joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e9d4
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd80
mov eax, 0x590908
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0056134c
mov esi, str.GET__ChuLkRul3z.html_HTTP_1.0_n
lea edi, [ebp - 0x21c]
mov eax, edi
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x58fc63
lea edx, [ebp - 0x21c]
push edx
call fcn.00560f50
add esp, 8
push 0x58fc7b
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00560f50
add esp, 8
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.00560fe0
pop ecx
push eax
lea edx, [ebp - 0x21c]
push edx
push ebx
call sub.WS2_32.DLL_send
push 0
lea ecx, [ebp - 0x21c]
push 0x1f3
push ecx
push ebx
call sub.WS2_32.DLL_recv
mov esi, eax
push ebx
call sub.WS2_32.DLL_closesocket
cmp esi, 0xffffffff
je 0x41eb5e
mov byte [ebp + esi - 0x21c], 0
push 0x58fcbd
lea eax, [ebp - 0x21c]
push eax
call fcn.005610d9
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x41eb5e
push str._n___
push ebx
call fcn.005610d9
add esp, 8
mov byte [eax], 0
push ebx
call fcn.0056114c
pop ecx
mov esi, eax
push 0x58fcc7
push ebx
call fcn.005610d9
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x41eb50
inc ebx
push 0x58fcc9
push ebx
call fcn.005610d9
add esp, 8
test eax, eax
je 0x41eadc
lea ebx, [eax + 1]
push 0x58fccb
push ebx
call fcn.005610d9
add esp, 8
test eax, eax
je 0x41eaf1
mov byte [eax], 0
mov word [ebp - 0x18], 8
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00583900
inc dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [sym.LookAtLan.exe__PCDetails]
mov eax, dword [eax + 0x300]
call fcn.0051bd28
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00583ae8
mov ecx, dword [sym.LookAtLan.exe__PCDetails]
mov edx, 0x12
mov eax, dword [ecx + 0x300]
mov eax, dword [eax + 0x58]
call fcn.004fbfb4
mov ecx, dword [sym.LookAtLan.exe__PCDetails]
mov eax, dword [ecx + 0x300]
mov edx, dword [eax]
call dword [edx + 0x78]
mov eax, esi
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x41eb6a
xor eax, eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41eb74
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda8
mov ecx, 7
lea edx, [ebp - 0x1f4]
push ebx
push esi
push edi
lea edi, [ebp - 0x1f4]
mov ebx, dword [ebp + 8]
mov eax, edi
mov esi, 0x58fccd
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push str.Connection:_Keep_Alive_n
push edx
call fcn.00560f50
add esp, 8
push str.User_Agent:_Mozilla_4.73__en___X11__I__Linux_2.2.15_4mdk_i686__n_n_n
lea ecx, [ebp - 0x1f4]
push ecx
call fcn.00560f50
add esp, 8
push 0
lea eax, [ebp - 0x1f4]
push eax
call fcn.00560fe0
pop ecx
push eax
lea edx, [ebp - 0x1f4]
push edx
push ebx
call sub.WS2_32.DLL_send
push 0
lea ecx, [ebp - 0x1f4]
push 0x1f3
push ecx
push ebx
call sub.WS2_32.DLL_recv
mov esi, eax
push ebx
call sub.WS2_32.DLL_closesocket
cmp esi, 0xffffffff
je 0x41ec3a
mov byte [ebp + esi - 0x1f4], 0
push str.Server:
lea eax, [ebp - 0x1f4]
push eax
call fcn.005610d9
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x41ec3a
push str._n_n_n_n
push ebx
call fcn.005610d9
add esp, 8
mov byte [eax], 0
push ebx
call fcn.0056114c
pop ecx
jmp 0x41ec3c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ec44
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda8
push ebx
push esi
mov esi, dword [ebp + 8]
push 0
push 0x1f3
lea eax, [ebp - 0x1f4]
push eax
push esi
call sub.WS2_32.DLL_recv
mov ebx, eax
push esi
call sub.WS2_32.DLL_closesocket
cmp ebx, 0xffffffff
je 0x41ec9f
mov byte [ebp + ebx - 0x1f4], 0
lea ebx, [ebp - 0x1f4]
push 0x58fd4e
push ebx
call fcn.005610d9
add esp, 8
test eax, eax
je 0x41ec96
mov byte [eax], 0
push ebx
call fcn.0056114c
pop ecx
jmp 0x41eca1
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41eca8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda8
push ebx
push esi
mov esi, dword [ebp + 8]
push 0
push 0x1f3
lea eax, [ebp - 0x1f4]
push eax
push esi
call sub.WS2_32.DLL_recv
mov ebx, eax
push esi
call sub.WS2_32.DLL_closesocket
cmp ebx, 0xffffffff
je 0x41ed03
mov byte [ebp + ebx - 0x1f4], 0
lea ebx, [ebp - 0x1f4]
push 0x58fd50
push ebx
call fcn.005610d9
add esp, 8
test eax, eax
je 0x41ecfa
mov byte [eax], 0
push ebx
call fcn.0056114c
