joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460b60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x460dbf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x460bc2
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00460628
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e5d8
cmp al, 1
jne 0x460bc2
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00460940
test al, al
je 0x460d4e
cmp dword [ebp - 8], 0
jge 0x460be0
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00460628
mov eax, dword [ebp - 0x210]
call fcn.004042f0
cmp ebx, eax
jge 0x460c2a
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00460628
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5a5628]
and eax, 0xff
bt dword [edx], eax
jae 0x460c2a
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
cmp eax, dword [ebp - 8]
jg 0x460c3e
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00460b3c
cmp ebx, dword [ebp - 8]
je 0x460d40
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x460c6a
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.004034e4
and eax, 0x7f
movzx eax, word [eax*2 + 0x5a1d08]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 1
xor eax, eax
push ebp
push 0x460d2d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.004034e4
and eax, 0x7f
movzx eax, word [eax*2 + 0x5a1d08]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0043d1f8
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.004034e4
and eax, 0x7f
movzx eax, word [eax*2 + 0x5a1d08]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0043d1f8
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460d34
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x218], edx
jmp 0x460da1
cmp dword [ebp - 8], 0
jge 0x460d59
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00460628
mov eax, dword [ebp - 0x218]
call fcn.004042f0
cmp eax, dword [ebp - 8]
jg 0x460d93
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00460628
mov eax, dword [ebp - 0x21c]
call fcn.004042f0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00460b3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460dc6
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404094
ret
Function at 0x47dafb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x5a2b1a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47db53
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x5a2b3b
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47db49
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x47db57
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x494fb8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x495090
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5a68fc], 0
jne 0x495074
lea eax, [ebp - 4]
mov edx, 0x4950a8
call fcn.00404108
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004044b4
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x495074
mov eax, ebx
call fcn.00402844
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x49506d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x495057
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4950b8
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x495057
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x5a68fc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495074
mov eax, dword [ebp - 0xc]
call fcn.0040285c
ret
mov ebx, dword [0x5a68fc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495097
lea eax, [ebp - 4]
call fcn.00404070
ret

Function at 0x4c9388
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.004c8ed0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004044b4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4c93e6
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5a512c]
mov dl, 1
mov eax, dword [0x4c8d5c]
call fcn.0040ddc4
call fcn.00403aa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c93f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004044b4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4c9448
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5a5678]
mov dl, 1
mov eax, dword [0x4c8d5c]
call fcn.0040ddc4
call fcn.00403aa0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004c8f00
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4f8fa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, ecx
mov dword [ebp - 8], eax
dec edx
mov eax, edx
shl eax, 2
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4f900d
xor eax, eax
