joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bb70
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x44bba5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403cb0
jmp 0x44bbaf
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403c1c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44c934
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x44c96c
mov eax, esi
call fcn.00433504
test al, al
je 0x44c96c
mov eax, dword [ebx + 0x74]
call fcn.00433208
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44c96c
push 0
mov eax, dword [ebx + 0x74]
call fcn.00433208
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x451328
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.004510a4
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040400c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x451386
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4bcf30]
mov dl, 1
mov eax, dword [0x450fc8]
call fcn.0040b86c
call fcn.00403624
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x451c44
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
jmp 0x451c63
mov eax, dword [0x4bcfa0]
mov eax, dword [eax]
call fcn.0044be18
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, dword [ebp - 4]
cdq
cmp edx, dword [esp + 4]
jne 0x451c8e
cmp eax, dword [esp]
pop edx
pop eax
ja 0x451c57
jmp 0x451c92
pop edx
pop eax
jg 0x451c57
pop ecx
pop ecx
pop ebp
ret
Function at 0x463f4c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x463f62
add esp, 0xfffffff0
call fcn.004031cc
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x464097
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.00414a74
mov byte [edi + 0x40], 3
mov dword [edi + 0x4c], 0x1fffffff
mov al, byte [0x4640bc]
mov byte [edi + 0x2c], al
xor ecx, ecx
mov dl, 1
mov eax, dword [0x463a00]
call fcn.0046425c
mov dword [edi + 0x30], eax
xor eax, eax
mov dword [edi + 0x98], eax
test byte [edi + 0x20], 0x10
jne 0x463ffe
mov byte [edi + 0xa0], 0
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402928
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00408a44
mov eax, dword [ebp - 4]
call fcn.0040400c
push eax
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov esi, eax
mov dword [edi + 0x9c], esi
test esi, esi
je 0x463ffe
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x463ffe
mov byte [edi + 0xa0], 1
push 0x32
xor ecx, ecx
mov dl, 1
mov eax, dword [0x463cc8]
call fcn.0046455c
mov dword [edi + 0x50], eax
mov byte [edi + 0x60], 0
xor eax, eax
mov dword [edi + 0x64], eax
mov byte [edi + 0x54], 2
xor edx, edx
mov eax, edi
call fcn.00463e64
mov dword [edi + 0x5c], 0xffffffff
xor eax, eax
mov dword [edi + 0x84], eax
xor eax, eax
mov dword [edi + 0x80], eax
mov byte [edi + 0x88], 0
mov al, byte [0x4640c0]
mov byte [edi + 0x34], al
lea eax, [edi + 0x90]
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
push 0x40a4
mov eax, dword [0x4be4dc]
push eax
call sub.user32.dll_LoadCursorA
mov ecx, eax
mov eax, dword [0x4bd128]
mov eax, dword [eax]
mov edx, 0xffffff01
call fcn.0044a330
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46409e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403bec
ret
Function at 0x470dbc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
mov eax, dword [0x4bcfa0]
mov eax, dword [eax]
call fcn.0044be18
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, dword [ebp - 4]
cdq
cmp edx, dword [esp + 4]
jne 0x470e04
cmp eax, dword [esp]
pop edx
pop eax
ja 0x470dcd
jmp 0x470e08
pop edx
pop eax
jg 0x470dcd
pop ecx
pop ecx
pop ebp
ret
Function at 0x474588
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4747e7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4745ea
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00474050
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c080
cmp al, 1
jne 0x4745ea
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00474368
test al, al
je 0x474776
cmp dword [ebp - 8], 0
jge 0x474608
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00474050
mov eax, dword [ebp - 0x210]
call fcn.00403e48
cmp ebx, eax
jge 0x474652
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00474050
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4bd134]
and eax, 0xff
bt dword [edx], eax
jae 0x474652
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
cmp eax, dword [ebp - 8]
jg 0x474666
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00474564
cmp ebx, dword [ebp - 8]
je 0x474768
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x474692
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.004030a8
and eax, 0x7f
movzx eax, word [eax*2 + 0x4bbe1c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 1
xor eax, eax
push ebp
push 0x474755
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.004030a8
and eax, 0x7f
movzx eax, word [eax*2 + 0x4bbe1c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00433208
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.004030a8
and eax, 0x7f
movzx eax, word [eax*2 + 0x4bbe1c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00433208
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47475c