pop ecx
jmp 0x41ed05
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ed0c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe0c
push ebx
push esi
mov esi, dword [ebp + 8]
push 0
push 0x1f3
lea eax, [ebp - 0x1f4]
push eax
push esi
call sub.WS2_32.DLL_recv
mov ebx, eax
push esi
call sub.WS2_32.DLL_closesocket
cmp ebx, 0xffffffff
je 0x41ed67
mov byte [ebp + ebx - 0x1f4], 0
lea ebx, [ebp - 0x1f4]
push 0x58fd52
push ebx
call fcn.005610d9
add esp, 8
test eax, eax
je 0x41ed5e
mov byte [eax], 0
push ebx
call fcn.0056114c
pop ecx
jmp 0x41ed69
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ed70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
mov esi, dword [ebp + 8]
mov al, byte [str._n_d._d._d._d]
mov byte [ebp - 1], al
push 0
push 0x1f3
lea edx, [ebp - 0x1f8]
push edx
push esi
call sub.WS2_32.DLL_recv
mov ebx, eax
push esi
call sub.WS2_32.DLL_closesocket
cmp ebx, 0xffffffff
je 0x41edd2
mov byte [ebp + ebx - 0x1f8], 0
lea ebx, [ebp - 0x1f8]
lea eax, [ebp - 1]
push eax
push ebx
call fcn.005610d9
add esp, 8
test eax, eax
je 0x41edc9
mov byte [eax], 0
push ebx
call fcn.0056114c
pop ecx
jmp 0x41edd4
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421b44
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, 0x591ec0
call fcn.0056134c
lea edx, [ebp - 0x44]
push edx
push esi
call fcn.00401308
add esp, 8
mov ecx, dword [ebx + 0x2d0]
mov eax, dword [ecx + 0x398]
add eax, 0x1c
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x40]
push 0x32
lea ecx, [ebp - 0x78]
push ecx
push 0x102
mov eax, dword [0x5ae9d0]
push eax
call sub.USER32.DLL_LoadStringA
mov edx, dword [ebx + 0x2d0]
lea eax, [ebp - 8]
mov edi, dword [edx + 0x398]
lea edx, [ebp - 0x44]
mov word [ebp - 0x20], 8
add edi, 0x1c
call fcn.00583900
push eax
inc dword [ebp - 0x14]
lea edx, [ebp - 0x78]
lea eax, [ebp - 4]
call fcn.00583900
inc dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x14]
pop edx
call fcn.00583b40
mov eax, dword [edi]
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [edx]
call dword [ecx + 0x34]
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00583ae8
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00583ae8
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00583ae8
mov eax, dword [ebx + 0x2d4]
mov edx, dword [eax]
call dword [edx + 0x98]
mov eax, dword [ebx + 0x2e4]
mov edx, dword [eax]
call dword [edx + 0x98]
lea ecx, [ebp - 0x34]
push ecx
push 0
push esi
push 0x421c5c
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebx + 0x304], eax
mov eax, dword [ebp - 0x30]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422444
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
mov ebx, eax
mov eax, 0x592034
call fcn.0056134c
mov edx, dword [sym.LookAtLan.exe__MainWin]
mov ecx, dword [edx]
mov al, byte [ecx + 0x691]
cmp al, 1
jne 0x422477
push 1
push 0
push 0x591e54
call sub.WINMM.DLL_PlaySoundA
push 1
mov edx, dword [ebx + 0x304]
push edx
call sub.KERNEL32.DLL_TerminateThread
test eax, eax
jne 0x4224dc
push 0
lea ecx, [ebp - 0x2c]
push 0
push ecx
push 0x400
call sub.KERNEL32.DLL_GetLastError
push eax
push 0
push 0x1100
call sub.KERNEL32.DLL_FormatMessageA
mov word [ebp - 0x18], 8
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x2c]
call fcn.00583900
inc dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00516a6c
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00583ae8
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.KERNEL32.DLL_LocalFree
mov eax, dword [sym.LookAtLan.exe__GraphPing]
mov eax, dword [eax + 0x2d4]
mov edx, dword [eax]
call dword [edx + 0x98]
mov ecx, dword [sym.LookAtLan.exe__GraphPing]
mov eax, dword [ecx + 0x2e4]
mov edx, dword [eax]
call dword [edx + 0x98]
mov eax, ebx
call fcn.0050c688
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43afc4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
mov eax, 0x59f2c4
push ebx
mov ebx, dword [ebp + 8]
call fcn.0056134c
mov edx, dword [sym.LookAtLan.exe__MainWin]
mov ecx, dword [edx]
mov al, byte [ecx + 0x691]
cmp al, 1
jne 0x43aff8
push 1
push 0
push 0x59f150
call sub.WINMM.DLL_PlaySoundA
mov byte [ebx + 0x350], 1
mov edx, dword [ebx + 0x2d0]
mov eax, dword [edx + 0x254]
