joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407de0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [ebx + 0x18], 0
jne 0x407e47
mov byte [ebp - 0x800], 0
mov eax, dword [ebx + 0x19]
call fcn.004036cc
push eax
push 0x800
lea eax, [ebp - 0x800]
push eax
mov eax, esi
call fcn.004036cc
push eax
mov eax, edi
call fcn.004036cc
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004036cc
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x800]
mov ecx, 0x800
call fcn.004034f0
jmp 0x407e78
mov eax, dword [ebp + 8]
mov edx, esi
call fcn.00403434
mov eax, dword [ebx + 0x19]
call fcn.004036cc
push eax
mov eax, esi
call fcn.004036cc
push eax
mov eax, edi
call fcn.004036cc
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004036cc
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a190
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
call fcn.0040be2c
test eax, eax
je 0x40a1ac
cmp dword [eax + 0x155], ebx
jne 0x40a1ac
xor edx, edx
mov dword [eax + 0x155], edx
mov ecx, dword [ebx + 0x18]
jecxz 0x40a1b9
push 0
push ecx
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.00405ed4
mov eax, ebx
call fcn.0040b9d4
xor ecx, ecx
cmp byte [ebx + 0x8a], cl
jne 0x40a327
xchg byte [ebx + 0xfb], cl
jecxz 0x40a1e8
mov eax, dword [ebx + 0xf6]
call fcn.00402620
inc byte [ebx + 0x8a]
mov eax, dword [ebx + 0x10a]
call fcn.00405eb8
mov eax, dword [ebx + 0x112]
call fcn.00405eb8
mov eax, dword [ebx + 0x40]
call fcn.00405eb8
xor ecx, ecx
mov dword [ebx + 0x10a], ecx
mov dword [ebx + 0x112], ecx
mov dword [ebx + 0x40], ecx
xchg dword [ebx + 0x52b], ecx
jecxz 0x40a22b
xchg ecx, eax
call fcn.00402620
mov eax, dword [ebx + 0x52f]
call fcn.00405eb8
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x40a2a8
xor ecx, ecx
xchg dword [ebx + 0x93], ecx
jecxz 0x40a24d
push ecx
call sub.user32.dll_DestroyAcceleratorTable
mov eax, dword [ebx + 0x8f]
call fcn.00405eb8
mov eax, dword [ebx + 0x97]
test eax, eax
je 0x40a269
call fcn.00405eb8
jmp 0x40a258
push dword [ebx + 0x18]
call sub.user32.dll_IsWindow
test eax, eax
je 0x40a2a3
push eax
push 1
push 0x80
push dword [ebx + 0x18]
call sub.user32.dll_SendMessageA
test eax, eax
je 0x40a295
cmp byte [ebx + 0x35], 0
jne 0x40a295
push eax
call sub.user32.dll_DestroyIcon
cmp byte [ebx + 0x48], 0
jne 0x40a2a3
push dword [ebx + 0x18]
call sub.user32.dll_DestroyWindow
xor eax, eax
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x36]
test eax, eax
je 0x40a2b4
call fcn.00402620
mov eax, dword [ebx + 0x26d]
test eax, eax
je 0x40a2c3
call fcn.00402620
mov ecx, dword [ebx + 0x49]
jecxz 0x40a2e2
cmp dword [ecx + 0x155], ebx
jne 0x40a2d8
xor eax, eax
mov dword [ecx + 0x155], eax
mov eax, dword [ecx + 0x60]
mov edx, ebx
call fcn.00406050
mov ecx, dword [ebx + 0x79]
jecxz 0x40a2ed
push ecx
call sub.gdi32.dll_DeleteObject
push ebx
push dword [ebx + 0x60]
push dword [ebx + 0x568]
push dword [ebx + 0x56c]
push dword [ebx + 0x2f5]
push dword [ebx + 0xcb]
mov bl, 5
pop eax
call fcn.00405eb8
dec bl
jne 0x40a30b
pop ebx
lea eax, [ebx + 0x4fb]
call fcn.0040339c
xchg ebx, eax
call fcn.00405ec4
pop ebx
ret
Function at 0x40b378
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x40b387
mov edx, dword [edx + 0x36]
jmp fcn.004034c0
mov ecx, dword [edx + 0x18]
jecxz 0x40b37f
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.00403838
pop edx
mov ecx, dword [ebx]
jecxz 0x40b3af
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x40e2f0
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040e07c
je 0x40e335
mov eax, ebx
push edx
call fcn.0040e6ac
pop edx
cmp eax, edx
je 0x40e335
test edx, edx
mov eax, ebx
jne 0x40e314
pop ebx
inc edx
jmp fcn.0040e69c
mov byte [ebx + 0x49], dl
cmp dl, 5
jne 0x40e31d
dec edx
push edx
xor edx, edx
call fcn.0040e69c
mov eax, dword [ebx + 0x3d]
movzx eax, word [eax + 0xe]
call fcn.0040db50
pop edx
cmp al, dl
xchg ebx, eax
pop ebx
jne fcn.0040e354
ret
Function at 0x410764
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
cmp byte [0x43d64c], 0xff
je 0x41077a
mov al, byte [0x43d64c]
jmp 0x4107da
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x4107b3
mov al, 3
mov edx, dword [esp + 4]
cmp edx, 6
jb 0x41079f
mov al, 6
jmp 0x4107d5
cmp edx, 5
jb 0x4107d5
cmp dword [esp + 8], 1
jb 0x4107af
mov al, 5
jmp 0x4107d5
mov al, 4
jmp 0x4107d5
cmp eax, 1
jne 0x4107d3
mov al, 1
cmp dword [esp + 4], 4
ja 0x4107cf
cmp dword [esp + 4], 4
jne 0x4107d5
cmp dword [esp + 8], 0xa
jb 0x4107d5
mov al, 2
jmp 0x4107d5
xor eax, eax
mov byte [0x43d64c], al
add esp, 0x94
ret

