joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e35f9
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4e3620
mov word [ebp - 0x14], 2
movzx eax, word [ebx + 4]
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
cmp ebx, 1
push 0
sbb eax, eax
push 0
not eax
and eax, 0x10
push eax
xor eax, eax
test ebx, ebx
je 0x4e3638
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push 0
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.WS2_32.DLL_WSASendTo
inc eax
jne 0x4e3663
call fcn.00524b70
cmp eax, 0x2733
sete al
movzx eax, al
dec eax
jmp 0x4e3666
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4e36f9
Capabilities:
Get socket status

Disassembly:
push ebp
mov edx, 0x3e8
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x228
mov ecx, edx
mov eax, dword [ebp + 0x10]
xor edx, edx
div ecx
imul edx, edx, 0x3e8
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], eax
mov eax, dword [esi]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x230], edx
test al, 1
je 0x4e3755
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], 1
test al, 2
je 0x4e3788
xor eax, eax
mov edx, dword [ebp - 0x11c]
cmp eax, edx
jae 0x4e3771
cmp dword [ebp + eax*4 - 0x118], ebx
je 0x4e3771
inc eax
jmp 0x4e3761
cmp eax, edx
jne 0x4e3788
cmp eax, 0x3f
ja 0x4e3788
mov dword [ebp + eax*4 - 0x118], ebx
inc eax
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x234]
lea edi, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x11c]
push 0
push edi
push eax
lea eax, [ebx + 1]
push eax
call sub.WS2_32.DLL_select
or edx, 0xffffffff
test eax, eax
jl 0x4e37db
mov dword [esi], 0
je 0x4e37d9
push edi
push ebx
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
je 0x4e37c5
or dword [esi], 1
lea ecx, [ebp - 0x11c]
push ecx
push ebx
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
je 0x4e37d9
or dword [esi], 2
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x51574f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
or eax, 0xffffffff
cmp dword [ebx + 0x3c], 0
jne 0x5157b9
cmp dword [ebx + 4], 0
jne 0x5157ac
call sub.msvcrt.dll__errno
mov dword [eax], 0
push dword [ebx + 0x40]
push 0x4000
push 1
push dword [ebx + 0x44]
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
mov dword [ebx + 4], eax
jne 0x5157a7
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x3c], 1
test byte [eax + 0xc], 0x20
je 0x5157a2
mov dword [ebx + 0x38], 0xffffffff
or eax, 0xffffffff
jmp 0x5157b9
mov eax, dword [ebx + 0x44]
mov dword [ebx], eax
dec dword [ebx + 4]
mov eax, dword [ebx]
movzx edx, byte [eax]
inc eax
mov dword [ebx], eax
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x5157be
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, dword [eax + 4]
mov esi, eax
cmp ebx, 1
ja 0x515831
test ebx, ebx
je 0x5157db
mov edx, dword [esi]
mov eax, dword [eax + 0x44]
mov dl, byte [edx]
mov byte [eax], dl
call sub.msvcrt.dll__errno
mov cl, bl
add ebx, dword [esi + 0x44]
mov dword [eax], 0
mov eax, 0x4000
push dword [esi + 0x40]
sar eax, cl
push eax
push 1
push ebx
call sub.msvcrt.dll_fread
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x515817
mov eax, dword [esi + 0x40]
test byte [eax + 0xc], 0x20
je 0x515817
mov dword [esi + 0x38], 0xffffffff
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x44]
add edx, ebx
mov dword [esi], eax
mov dword [esi + 4], edx
cmp edx, 1
ja 0x515831
mov dword [esi + 0x58], edx
jmp 0x515902
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x51583e
cmp byte [eax + 1], 0x8b
je 0x51584a
mov dword [esi + 0x58], 1
jmp 0x515902
sub dword [esi + 4], 2
add eax, 2
mov dword [esi], eax
mov eax, esi
call fcn.0051574f
mov ebx, eax
mov eax, esi
call fcn.0051574f
cmp ebx, 8
mov edi, eax
jne 0x515870
mov bl, 5
test al, 0xe0
je 0x51587c
mov dword [esi + 0x38], 0xfffffffd
jmp 0x515902
mov eax, esi
call fcn.0051574f
dec ebx
jns 0x51587c
test edi, 4
je 0x5158b3
mov eax, esi
call fcn.0051574f
mov ebx, eax
mov eax, esi
call fcn.0051574f
shl eax, 8
add ebx, eax
dec ebx
cmp ebx, 0xffffffff
je 0x5158b3
mov eax, esi
call fcn.0051574f
inc eax
jne 0x5158a3
test edi, 8
je 0x5158c9
mov eax, esi
call fcn.0051574f