call fcn.00532a48
mov dword [ebx + 0x34c], 1
mov dl, 1
mov eax, dword [ebx + 0x2e0]
call fcn.0051352c
xor edx, edx
lea ecx, [ebp - 0x74]
mov dword [ebx + 0x348], edx
push 0x32
push ecx
mov eax, dword [0x5ae9d0]
push 0x10e
push eax
call sub.USER32.DLL_LoadStringA
mov word [ebp - 0x2c], 8
lea edx, [ebp - 0x74]
lea eax, [ebp - 4]
call fcn.00583900
inc dword [ebp - 0x20]
mov edx, dword [eax]
push edx
xor edx, edx
mov ecx, dword [ebx + 0x2dc]
mov eax, dword [ecx + 0x1f0]
call fcn.00530db0
pop edx
call fcn.00530d28
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00583ae8
push 0x32
lea eax, [ebp - 0x74]
push eax
push 0x10f
mov ecx, dword [0x5ae9d0]
push ecx
call sub.USER32.DLL_LoadStringA
mov word [ebp - 0x2c], 0x14
mov edx, 0x59f163
lea eax, [ebp - 0xc]
call fcn.00583900
inc dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x74]
lea eax, [ebp - 8]
call fcn.00583900
inc dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x10]
inc dword [ebp - 0x20]
pop edx
call fcn.00583b40
lea eax, [ebp - 0x10]
push eax
mov eax, dword [sym.LookAtLan.exe__MainWin]
mov edx, dword [eax]
lea eax, [ebp - 0x14]
mov edx, dword [edx + 0x944]
call fcn.00583a60
mov edx, eax
inc dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x18]
inc dword [ebp - 0x20]
pop eax
call fcn.00583b40
lea edx, [ebp - 0x18]
mov ecx, dword [edx]
mov edx, 1
push ecx
mov eax, dword [ebx + 0x2dc]
mov eax, dword [eax + 0x1f0]
call fcn.00530db0
pop edx
call fcn.00530d28
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00583ae8
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00583ae8
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00583ae8
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00583ae8
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00583ae8
xor edx, edx
mov eax, dword [ebx + 0x308]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
xor edx, edx
mov eax, dword [ebx + 0x310]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov dl, 1
mov eax, dword [ebx + 0x30c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
xor eax, eax
mov edx, dword [sym.LookAtLan.exe__VistaTree]
xor ecx, ecx
mov dword [edx + eax*4 + 0x320], ecx
inc eax
cmp eax, 0xa
jl 0x43b19f
lea eax, [ebp - 0x40]
push eax
push 0
push 0
push 0x43b1e0
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebx + 0x31c], eax
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c3ec
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov edi, eax
mov eax, 0x59f41c
call fcn.0056134c
mov edx, dword [sym.LookAtLan.exe__MainWin]
mov ecx, dword [edx]
mov al, byte [ecx + 0x691]
cmp al, 1
jne 0x43c421
push 1
push 0
push str.sounds_stop.wav
call sub.WINMM.DLL_PlaySoundA
push 1
mov edx, dword [edi + 0x31c]
push edx
call sub.KERNEL32.DLL_TerminateThread
mov ecx, dword [edi + 0x31c]
push ecx
call sub.KERNEL32.DLL_CloseHandle
xor esi, esi
lea ebx, [edi + 0x320]
mov eax, dword [ebx]
test eax, eax
je 0x43c459
push 1
push eax
call sub.KERNEL32.DLL_TerminateThread
mov edx, dword [ebx]
push edx
call sub.KERNEL32.DLL_CloseHandle
inc esi
add ebx, 4
cmp esi, 0xa
jl 0x43c443
mov ecx, dword [sym.LookAtLan.exe__VistaTree]
xor edx, edx
mov eax, dword [ecx + 0x2e0]
call fcn.0051352c
push 0x1e
lea ecx, [ebp - 0x48]
push ecx
push 0x112
mov eax, dword [0x5ae9d0]
push eax
call sub.USER32.DLL_LoadStringA
mov word [ebp - 0x18], 8
lea edx, [ebp - 0x48]
lea eax, [ebp - 4]
call fcn.00583900
inc dword [ebp - 0xc]
mov ecx, dword [sym.LookAtLan.exe__VistaTree]
mov edx, dword [eax]
push edx
xor edx, edx
mov eax, dword [ecx + 0x2dc]
mov eax, dword [eax + 0x1f0]
call fcn.00530db0
pop edx
call fcn.00530d28
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00583ae8
mov eax, dword [sym.LookAtLan.exe__VistaTree]
mov eax, dword [eax + 0x310]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [sym.LookAtLan.exe__VistaTree]
mov edx, dword [eax + 0x2e8]
mov eax, dword [edx + 0x128]
call fcn.004ff180
mov edx, dword [sym.LookAtLan.exe__MainWin]
mov ecx, eax
mov eax, dword [edx]
xor edx, edx
mov eax, dword [eax + 0x2fc]
call fcn.004d6aa8
mov ecx, dword [sym.LookAtLan.exe__VistaTree]
mov eax, dword [ecx + 0x2e8]
mov edx, dword [eax]
call dword [edx + 0x78]
mov ecx, dword [sym.LookAtLan.exe__VistaTree]
