 0x44f984
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4936ac], eax
cmp dword [0x4936ac], 0
je 0x44f947
push 0x44f990
mov eax, dword [0x4936ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49957c], eax
push 0x44f9a0
mov eax, dword [0x4936ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x499580], eax
push 0x44f9b4
mov eax, dword [0x4936ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x499584], eax
push 0x44f9cc
mov eax, dword [0x4936ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x499588], eax
push 0x44f9e4
mov eax, dword [0x4936ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49958c], eax
push 0x44f9f8
mov eax, dword [0x4936ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x499590], eax
push 0x44fa10
mov eax, dword [0x4936ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x499594], eax
push 0x44fa28
mov eax, dword [0x4936ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x499598], eax
push 0x44fa44
mov eax, dword [0x4936ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49959c], eax
push 0x44fa50
mov eax, dword [0x4936ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4995a0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f965
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x454fd4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x455028]
test si, 4
je 0x454fe9
or bl, 1
test si, 8
je 0x454ff3
or bl, 4
test si, 1
je 0x454ffd
or bl, 8
test si, 2
je 0x455007
or bl, 0x10
test si, 0x10
je 0x455011
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x455020
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45502c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x455068]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x455046
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x455055
or bl, 4
test esi, 0x20000000
je 0x455060
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x45c7ac
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45c7be
add esp, 0xfffffff0
call fcn.004043b0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042051c
mov eax, dword [0x4952ec]
mov dword [eax + 4], ebx
mov dword [eax], 0x45cb50
mov eax, dword [0x4952f8]
mov dword [eax + 4], ebx
mov dword [eax], 0x45cb5c
mov eax, ebx
call fcn.0045cb68
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x417b64]
call fcn.0040405c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x417b64]
call fcn.0040405c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x417b64]
call fcn.0040405c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x417b64]
call fcn.0040405c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x417b64]
call fcn.0040405c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x458600
push eax
push 0
push 0
mov eax, dword [0x49548c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4251cc]
call fcn.00426a20
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4251cc]
call fcn.00426a20
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4251cc]
call fcn.00426a20
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045cf98
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45ce68
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45ce68
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45ce68
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45c8fb
call fcn.00404408
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45cc4c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45cdf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45cdd8
mov dl, 1
mov eax, dword [0x417f88]
call fcn.0040405c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404f8c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45cdc7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044fb54
test al, al
je 0x45cdba
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45ce08
lea eax, [ebp - 0x254]
call fcn.0040aff8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45cdba
xor eax, eax
push ebp
push 0x45cdb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45ce40
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45cd9c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004051fc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45cd9c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004051fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cdba
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45ccbd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041bce8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cdfe
lea eax, [ebp - 0x260]
call fcn.00404f8c
ret

Function at 0x45d770
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4995b0]
cmp byte [eax + 0xad], 0
jne 0x45d7e1
cmp dword [0x4995c8], 0
jne 0x45d7a2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45d72c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4995c8], eax
cmp dword [0x4995c4], 0
jne 0x45d7bd
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4995c4], eax
cmp dword [0x4995cc], 0
jne 0x45d7e1
push esp
push 0
push 0
push 0x45d6d0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4995cc], eax
pop edx
ret
Function at 0x45d9b4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45d9cb
add esp, 0xfffffff0
call fcn.004043b0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042051c
mov eax, dword [0x495474]
cmp word [eax + 2], 0
jne 0x45d9f3
mov eax, dword [0x495474]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045f47c
mov eax, dword [0x49553c]
cmp word [eax + 2], 0
jne 0x45da0d