Function at 0x411cb4
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
cmp dword [0x43d688], 0
jne 0x411cd5
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
sete al
jmp 0x411cd7
mov al, 1
inc dword [0x43d688]
add esp, 0x190
ret

Function at 0x411ce4
Capabilities:
Resolve dns

Disassembly:
push ebx
push ecx
mov ebx, edx
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x411cfc
mov eax, ebx
call fcn.0040339c
pop edx
pop ebx
ret
movsx ecx, word [eax + 0xa]
mov edx, esp
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
call fcn.004026dc
push dword [esp]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.004034c0
pop edx
pop ebx
ret
Function at 0x41b330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4405f4
cmp dword [edi], 0
jne 0x41b3ac
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4405f0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x43d8a0
mov ecx, 2
call fcn.004026dc
mov edx, 0x41b308
lea eax, [esi + 5]
call fcn.0041b328
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b328
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0x52b
jl 0x41b381
mov dword [0x4405f0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x421b44
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
mov eax, dword [ebx + 0x6c]
sub edi, eax
mov edx, dword [ebx + 0x64]
sub edi, edx
test edi, edi
jne 0x421b74
mov ecx, dword [ebx + 0x64]
test ecx, ecx
jne 0x421b74
mov eax, dword [ebx + 0x6c]
test eax, eax
jne 0x421b74
mov edi, esi
jmp 0x421c08
cmp edi, 0xffffffff
jne 0x421b7f
dec edi
jmp 0x421c08
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
mov edx, dword [ebx + 0x64]
cmp eax, edx
ja 0x421c08
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0042099c
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
mov ecx, dword [ebx + 0x3c]
add edx, ecx
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
mov ecx, dword [esp]
cmp esi, ecx
ja 0x421bd2
mov cx, word [esp]
sub cx, si
jmp 0x421bd4
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x421bb9
mov eax, esi
mov edx, eax
add edx, edx
mov ecx, dword [ebx + 0x38]
add edx, ecx
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
mov ecx, dword [esp]
cmp esi, ecx
ja 0x421bfe
mov cx, word [esp]
sub cx, si
jmp 0x421c00
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x421be5
add edi, esi
mov ebp, dword [ebx]
mov eax, dword [ebp + 4]
test eax, eax
je 0x421c70
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
add edx, ecx
mov eax, dword [ebx + 0x6c]
add edx, eax
mov ecx, edi
mov eax, ebp
call fcn.004218d4
add dword [ebx + 0x6c], eax
mov edx, dword [ebx + 0x6c]
cmp edx, 3
jb 0x421c59
mov ecx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x64]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
mov edx, dword [ebx + 0x4c]
and eax, edx
mov dword [ebx + 0x40], eax
mov eax, dword [ebx + 0x6c]
cmp eax, 0x106
jae 0x421c70
mov ecx, dword [ebx]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x421b4e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4314a4
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x248], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x431655
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x144]
mov ecx, 0x43166c
mov edx, edi
call fcn.00403554
mov eax, dword [ebp - 0x144]
call fcn.004036cc
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x431631
lea eax, [ebp - 0x140]
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x114]
call fcn.00402828
lea eax, [ebp - 0x244]
mov edx, 0x431670
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402780
je 0x431610
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x114]
call fcn.004034c0
mov eax, dword [ebp - 0x144]
mov edx, 0x43167c
call fcn.00403618
je 0x431610
test byte [ebp - 0x140], 0x10
je 0x4315e5
cmp byte [ebx + 0x1f], 0
jbe 0x431595
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004034f0
mov ecx, dword [ebp - 0x144]
mov edx, edi
mov eax, ebx
call fcn.0043139c
cmp byte [ebx + 0x1c], 0
jne 0x431610
push edi
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004034f0
push dword [ebp - 0x248]
push 0x431688
lea eax, [ebp - 0x144]
mov edx, 3
call fcn.004035c8
mov edx, dword [ebp - 0x144]
mov eax, ebx
call fcn.004314a4
lea eax, [ebp - 0x140]
mov dword [ebx + 0x10], eax
jmp 0x431610
cmp byte [ebx + 0x1f], 1
je 0x431610
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004034f0
mov ecx, dword [ebp - 0x144]
mov edx, edi
mov eax, ebx
call fcn.0043139c
cmp byte [ebx + 8], 0
jne 0x43162b
lea eax, [ebp - 0x140]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x43150e