test eax, eax
je 0x5158c9
inc eax
jmp 0x5158b9
test edi, 0x10
je 0x5158df
mov eax, esi
call fcn.0051574f
test eax, eax
je 0x5158df
inc eax
jmp 0x5158cf
and edi, 2
je 0x5158f2
mov eax, esi
call fcn.0051574f
mov eax, esi
call fcn.0051574f
mov eax, dword [esi + 0x3c]
cmp eax, 1
sbb eax, eax
not eax
and eax, 0xfffffffd
mov dword [esi + 0x38], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x515fc6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test ebx, ebx
je 0x515fdf
cmp byte [ebx + 0x5c], 0x77
je 0x515ff2
mov eax, 0xfffffffe
jmp 0x51606a
mov dword [ebx + 0x38], 0xffffffff
jmp 0x516058
mov dword [ebx], edi
mov dword [ebx + 4], esi
test esi, esi
je 0x516058
cmp dword [ebx + 0x10], 0
jne 0x516028
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0xc], eax
push dword [ebx + 0x40]
push 0x4000
push 1
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp eax, 0x4000
jne 0x515fe9
mov dword [ebx + 0x10], 0x4000
mov eax, dword [ebx + 4]
add dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x10]
add dword [ebx + 0x68], eax
push 0
push ebx
call fcn.00516920
mov edx, dword [ebx + 0x68]
mov ecx, dword [ebx + 4]
sub dword [ebx + 0x64], ecx
mov dword [ebx + 0x38], eax
sub edx, dword [ebx + 0x10]
test eax, eax
mov dword [ebx + 0x68], edx
pop edx
pop edx
jne 0x516058
test ecx, ecx
jmp 0x515ff9
push esi
push edi
push dword [ebx + 0x4c]
call fcn.0051831a
mov dword [ebx + 0x4c], eax
mov eax, esi
sub eax, dword [ebx + 4]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x516110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
test eax, eax
push ebx
push ebx
mov ebx, eax
mov dword [ebp - 0x10], edx
je 0x516128
cmp byte [eax + 0x5c], 0x77
je 0x516132
mov eax, 0xfffffffe
jmp 0x5161c4
mov dword [eax + 4], 0
mov eax, 0x4000
mov esi, eax
sub esi, dword [ebx + 0x10]
je 0x516167
push dword [ebx + 0x40]
push esi
push 1
push dword [ebx + 0x48]
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp eax, esi
jne 0x5161b6
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0x10], 0x4000
mov dword [ebx + 0xc], eax
test edi, edi
jne 0x5161ac
mov eax, dword [ebx + 0x10]
push dword [ebp - 0x10]
add dword [ebx + 0x68], eax
push ebx
call fcn.00516920
mov edx, dword [ebx + 0x10]
sub dword [ebx + 0x68], edx
pop edi
mov dword [ebx + 0x38], eax
pop ecx
test esi, esi
jne 0x516195
cmp eax, 0xfffffffb
jne 0x516195
mov dword [ebx + 0x38], 0
xor edi, edi
test edx, edx
jne 0x5161a1
cmp dword [ebx + 0x38], 1
jne 0x5161a6
mov edi, 1
cmp dword [ebx + 0x38], 1
jbe 0x516139
mov eax, dword [ebx + 0x38]
cmp eax, 1
jne 0x5161c4
jmp 0x5161c2
or eax, 0xffffffff
mov dword [ebx + 0x38], 0xffffffff
jmp 0x5161c4
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x51722b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov edi, dword [ebp + 8]
test edi, edi
je 0x51724a
mov ebx, dword [edi + 0x1c]
test ebx, ebx
je 0x51724a
cmp dword [edi + 0x20], 0
je 0x51724a
cmp dword [edi + 0x24], 0
jne 0x517254
mov eax, 0xfffffffe
jmp 0x517354
mov dword [edi + 0x2c], 2
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [ebx + 0x14], 0
test eax, eax
jns 0x517289
neg eax
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x18]
cmp edx, 1
sbb eax, eax
and eax, 0x47
add eax, 0x2a
cmp edx, 2
mov dword [ebx + 4], eax
jne 0x5172ac
push 0
push 0
push 0
call fcn.0051831a
jmp 0x5172b7
push 0
push 0
push 0
call fcn.0051bac0
add esp, 0xc
mov dword [edi + 0x30], eax
mov dword [ebx + 0x28], 0
push ebx
call fcn.0051a03f
pop edi
mov ecx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x44]
add eax, eax
cld
mov dword [ebx + 0x3c], eax
mov word [edi + ecx*2 - 2], 0
xor eax, eax
lea ecx, [ecx + ecx - 2]
rep stosb byte es:[edi], al
imul edx, dword [ebx + 0x84], 0xc
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
movzx eax, word [edx + 0x61abd2]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0
movzx eax, word [edx + 0x61abd0]
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x78], 2
movzx eax, word [edx + 0x61abd4]
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x60], 2
movzx eax, word [edx + 0x61abd6]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x48], 0