mov byte [ecx + 0x350], 0
mov eax, dword [edi + 0x30c]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44bfb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], eax
mov al, byte [0x44c050]
mov byte [ebp - 9], al
push 0x90
call sub.USER32.DLL_GetKeyState
movsx eax, ax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44bfe3
mov al, byte [0x44c054]
or al, byte [ebp - 9]
mov byte [ebp - 9], al
push 0x14
call sub.USER32.DLL_GetKeyState
movsx eax, ax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44c001
mov al, byte [0x44c058]
or al, byte [ebp - 9]
mov byte [ebp - 9], al
push 0x91
call sub.USER32.DLL_GetKeyState
movsx eax, ax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44c022
mov al, byte [0x44c05c]
or al, byte [ebp - 9]
mov byte [ebp - 9], al
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
jne 0x44c04b
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 9]
cmp dl, byte [eax + 0x2d]
je 0x44c04b
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 9]
mov byte [eax + 0x2d], dl
mov eax, dword [ebp - 4]
mov bx, 0xfff0
call fcn.0055d0fc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44c060
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov byte [ebp - 7], cl
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 6]
push eax
call sub.USER32.DLL_GetKeyState
movsx eax, ax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10c]
push eax
call sub.USER32.DLL_GetKeyboardState
cmp dword [ebp - 0xc], 0
jne 0x44c0b5
cmp byte [ebp - 7], 0
je 0x44c0b5
movzx eax, word [ebp - 6]
mov byte [ebp + eax - 0x10c], 1
lea eax, [ebp - 0x10c]
push eax
call sub.USER32.DLL_SetKeyboardState
jmp 0x44c0d3
cmp byte [ebp - 7], 0
jne 0x44c0d3
movzx eax, word [ebp - 6]
mov byte [ebp + eax - 0x10c], 0
lea eax, [ebp - 0x10c]
push eax
call sub.USER32.DLL_SetKeyboardState
mov esp, ebp
pop ebp
ret

Function at 0x44c450
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
push 0
mov eax, dword [0x5ae3ec]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.USER32.DLL_ShowWindow
push 0
mov eax, dword [0x5ae3ec]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
call fcn.00521ee0
push eax
call sub.USER32.DLL_ShowWindow
pop ecx
pop ebp
ret

Function at 0x44c724
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [0x44c768]
mov byte [ebp - 1], al
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x44c740
or byte [ebp - 1], 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x44c750
or byte [ebp - 1], 4
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x44c760
or byte [ebp - 1], 2
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret
Function at 0x44d700
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44d850
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0054c604
lea edx, [ebp - 0x110]
mov eax, dword [0x5ae3ec]
mov eax, dword [eax]
call fcn.0050f498
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.00555a10
mov eax, dword [ebp - 4]
mov byte [eax + 0x3c], 0
lea eax, [ebp - 0x109]
push eax
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
je 0x44d784
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x44d830
mov eax, dword [ebp - 4]
cmp word [eax + 0x32], 0
je 0x44d79a
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call dword [ebx + 0x30]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2e], 0
je 0x44d7fc
lea eax, [ebp - 0x109]
push eax
push 0
call sub.USER32.DLL_FindWindowA
mov dword [ebp - 8], eax
push 0x44d85c
mov eax, dword [ebp - 8]
push eax
call sub.USER32.DLL_SetWindowTextA
lea eax, [ebp - 0x109]
push eax
push 0
call sub.USER32.DLL_FindWindowA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44d7fc
mov eax, dword [ebp - 8]
push eax
call sub.USER32.DLL_IsIconic
test eax, eax
je 0x44d7f3
push 9
mov eax, dword [ebp - 8]
push eax
call sub.USER32.DLL_ShowWindow
jmp 0x44d7fc
mov eax, dword [ebp - 8]
push eax
call sub.USER32.DLL_BringWindowToTop
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2d], 0
je 0x44d830
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2c], 0
je 0x44d824
push 0
mov cx, word [0x44d860]
mov dl, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00516974
mov eax, dword [0x5ae3ec]
mov eax, dword [eax]