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43165c
lea eax, [ebp - 0x248]
call fcn.0040339c
lea eax, [ebp - 0x144]
call fcn.0040339c
ret
Function at 0x431ffc
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
xor ecx, ecx
mov eax, dword [esp]
mov ebp, 3
cdq
idiv ebp
lea eax, [eax + eax*2]
mov dword [esp + 4], eax
cmp ecx, dword [esp + 4]
jge 0x43208f
xor eax, eax
mov al, byte [edi]
shl eax, 0x10
xor edx, edx
mov dl, byte [edi + 1]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [edi + 2]
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x43fa98]
mov byte [esi + ebx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x43fa98]
mov byte [esi + ebx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
mov dl, byte [edx + 0x43fa98]
mov byte [esi + ebx + 2], dl
and eax, 0x3f
mov al, byte [eax + 0x43fa98]
mov byte [esi + ebx + 3], al
add ebx, 4
add edi, 3
add ecx, 3
cmp ecx, dword [esp + 4]
jl 0x432026
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
mov ecx, edx
test ecx, ecx
je 0x4320fd
xor eax, eax
mov al, byte [edi]
shl eax, 0x10
cmp ecx, 2
jne 0x4320b6
xor edx, edx
mov dl, byte [edi + 1]
shl edx, 8
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x43fa98]
mov byte [esi + ebx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x43fa98]
mov byte [esi + ebx + 1], dl
cmp ecx, 2
jne 0x4320f0
shr eax, 6
and eax, 0x3f
mov al, byte [eax + 0x43fa98]
mov byte [esi + ebx + 2], al
jmp 0x4320f5
mov byte [esi + ebx + 2], 0x3d
mov byte [esi + ebx + 3], 0x3d
add ebx, 4
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43295c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x432ae5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, edi
call fcn.00432b30
mov eax, esi
call fcn.004036cc
lea edx, [ebp - 4]
call fcn.00411ce4
mov eax, dword [ebp - 4]
call fcn.00403508
test eax, eax
jne 0x4329ba
mov edx, 1
mov eax, edi
call fcn.00432e30
jmp 0x432abd
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
test esi, esi
jne 0x4329dc
mov edx, 1
mov eax, edi
call fcn.00432e30
jmp 0x432abd
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0x10
call fcn.004027f0
mov word [ebp - 0x18], 2
mov ax, word [edi + 0x24]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x16], ax
mov eax, dword [ebp - 4]
call fcn.004036cc
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
call sub.wsock32.dll_connect
test eax, eax
je 0x432a37
push esi
call sub.wsock32.dll_closesocket
mov edx, 2
mov eax, edi
call fcn.00432e30
jmp 0x432abd
mov dword [edi + 4], esi
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.00432c7c
mov eax, dword [ebp - 0x1c]
mov edx, 0x432b00
call fcn.00403618
jne 0x432ab6
cmp dword [edi + 0x34], 0
jne 0x432a68
lea eax, [ebp - 8]
mov edx, 0x432b0c
call fcn.00403434
jmp 0x432a75
lea eax, [ebp - 8]
mov edx, 0x432b1c
call fcn.00403434
push dword [ebp - 8]
push 0x432b2c
push dword [edi + 0x30]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004035c8
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
mov eax, edi
call fcn.00432e3c
mov eax, dword [ebp - 0x1c]
mov edx, 0x432b00
call fcn.00403618
jne 0x432aad
mov bl, 1
jmp 0x432abd
mov eax, edi
call fcn.00432b30
jmp 0x432abd
mov eax, edi
call fcn.00432b30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432aec
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004033c0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004033c0
ret

Function at 0x432b54
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004036bc
xor eax, eax
push ebp
push 0x432bf1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x432bdb
mov eax, dword [ebp - 8]
call fcn.00403508
mov edi, eax
xor ebx, ebx
mov esi, edi
sub esi, ebx
cmp esi, 0x1000
jle 0x432ba3
mov esi, 0x1000
push 0
push esi
lea eax, [ebp - 8]
call fcn.004036d8
lea edx, [ebx + 1]
lea eax, [eax + edx - 1]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x432bd1
mov eax, dword [ebp - 4]
call fcn.00432b30
jmp 0x432bdb
add ebx, eax
cmp edi, ebx
jg 0x432b92
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432bf8
lea eax, [ebp - 8]
call fcn.0040339c
ret
Function at 0x432c7c
Capabilities:
Get socket status
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x432e08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x432e20
call fcn.00403434
cmp dword [ebx + 4], 0
je 0x432dea
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebx + 8]
call fcn.0040339c
jmp 0x432dd7
mov dword [ebp - 0x14], 1
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 4