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x517958
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, eax
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x74]
mov edx, dword [esi + 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x14]
add eax, dword [esi + 0x2c]
mov dword [ebp - 0x10], edx
sub eax, 0x106
mov edx, dword [esi + 0x6c]
sub dword [ebp - 0x10], edx
cmp edx, eax
jb 0x5179f4
push dword [ebp - 0x14]
mov edx, dword [esi + 0x38]
mov eax, dword [ebp - 0x14]
add eax, edx
push eax
push edx
call fcn.0052ef10
mov edx, dword [ebp - 0x14]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edx
add esp, 0xc
sub dword [esi + 0x6c], edx
lea eax, [eax + ecx*2]
sub dword [esi + 0x5c], edx
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x5179c6
mov ebx, edx
sub bx, word [ebp - 0x14]
dec ecx
mov word [eax], bx
jne 0x5179b3
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi + 0x40]
lea eax, [eax + ecx*2]
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x5179e8
mov ebx, edx
sub bx, word [ebp - 0x14]
dec ecx
mov word [eax], bx
jne 0x5179d5
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov ebx, dword [esi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x517aac
mov edx, dword [esi + 0x6c]
mov edi, eax
mov dword [ebp - 0x18], edx
mov edx, dword [esi + 0x38]
add dword [ebp - 0x18], edx
mov edx, dword [esi + 0x74]
add dword [ebp - 0x18], edx
cmp eax, dword [ebp - 0x10]
jbe 0x517a1d
mov edi, dword [ebp - 0x10]
xor edx, edx
test edi, edi
je 0x517a6b
sub eax, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x517a40
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0051bac0
jmp 0x517a50
cmp eax, 2
jne 0x517a56
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0051831a
add esp, 0xc
mov dword [ebx + 0x30], eax
push edi
push dword [ebx]
push dword [ebp - 0x18]
call fcn.0052ef10
add dword [ebx], edi
add dword [ebx + 8], edi
add esp, 0xc
mov edx, edi
mov eax, dword [esi + 0x74]
add eax, edx
mov dword [esi + 0x74], eax
cmp eax, 2
jbe 0x517a97
mov ebx, dword [esi + 0x6c]
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [ebx + edx]
mov dword [esi + 0x48], eax
movzx edx, byte [edx + ebx + 1]
shl eax, cl
xor eax, edx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp dword [esi + 0x74], 0x105
ja 0x517aac
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x517969
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x51831a
Capabilities:
Hash data with crc32

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x518564
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, eax
test esi, esi
not ecx
jmp 0x518352
test dl, 3
je 0x518354
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x61ac50]
dec esi
jne 0x51833a
mov ebx, edx
cmp esi, 0x1f
jbe 0x518507
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x61b450]
xor eax, dword [edx*4 + 0x61b850]
movzx edx, cl
xor eax, dword [edx*4 + 0x61b050]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x61ac50]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x61b450]
xor eax, dword [edx*4 + 0x61b850]
movzx edx, cl
xor eax, dword [edx*4 + 0x61b050]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x61ac50]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x61b450]
xor eax, dword [edx*4 + 0x61b850]
movzx edx, cl
xor eax, dword [edx*4 + 0x61b050]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x61ac50]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x61b450]
xor eax, dword [edx*4 + 0x61b850]
movzx edx, cl
xor eax, dword [edx*4 + 0x61b050]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x61ac50]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x61b450]
xor eax, dword [edx*4 + 0x61b850]
movzx edx, cl
xor eax, dword [edx*4 + 0x61b050]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x61ac50]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x61b450]
xor eax, dword [edx*4 + 0x61b850]
movzx edx, cl
xor eax, dword [edx*4 + 0x61b050]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x61ac50]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x61b450]
xor eax, dword [edx*4 + 0x61b850]
movzx edx, cl