push ebp
push 0x4f9006
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f900d
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualProtect
ret
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fae8c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4faffd
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fafd8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404218
lea eax, [ebp - 0x118]
mov edx, 0x4fb014
call fcn.004042f8
mov eax, dword [ebp - 0x118]
call fcn.004044b4
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4faf4a
lea eax, [ebp - 0x111]
call fcn.0040adf0
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404158
jmp 0x4faf51
mov eax, esi
call fcn.00404070
cmp bl, 0x61
jae 0x4faf72
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040e9a0
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.004040c4
jmp 0x4faf8c
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040e914
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.004040c4
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4fb020
call fcn.0040b5c8
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.004040c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fafdf
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4fe2ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004044b4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4fe305
test al, 0x10
jne 0x4fe309
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x511170
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
mov eax, dword [edi]
mov al, byte [eax + 0x35a]
mov byte [ebp - 5], al
call sub.kernel32.dll_GetTickCount
mov esi, eax
jmp 0x51119f
mov eax, dword [0x5a5258]
mov eax, dword [eax]
call fcn.00455fac
call sub.kernel32.dll_GetTickCount
cmp esi, eax
jle 0x5111b5
mov eax, dword [edi]
mov al, byte [eax + 0x35a]
cmp al, byte [ebp - 5]
je 0x511193
mov eax, dword [0x5a5258]
mov eax, dword [eax]
call fcn.00455fac
mov eax, dword [edi]
mov al, byte [eax + 0x35a]
cmp al, byte [ebp - 5]
jne 0x51137d
mov eax, dword [edi]
mov eax, dword [eax + 0x35c]
cmp eax, 7
ja case.0x5111df.0
jmp dword [eax*4 + 0x5111e6]
mov ebx, 0x190
jmp 0x511239
mov ebx, 0x12c
jmp 0x511239
mov ebx, 0xc8
jmp 0x511239
mov ebx, 0x82
jmp 0x511239
mov ebx, 0x4e
jmp 0x511239
mov ebx, 0x30
jmp 0x511239
mov ebx, 0x1e
jmp 0x511239
xor ebx, ebx
call sub.kernel32.dll_GetTickCount
mov esi, eax
add esi, ebx
mov ebx, dword [0x5a6d98]
mov eax, dword [0x5a6d9c]
mov dword [ebp - 4], eax
mov eax, dword [edi]
mov al, byte [eax + 0x35a]
dec al
je 0x511275
dec al
je 0x5112ab
dec al
je 0x5112f8
dec al
je 0x511322
jmp 0x511366
mov eax, dword [edi]
mov eax, dword [eax + 0x214]
call fcn.00504914
test eax, eax
jle 0x511296
push 0
mov eax, dword [edi]
xor ecx, ecx
mov edx, 0x115
call fcn.00437f94
mov eax, dword [edi]
mov eax, dword [eax + 0x35c]
neg eax
lea eax, [eax + eax*2]
mov dword [ebp - 4], eax
jmp 0x511366
mov eax, dword [edi]
mov eax, dword [eax + 0x214]
call fcn.00504914
mov edx, dword [edi]
mov edx, dword [edx + 0x1fc]
mov ecx, dword [edi]
sub edx, dword [ecx + 0x300]
cmp eax, edx
jg 0x5112df
push 0
mov eax, dword [edi]
mov ecx, 1
mov edx, 0x115
call fcn.00437f94
mov eax, dword [edi]
call fcn.00436a48
mov edx, dword [edi]
mov edx, dword [edx + 0x35c]
lea edx, [edx + edx*2]
add eax, edx
mov dword [ebp - 4], eax
jmp 0x511366
mov eax, dword [edi]
cmp dword [eax + 0x220], 0
jle 0x511313
push 0
mov eax, dword [edi]
xor ecx, ecx
mov edx, 0x114
call fcn.00437f94
mov eax, dword [edi]
mov eax, dword [eax + 0x35c]
neg eax
lea ebx, [eax + eax*2]
jmp 0x511366
mov eax, dword [edi]
call fcn.00436a04
mov edx, dword [edi]
mov edx, dword [edx + 0x310]
sub edx, eax
mov eax, dword [edi]
cmp edx, dword [eax + 0x220]
jle 0x511350
push 0
mov eax, dword [edi]
mov ecx, 1
mov edx, 0x114
call fcn.00437f94
mov eax, dword [edi]
call fcn.00436a04
mov ebx, eax
mov eax, dword [edi]
mov eax, dword [eax + 0x35c]
lea eax, [eax + eax*2]
add ebx, eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi]
mov ecx, ebx
mov dl, byte [0x511398]
mov bx, 0xffd9
call fcn.004034e4
mov eax, dword [edi]
mov al, byte [eax + 0x35a]
cmp al, byte [ebp - 5]
je 0x51119f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x518e14
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov edi, edx
mov esi, eax
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
push 0x518f70
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
test ebx, ebx