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
call sub.wsock32.dll_select
sub eax, 0xffffffff
je 0x432d0e
dec eax
je 0x432dea
jmp 0x432d1a
mov eax, ebx
call fcn.00432b30
jmp 0x432dea
cmp dword [ebp - 0x1c], 0
jle 0x432d2c
mov eax, ebx
call fcn.00432b30
jmp 0x432dea
lea eax, [ebp - 0xc]
push eax
push 0x4004667f
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_ioctlsocket
cmp dword [ebp - 0xc], 1
jge 0x432d50
mov eax, ebx
call fcn.00432b30
jmp 0x432dea
mov eax, dword [ebp - 8]
call fcn.00403508
cmp eax, dword [ebp - 0xc]
jge 0x432d68
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00403838
push 0
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 8]
call fcn.004036d8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_recv
mov esi, eax
cmp esi, 1
jge 0x432d90
mov eax, ebx
call fcn.00432b30
jmp 0x432dea
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040370c
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 8]
call fcn.00403510
mov edx, dword [ebx + 8]
mov eax, 0x432e2c
call fcn.004037f0
test eax, eax
jle 0x432dd7
mov eax, dword [ebp - 4]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebx + 8]
call fcn.0040370c
jmp 0x432dea
mov eax, dword [ebx + 8]
call fcn.00403508
cmp eax, 0x2800
jl 0x432cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432e0f
lea eax, [ebp - 0x28]
call fcn.0040339c
lea eax, [ebp - 8]
call fcn.0040339c
ret
Function at 0x434748
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [0x43fb54]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x4347e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x434789
call fcn.00402f54
jmp 0x4347e8
mov dword [ebx + 0x1c8], esi
mov ax, word [0x440918]
mov word [ebp - 0x18], ax
mov dword [ebp - 0x10], 1
mov dword [ebp - 8], 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
call fcn.00434560
test eax, eax
jne 0x4347ca
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [0x440918]
push eax
call sub.user32.dll_SetClipboardData
jmp 0x4347ce
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4347e8
call sub.user32.dll_CloseClipboard
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102eaf5f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
call fcn.10001066
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
jne 0x102eb0ba
lea eax, [esp + 0x30]
lea ecx, [esp + 0x40]
mov dword [0x1030d024], 0x1f19
mov dword [esp], eax
mov dword [esp + 0x28], ecx
call fcn.102ea31c
lea ecx, [0x102ea8d8]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x7c], edx
mov dword [esp + 0x64], 0x140e00
mov edx, dword [0x1030d010]
mov dword [esp + 0x88], edx
mov edx, dword [0x1030d014]
mov dword [esp + 0x44], edx
mov edx, dword [0x1030d018]
mov dword [esp + 0x58], edx
mov edx, dword [0x1030d01c]
mov dword [esp + 0x60], edx
mov edx, dword [0x1030d020]
mov dword [esp + 0x40], edx
mov dword [0x1030d028], 0x4bf
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
cmp word [eax], 0x5a4d
mov dword [esp + 0x1c], eax
jne 0x102eb01f
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x18], ecx
je 0x102eb03b
mov eax, dword [esp + 0x1c]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x102eaffc
mov eax, dword [esp + 0x18]
add eax, 0x50
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x70], ecx
mov dword [0x1030d028], 0xe73
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx]
mov dword [esp + 0x80], edx
call fcn.102ea925
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x102eb0b2
lea eax, [esp + 0x40]
mov dword [0x1030d028], 0x341
mov ecx, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.102eaa5b
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x1001e1e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001e20e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001e20c
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1001e259
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001e23c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001e259
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.1002403a
mov dword [eax], 0x2a276893
jmp 0x1001e231
mov esp, ebp
pop ebp
ret
Function at 0x1002aef8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002af28
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002af26
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1002af73
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002af56
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1002af73
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.1002403a
mov dword [eax], 0xfffffffa
jmp 0x1002af4b
mov esp, ebp
pop ebp
ret