xor eax, dword [edx*4 + 0x61b050]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x61ac50]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x61b450]
xor eax, dword [edx*4 + 0x61b850]
sub esi, 0x20
shr ecx, 0x10
movzx edx, cl
xor eax, dword [edx*4 + 0x61b050]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x61ac50]
jmp 0x518356
cmp esi, 3
jbe 0x518545
xor ecx, dword [ebx]
sub esi, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x61b450]
add ebx, 4
shr ecx, 0x10
xor eax, dword [edx*4 + 0x61b850]
movzx edx, cl
xor eax, dword [edx*4 + 0x61b050]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x61ac50]
jmp 0x518507
mov edx, ebx
test esi, esi
je 0x518560
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x61ac50]
dec esi
jmp 0x518549
mov eax, ecx
not eax
pop ebx
pop esi
pop ebp
ret
Function at 0x51f3cd
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa0
lea ebx, [ebp - 0xa4]
push 0x94
push 0x59ac40
push ebx
call fcn.0052ef10
add esp, 0xc
cmp dword [0x622650], 0
jne 0x51f459
push ebx
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x51f416
cmp dword [ebp - 0x94], 2
jne 0x51f416
mov dword [0x622610], 1
mov dword [0x622680], 1
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x622630], eax
push eax
push 0
push 0x51f08a
push 3
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x622620], eax
push 1
call sub.WINMM.DLL_timeBeginPeriod
push 0x51ef0b
call fcn.004012d0
mov dword [0x622650], 1
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x51f45e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
jmp 0x51f541
mov ecx, dword [ebp - 0x20]
sub ecx, 0x100
cmp ecx, 5
ja 0x51f4fe
mov eax, 1
shl eax, cl
test al, 0x33
je 0x51f4fe
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x51f4fe
cmp eax, 0x12
jbe 0x51f49c
sub eax, 0x5b
cmp eax, 1
ja 0x51f4fe
mov dword [0x622640], 0
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x51f4b9
or dword [0x622640], 1
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x51f4cc
or dword [0x622640], 2
push 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x51f4df
or dword [0x622640], 4
push 0x5b
call sub.USER32.dll_GetKeyState
test ax, ax
js 0x51f4f7
push 0x5c
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x51f4fe
or dword [0x622640], 8
mov eax, dword [ebp - 0x24]
call fcn.0051ef2a
test eax, eax
je 0x51f532
push dword [ebp - 0x24]
jmp 0x51f510
push ebx
call sub.USER32.dll_GetParent
mov ebx, eax
test eax, eax
je 0x51f532
call fcn.0051ef2a
test eax, eax
jne 0x51f50f
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.USER32.dll_IsDialogMessageA
test eax, eax
jne 0x51f541
lea ebx, [ebp - 0x24]
push ebx
call sub.USER32.dll_TranslateMessage
push ebx
call sub.USER32.dll_DispatchMessageA
lea eax, [ebp - 0x24]
push 1
push 0
push 0
push 0
push eax
call sub.USER32.dll_PeekMessageA
test eax, eax
jne 0x51f46a
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x51f55f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xff
push 0xffffffffffffffff
push 0
push 0
push 0
call sub.USER32.dll_MsgWaitForMultipleObjects
leave
jmp fcn.0051f45e

Function at 0x51fa77
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x622610], 0
mov eax, dword [ebp + 8]
je 0x51faa0
push 0xa
push 0
push 0
push eax
call fcn.005231bc
mov dword [esp], eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteW
jmp 0x51fab8
push 0xa
push 0
push 0
push eax
call fcn.005231a2
mov dword [esp], eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x20
leave
setg al
movzx eax, al
ret
Function at 0x51fd86
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x631c10], 0
mov eax, dword [ebp + 8]
je 0x51fdad
push eax
call fcn.005231bc
mov dword [esp], eax
call sub.msvcrt.dll__wgetenv
pop edx
mov dword [ebp + 8], eax
leave
jmp fcn.0052239f
push eax
call fcn.005231a2
mov dword [esp], eax
call sub.msvcrt.dll_getenv
pop ecx
mov dword [ebp + 8], eax
leave
jmp fcn.0052232a
Function at 0x520324
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.005231a2
mov dword [esp], eax
call sub.WS2_32.DLL_gethostbyname
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x520354
movsx edx, word [ecx + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