je 0x518ea4
push 0x518f7c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov ebp, eax
test ebp, ebp
je 0x518e9e
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x194]
call fcn.004044b4
push eax
call ebp
test eax, eax
je 0x518e9e
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
push ebx
call sub.kernel32.dll_FreeLibrary_1
cmp dword [esp + 0x14], 0xffffffff
jne 0x518f2f
cmp dword [esp + 0x10], 0xffffffff
jne 0x518f2f
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x194]
call fcn.004044b4
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x518f2f
mov eax, dword [esp + 8]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 8]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x14]
xor edx, edx
call fcn.00407af0
call fcn.00407af0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 8]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x14]
xor edx, edx
call fcn.00407af0
call fcn.00407af0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
test edi, 1
je 0x518f4b
mov eax, dword [esp + 0x10]
mov dword [esi + 0x188], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x18c], eax
test edi, 2
je 0x518f67
mov eax, dword [esp + 0x18]
mov dword [esi + 0x178], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x17c], eax
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x518f90
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x114], edx
mov esi, eax
xor eax, eax
push ebp
push 0x51912c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 0x10], 0xff
mov dword [esi + 0x178], 0
mov dword [esi + 0x17c], 0
mov dword [esi + 0x180], 0
mov dword [esi + 0x184], 0
lea eax, [esi + 0x174]
call fcn.00404070
mov byte [ebp - 1], 0
lea edx, [ebp - 0x114]
mov eax, dword [esi + 0x194]
call fcn.00409f58
mov eax, dword [ebp - 0x114]
mov bl, byte [eax]
cmp bl, 0x5c
je 0x519073
cmp bl, 0x41
jb 0x519021
cmp bl, 0x5a
jbe 0x51903e
mov eax, dword [esi + 0x194]
push eax
mov ecx, 0x2afb
mov dl, 1
mov eax, dword [0x516c40]
call fcn.0051935c
call fcn.00403aa0
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
xor eax, eax
mov al, bl
sub eax, 0x41
cmp eax, 0x1f
ja 0x519054
bt edi, eax
jb 0x519073
mov eax, dword [esi + 0x194]
push eax
mov ecx, 0x2afc
mov dl, 1
mov eax, dword [0x516c40]
call fcn.0051935c
call fcn.00403aa0
push 1
call sub.kernel32.dll_SetErrorMode
mov edi, eax
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x190]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, dword [esi + 0x194]
call fcn.004044b4
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
jne 0x5190cb
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x1f
jne 0x5190c3
test byte [esi + 0x29], 0x80
je 0x5190c3
mov byte [ebp - 1], 1
push edi
call sub.kernel32.dll_SetErrorMode
jmp 0x519113
lea eax, [esi + 0x174]
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.004042a0
mov edx, 3
mov eax, esi
call fcn.00518e14
push edi
call sub.kernel32.dll_SetErrorMode
cmp bl, 0x5c
je 0x51910f
cmp bl, 0x5c
je 0x519113
cmp dword [esi + 0x17c], 0xffffffff
jne 0x51910d
cmp dword [esi + 0x178], 0xffffffff
je 0x519113
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519133
lea eax, [ebp - 0x114]
call fcn.00404070
ret
Function at 0x524278
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x524354
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, ebx
call fcn.004040c4
mov edx, 0x52436c
mov eax, ebx
call fcn.00409ff0
test eax, eax
jne 0x5242d5
mov byte [ebp - 8], 0x7f
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 1
mov eax, edi
mov edx, 0x524380
call fcn.004040c4
mov esi, dword [ebp - 8]
jmp 0x52433e
mov eax, ebx
call fcn.004044b4
push eax
call sub.wsock32.dll_inet_addr
mov esi, eax
cmp esi, 0xffffffff
jne 0x52433e
mov eax, ebx
call fcn.004044b4
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x524307
or edx, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.00524468
jmp 0x52433b
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dl, byte [eax]
mov byte [ebp - 8], dl
mov dl, byte [eax + 1]
mov byte [ebp - 7], dl
mov dl, byte [eax + 2]
mov byte [ebp - 6], dl
mov al, byte [eax + 3]
mov byte [ebp - 5], al
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0052621c
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004040c4
mov esi, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52435b
lea eax, [ebp - 0xc]
call fcn.00404070
ret
Function at 0x525654
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov eax, dword [ebx + 0x98]