mov eax, dword [0x49553c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045f688
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x417b64]
call fcn.0040405c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x417b64]
call fcn.0040405c
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x417b64]
call fcn.0040405c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x425cdc]
call fcn.0042d308
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x45dbc4
mov eax, dword [0x495368]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042d6dc
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45fd58
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x495368]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040f0e8
test eax, eax
je 0x45db14
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a614
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040f11c
test eax, eax
je 0x45db28
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004051fc
mov byte [ebx + 0xd4], 0
push ebx
push 0x45efc4
call fcn.00421698
mov dword [ebx + 0xc8], eax
mov eax, dword [0x495220]
cmp byte [eax], 0
jne 0x45db79
mov eax, ebx
call fcn.0045dd08
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045ff34
mov eax, ebx
call fcn.00460a94
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45dbb9
call fcn.00404408
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45df88
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4995b0]
cmp dword [eax + 0x30], 0
je 0x45e032
cmp dword [ebx + 0x94], 0
jne 0x45e02c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45df18
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45e02c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45dff2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45e02c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419f90
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45e001
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45ed4c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45ed81
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040507c
jmp 0x45ed8e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404fe0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x460118
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x460186
mov eax, esi
call fcn.0044a814
test al, al
je 0x460186
mov eax, dword [ebx + 0x84]
call fcn.0044a474
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x460186
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x46017a
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044a474
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0044286c
jmp 0x460186
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045ff54
pop esi
pop ebx
ret
Function at 0x4619cc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x461a8b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x80]
mov edx, 0x400
call fcn.004056d8
xor eax, eax
mov dword [ebx + 0x58], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x4c]
mov dword [ebx + 0x68], eax
lea eax, [ebx + 0x58]
push eax
lea eax, [ebp - 4]
push eax
push 0x400
lea eax, [ebx + 0x80]
call fcn.004054a8
push eax
mov eax, dword [ebx + 0x40]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x461a75
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0x3e5
je 0x461a75
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x461aa0
call fcn.0040b078
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x408400]
call fcn.0040e128
call fcn.00404900
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461a92
lea eax, [ebp - 8]
call fcn.00404f8c
ret
Function at 0x461ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x461bf9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x89], 0
je 0x461bde
lea eax, [ebx + 0x84]
call fcn.00404f8c
push 0x499608
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x64]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x461b2c
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x64]
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x84]
call fcn.00404fe0
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x64]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x48]
push 0x499608
call sub.kernel32.dll_LeaveCriticalSection
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x461b45
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 8], esi
cmp dword [ebp - 8], 0
je 0x461bde
xor eax, eax
mov dword [ebx + 0x6c], eax
xor eax, eax
mov dword [ebx + 0x70], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x78], eax
mov eax, dword [ebx + 0x50]
mov dword [ebx + 0x7c], eax
lea eax, [ebx + 0x6c]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebx + 0x84]
call fcn.004054a8
push eax
mov eax, dword [ebx + 0x40]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x461add
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3e5
je 0x461bd7
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x461c10
call fcn.0040b078
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x408400]
call fcn.0040e128
call fcn.00404900
mov byte [ebx + 0x89], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461c00
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404fb0
ret
Function at 0x465930
Capabilities:
Connect socket
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x400], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x465a9e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x54]
mov edx, dword [ebx + 0x50]
call fcn.00404fe0
cmp dword [ebx + 0x54], 0