call fcn.0050fa28
mov eax, dword [ebp - 4]
mov byte [eax + 0x3c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d857
lea eax, [ebp - 0x110]
call fcn.0055dbbc
ret
Function at 0x458cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
push ebp
push 0x458d72
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x190
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x458d80
push reloc.WS2_32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x458d5c
mov dword [ebp - 0x10], 0x20
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x458d98
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [ebp - 0x14], 2
je 0x458d5c
cmp dword [ebp - 0x14], 0
jne 0x458d2c
cmp dword [ebp - 0xc], 1
je 0x458d33
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x458d5c
lea eax, [ebp - 0x3c]
lea edx, [ebp - 0x38]
mov ecx, 0x20
call fcn.0055ddec
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x18]
call fcn.0055cbd8
mov dword [ebp - 4], eax
cmp dword [ebp - 0x18], 0
je 0x458d5c
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458d79
lea eax, [ebp - 0x3c]
call fcn.0055dbbc
ret

Function at 0x4599d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459aa8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5ae650]
cmp dword [eax], 5
jl 0x459a08
mov eax, dword [0x5ae64c]
cmp dword [eax], 2
je 0x459a11
mov byte [ebp - 5], 1
jmp 0x459a92
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push 0x459ac0
push dword [ebp - 4]
push 0x459aec
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0055defc
mov eax, dword [ebp - 0x20]
call fcn.0055e000
push eax
push reloc.WS2_32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x459a92
mov dword [ebp - 0x18], 8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x459a7c
cmp word [ebp - 0x14], 0
jne 0x459a85
cmp dword [ebp - 0x1c], 0xea
jne 0x459a89
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459aaf
lea eax, [ebp - 0x20]
call fcn.0055dbbc
ret
Function at 0x45e824
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005221dc
test al, al
je 0x45e97f
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00521ee0
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.USER32.DLL_GetUpdateRect
test eax, eax
je 0x45e88d
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call sub.USER32.DLL_EqualRect
test eax, eax
je 0x45e88d
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0045b0a8
jmp 0x45e97f
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.USER32.DLL_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45e96d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_SelectObject
push 0
push 0
push 0x85
mov eax, dword [ebp - 4]
push eax
call sub.USER32.DLL_SendMessageA
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
push eax
call sub.USER32.DLL_SendMessageA
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
push eax
call sub.USER32.DLL_SendMessageA
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_BitBlt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e974
cmp dword [ebp - 0xc], 0
je 0x45e950
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_DeleteDC
cmp dword [ebp - 0x10], 0
je 0x45e95f
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_DeleteObject
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.USER32.DLL_ReleaseDC
ret
mov esp, ebp
pop ebp
ret
Function at 0x468f94
Capabilities:
Encode data using xor

Disassembly:
add byte [eax - 0x37], al
push esp
add byte [esi + edi], dh
inc edi
add byte [eax + 0x74004d6e], al
xor eax, 0x36b80052
push edx
add byte [eax + 0x40], cl
inc edi
add byte [esp + edx*2], cl
push esp
inc edx
dec ecx
insd dword es:[edi], dx
popal
dec esp
imul esi, dword [ebx + 0x74], 0x94909090
pop dword [esi]
pop es
or al, 0x54
push esp
inc edx
dec ecx
insd dword es:[edi], dx
popal
dec esp
imul esi, dword [ebx + 0x74], 0x468f40
enter 0x468e, 0
adc dword [eax], eax
pop es
push esp
inc edx
xor cl, byte [ecx + 0x74]
insd dword es:[edi], dx
add eax, 0x4d638800
add byte [eax], bh
add bh, bh
add byte [edx + 0x47], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x430d000c], al
push 0x656b6365
dec ecx
insd dword es:[edi], dx
popal
jae 0x468f67
arpl word [ebp], cx
add byte [eax], 0
jmp [eax]