call fcn.004042f0
mov esi, dword [ebx + 0x50]
sub eax, esi
sar esi, 1
jns 0x525671
adc esi, 0
cmp eax, esi
jge 0x525692
mov eax, dword [ebx + 0x98]
call fcn.004042f0
mov edx, eax
add edx, dword [ebx + 0x4c]
lea eax, [ebx + 0x98]
call fcn.00404624
jmp 0x5256d8
mov eax, dword [ebx + 0x98]
call fcn.004042f0
sub eax, dword [ebx + 0x50]
mov edx, dword [ebx + 0x4c]
add edx, edx
cmp eax, edx
jle 0x5256d8
mov eax, dword [ebx + 0x98]
call fcn.004042f0
mov esi, dword [ebx + 0x4c]
sub eax, esi
cmp eax, esi
jle 0x5256d8
mov eax, dword [ebx + 0x98]
call fcn.004042f0
mov edx, eax
sub edx, dword [ebx + 0x4c]
lea eax, [ebx + 0x98]
call fcn.00404624
lea eax, [ebx + 0x98]
call fcn.004044c0
push 0
mov eax, dword [ebx + 0x98]
call fcn.004042f0
sub eax, dword [ebx + 0x50]
push eax
lea eax, [ebx + 0x98]
call fcn.004044c0
mov edx, dword [ebx + 0x50]
lea eax, [eax + edx - 1]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.wsock32.dll_recv
mov esi, eax
test esi, esi
sete al
mov byte [ebx + 0x38], al
test al, al
jne 0x52578d
push 0
mov dword [esp + 4], 0x274a
lea ecx, [esp + 4]
mov edx, esi
mov eax, dword [ebx]
call fcn.00524484
test al, al
je 0x52574c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x38]
mov edx, 0x274a
mov eax, dword [ebx]
call fcn.00525a44
mov edx, dword [ebx + 0x54]
add edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
cmp byte [ebx + 0x44], 0
je 0x52578a
mov eax, dword [ebx + 0x50]
mov edi, eax
add edi, esi
dec edi
sub edi, eax
jl 0x52578a
inc edi
lea eax, [ebx + 0x98]
call fcn.004044c0
mov edx, dword [ebx + 0x98]
mov dl, byte [edx + esi - 1]
and dl, 0x7f
mov byte [eax + esi - 1], dl
dec edi
jne 0x52576b
add dword [ebx + 0x50], esi
mov eax, ebx
call fcn.005261d0
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x525b20
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov esi, edx
mov ebx, eax
test ebp, ebp
je 0x525bb7
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x34]
test al, al
jne 0x525b56
mov ecx, 0x525bc8
mov dl, 1
mov eax, dword [0x523cdc]
call fcn.0040dc54
call fcn.00403aa0
mov dword [esp], esi
xor esi, esi
push 0
mov eax, ebp
sub eax, esi
push eax
mov eax, dword [esp + 8]
add eax, esi
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.wsock32.dll_send
mov edi, eax
test edi, edi
sete al
mov byte [ebx + 0x38], al
mov eax, ebx
call fcn.005261d0
push 0
mov dword [esp + 8], 0x274a
lea ecx, [esp + 8]
mov edx, edi
mov eax, dword [ebx]
call fcn.00524484
test al, al
je 0x525bb1
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x38]
mov edx, 0x274a
mov eax, dword [ebx]
call fcn.00525a44
add esi, edi
cmp ebp, esi
jne 0x525b5b
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x526108
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
xor eax, eax
mov dword [ebp - 0x194], eax
xor eax, eax
push ebp
push 0x52619d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
inc eax
jne 0x526151
mov ecx, 0x5261b0
mov dl, 1
mov eax, dword [0x523bbc]
call fcn.0040dc54
call fcn.00403aa0
lea edx, [ebp - 0x194]
lea eax, [ebp - 0x18c]
call fcn.0040b080
mov edx, dword [ebp - 0x194]
mov eax, 0x5a3388
call fcn.004040c4
movzx eax, word [ebp - 8]
mov dword [0x5a3390], eax
movzx eax, word [ebp - 0xa]
mov dword [0x5a338c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5261a4
lea eax, [ebp - 0x194]
call fcn.00404070
ret

Function at 0x550c44
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
lea eax, [esp + 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x550c88
lea eax, [esp + 0x111]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
mov eax, esp
call fcn.0040b080
add esp, 0x20c
pop ebx
ret

Function at 0x56db0c
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x56db36
push 5
push 0
push 0
mov eax, ebx
call fcn.004044b4
push eax
push 0x56db38
mov eax, dword [0x5a5258]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
pop ebx
ret
Function at 0x580238
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044a4
xor eax, eax
push ebp
push 0x580328
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.00581fc0
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ab44
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00580abc
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040aa20
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00580b30
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58032f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404094
ret