jne 0x465989
push 0x3e8
lea eax, [ebp - 0x3f9]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebx + 0x54]
lea edx, [ebp - 0x3f9]
mov ecx, 0x3e9
call fcn.004051fc
mov eax, dword [ebx + 0x54]
movzx eax, byte [eax]
add al, 0xd0
sub al, 0xa
jb 0x465a2d
mov eax, dword [ebx + 0x54]
call fcn.00405450
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4659b9
xor edx, edx
mov eax, 0x465ab4
call fcn.00464d18
jmp 0x465a2d
mov esi, eax
lea eax, [ebp - 0x400]
push eax
mov eax, dword [esi + 0xc]
mov edi, dword [eax]
movzx eax, byte [edi]
mov dword [ebp - 0x420], eax
mov byte [ebp - 0x41c], 0
movzx eax, byte [edi + 1]
mov dword [ebp - 0x418], eax
mov byte [ebp - 0x414], 0
movzx eax, byte [edi + 2]
mov dword [ebp - 0x410], eax
mov byte [ebp - 0x40c], 0
movzx eax, byte [edi + 3]
mov dword [ebp - 0x408], eax
mov byte [ebp - 0x404], 0
lea edx, [ebp - 0x420]
mov ecx, 3
mov eax, 0x465acc
call fcn.0040b078
mov edx, dword [ebp - 0x400]
lea eax, [ebx + 0x54]
call fcn.00404fe0
mov eax, dword [ebx + 0x54]
call fcn.00405450
push eax
call sub.wsock32.dll_inet_addr
mov word [ebp - 0x10], 2
mov dword [ebp - 0xc], eax
movzx eax, word [ebx + 0x40]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
mov byte [ebx + 0x59], 1
push 0x10
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x44]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x465a85
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x465a85
mov byte [ebx + 0x59], 0
mov edx, eax
mov eax, 0x465ae0
call fcn.00464d18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465aa5
lea eax, [ebp - 0x400]
call fcn.00404f8c
ret

Function at 0x466d54
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x466db0
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00466ccc
test esi, esi
je 0x466d9a
mov eax, dword [ebp - 4]
call fcn.00405450
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x466d94
test al, 0x10
jne 0x466d98
xor ebx, ebx
jmp 0x466d9a
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466db7
lea eax, [ebp - 4]
call fcn.00404f8c
ret

Function at 0x467250
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 5
ja 0x46727c
cmp dword [esp + 4], 5
jne 0x467278
cmp dword [esp + 8], 1
jae 0x46727c
xor eax, eax
jmp 0x46727e
mov al, 1
add esp, 0x94
ret
Function at 0x4674d4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, eax
mov eax, ecx
test esi, esi
je 0x467504
test edx, edx
jle 0x467504
xor eax, 0xffffffff
test edx, edx
jle 0x467501
mov ecx, eax
xor cl, byte [esi]
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x493c58]
shr eax, 8
xor ecx, eax
mov eax, ecx
inc esi
dec edx
jne 0x4674e8
xor eax, 0xffffffff
pop esi
ret

Function at 0x467570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 9], 1
cmp dword [ebp - 4], 0xffffffff
je 0x4676af
xor eax, eax
push ebp
push 0x4676a1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409c54
lea edx, [ebp - 0x58]
mov ecx, 0x40
mov eax, dword [ebp - 4]
call fcn.00409bfc
mov ebx, eax
cmp ebx, 0x40
jne 0x467697
cmp word [ebp - 0x58], 0x5a4d
jne 0x467697
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00409c54
test eax, eax
jl 0x467697
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 4]
call fcn.00409bfc
mov ebx, eax
cmp ebx, 4
jne 0x467697
cmp dword [ebp - 0x10], 0x4550
jne 0x467697
lea edx, [ebp - 0x6c]
mov ecx, 0x14
mov eax, dword [ebp - 4]
call fcn.00409bfc
mov ebx, eax
cmp ebx, 0x14
jne 0x467697
cmp word [ebp - 0x6c], 0x14c
jne 0x467697
movzx eax, word [ebp - 0x6a]
mov dword [ebp - 0x18], eax
mov ecx, 1
mov edx, 0xe0
mov eax, dword [ebp - 4]
call fcn.00409c54
test eax, eax
jl 0x467697
mov byte [ebp - 9], 0
mov edi, dword [ebp - 0x18]
test edi, edi
jle 0x4675ac
lea edx, [ebp - 0x94]
mov ecx, 0x28
mov eax, dword [ebp - 4]
call fcn.00409bfc
mov ebx, eax
cmp ebx, 0x28
je 0x46767e
mov byte [ebp - 9], 1
jmp 0x4675ac
mov esi, dword [ebp - 0x80]
add esi, dword [ebp - 0x84]
cmp esi, dword [ebp - 8]
jbe 0x46768f
mov dword [ebp - 8], esi
dec edi
jne 0x46765b
jmp 0x4675ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4676af
cmp byte [ebp - 9], 0
je 0x4676ba
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a7b4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 0xd], dl
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46a8d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x46a8b6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x46a8ab
lea ecx, [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1c]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x46a820
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jl 0x46a8a1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1c]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
setne al
or al, byte [ebp - 0xd]
je 0x46a8a1
test esi, esi
je 0x46a845
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, 0x46a8e0
call fcn.00466534
test al, al
je 0x46a887
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ef2c
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405024
mov eax, dword [ebp - 4]
call fcn.00466d54
test al, al
je 0x46a8a1
mov eax, dword [ebp - 4]
call fcn.0040a5c0
jmp 0x46a8a1
mov eax, dword [ebp - 4]
call fcn.00409cb0
test al, al
je 0x46a8a1
mov eax, dword [ebp - 4]
call fcn.00405450
push eax
call sub.kernel32.dll_DeleteFileA
dec ebx
cmp ebx, 0xffffffff
jne 0x46a802
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1c]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a8d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404fb0
ret