movsx edx, word [ecx + 0xa]
mov dword [eax], edx
mov eax, dword [ecx + 0xc]
leave
ret

Function at 0x520356
Capabilities:
Connect socket

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
push edi
sub esp, 0x10
cmp dword [ebp + 0x10], 2
jne 0x5203a4
cld
xor eax, eax
lea edi, [ebp - 0x14]
mov ecx, 4
rep stosd dword es:[edi], eax
movzx eax, word [ebp + 0x18]
mov word [ebp - 0x14], 2
push eax
call sub.WS2_32.DLL_htons
push dword [ebp + 0x14]
push dword [ebp + 0xc]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
call fcn.0052ef10
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [ebp + 8]
call sub.WS2_32.DLL_connect
mov edi, dword [ebp - 4]
leave
ret

Function at 0x5205d6
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 4
cld
push edi
lea edi, [ebp - 0x14]
sub esp, 0x10
rep stosd dword es:[edi], eax
push dword [ebp + 0x18]
mov word [ebp - 0x14], 2
call sub.WS2_32.DLL_htonl
mov dword [ebp - 0x10], eax
movzx eax, word [ebp + 0x1c]
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.WS2_32.DLL_sendto
mov edi, dword [ebp - 4]
leave
ret

Function at 0x520742
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WS2_32.DLL_WSAStartup
push 0x520739
call fcn.004012d0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x631be0], eax
lea edx, [eax + 0x20]
add eax, 0x40
mov dword [0x631c00], edx
mov dword [0x631bf0], eax
leave
ret
Function at 0x5255f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 0x78
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
cmp eax, dword [ebp - 4]
jbe 0x5256aa
sub esp, 8
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
lea ecx, [eax*4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [ecx + edx]
push eax
call sub.KERNEL32.DLL_lstrcmpA
add esp, 8
test eax, eax
jne 0x5256a3
mov eax, dword [ebp - 4]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x18]
mov ax, word [edx + eax]
and eax, 0xffff
lea ecx, [eax*4]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, dword [ecx + edx]
mov dword [ebp - 0x24], eax
jmp 0x5256b1
lea eax, [ebp - 4]
inc dword [eax]
jmp 0x52564b
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
leave
ret

Function at 0x528070
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x5280a6
mov dword [0x630b20], eax
mov edx, 0x528050
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0052d910
test eax, eax
sete al
movzx eax, al
mov dword [0x59da90], eax
leave
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x59da90], eax
leave
ret
Function at 0x528190
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0x527360
mov dword [ebp - 0x24], 0x530c58
mov dword [ebp - 0x1c], 0x528250
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.0052e0c0
cmp dword [0x59da90], 0
mov dword [ebp - 0x44], 0x630b30
je 0x528230
jl 0x528270
mov dword [ebp - 0x3c], 1
mov eax, dword [0x630b20]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x528313
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0052e1a0
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x631500]
mov eax, 0xffffffff
test edx, edx
je 0x52828a
mov eax, dword [0x59da94]
test eax, eax
je 0x5282ca
xor eax, eax
test eax, eax
jne 0x5282c0
mov edi, dword [0x59da90]
test edi, edi
js 0x5282c0
mov dword [ebp - 0x44], 0x630b30
mov ebx, dword [0x59da90]
test ebx, ebx
je 0x528230
jmp 0x5281de
xor esi, esi
mov dword [0x59da90], esi
jmp 0x528298
mov dword [esp], 0x59da98
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.DLL_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x528351
mov eax, dword [0x59da94]
test eax, eax
jne 0x528288
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x59da94]
test eax, eax
je 0x5282ed
jmp 0x528288
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x528345
mov dword [esp + 4], eax
mov eax, dword [0x630b20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x52837a
test edx, edx
je 0x528365
mov dword [ebp - 0x3c], 1
call fcn.00526ea0
call fcn.00528070
mov eax, 1
mov dword [0x59da94], eax
jmp 0x528288
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x528226
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x528341