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x218], edx
jmp 0x4747c9
cmp dword [ebp - 8], 0
jge 0x474781
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00474050
mov eax, dword [ebp - 0x218]
call fcn.00403e48
cmp eax, dword [ebp - 8]
jg 0x4747bb
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00474050
mov eax, dword [ebp - 0x21c]
call fcn.00403e48
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00474564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4747ee
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00403bec
ret
Function at 0x4809ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040400c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x480a05
test al, 0x10
jne 0x480a09
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x486f7c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x14f], 0
jne 0x487081
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x487081
mov eax, dword [ebp - 4]
cmp dword [eax + 0x149], 0
je 0x486fc5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x149]
cmp byte [eax + 0x51], 0
jne 0x487081
mov eax, dword [ebp - 4]
cmp byte [eax + 0x135], 0
jne 0x486fe3
mov eax, dword [ebp - 4]
mov byte [eax + 0x169], 2
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x78]
xor eax, eax
push ebp
push 0x48707a
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, 0x14
jge 0x487014
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jge 0x486ff9
mov eax, dword [ebp - 4]
cmp dword [eax + 0x128], 0
jne 0x48702c
mov eax, dword [ebp - 4]
mov bx, 0xffec
call fcn.004030a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487081
mov eax, dword [ebp - 4]
mov byte [eax + 0x169], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x128], 0
jne 0x487059
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x78]
jmp 0x487079
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x135]
xor dl, 1
mov eax, dword [ebp - 4]
call fcn.004872ac
mov eax, dword [ebp - 4]
mov bx, 0xffec
call fcn.004030a8
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x491aa0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x491ace
mov eax, ebx
call fcn.00492544
cmp dword [ebx + 0x3c], 0
je 0x491ac7
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x491b3f
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x491b31
cmp dword [ebx + 8], 0
je 0x491af0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x491b02
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x491b31
cmp dword [ebx + 8], 0
je 0x491ae3
cmp eax, 3
je 0x491b15
dec eax
jne 0x491ae3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x491ae3
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x491ae3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x491b5d
cmp dword [ebx + 0x10], 0xcc
je 0x491b5d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00491b68
pop ebx
ret
Function at 0x4a5114
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe1c
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ffc
xor eax, eax
push ebp
push 0x4a530a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4a5145
cmp dword [ebp - 8], 0
jne 0x4a5151
mov dword [ebp - 0xc], 0xfffffeca
jmp 0x4a52f4
xor eax, eax
mov dword [0x4ce034], eax
lea eax, [ebp - 0x1b4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jge 0x4a5179
mov dword [ebp - 0xc], 0xfffffecb
jmp 0x4a52f4
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x4a5199
mov dword [ebp - 0xc], 0xfffffecb
jmp 0x4a52f4
mov byte [ebp - 0x19], 0
mov eax, dword [ebp - 4]
call fcn.00403e48
test eax, eax
jle 0x4a51e6
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
cmp byte [eax + edx - 1], 0x30
jb 0x4a51cd
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
cmp byte [eax + edx - 1], 0x39
jbe 0x4a51de
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
cmp byte [eax + edx - 1], 0x2e
je 0x4a51de
mov byte [ebp - 0x19], 1
inc dword [ebp - 0x20]
dec dword [ebp - 0x24]
jne 0x4a51b3
cmp byte [ebp - 0x19], 0
je 0x4a5298
mov eax, dword [ebp - 4]
call fcn.0040400c
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4a5221
mov dword [ebp - 0xc], 0xfffffec1
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
jmp 0x4a52f4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
mov dword [ebp - 0x1e4], eax
mov byte [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x14]
inc eax
movzx eax, byte [eax]
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x14]
add eax, 2
movzx eax, byte [eax]
mov dword [ebp - 0x1d4], eax
mov byte [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x14]
add eax, 3
movzx eax, byte [eax]
mov dword [ebp - 0x1cc], eax
mov byte [ebp - 0x1c8], 0
lea edx, [ebp - 0x1e4]
mov ecx, 3
mov eax, 0x4a5320
call fcn.004092f0
mov word [ebp - 0x1c4], 2
mov ax, word [ebp - 8]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x1c2], ax
mov eax, dword [ebp - 4]
call fcn.0040400c
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x1c0], eax
push 0x10
lea eax, [ebp - 0x1c4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_connect
test eax, eax
jge 0x4a52ee
mov dword [ebp - 0xc], 0xfffffeca
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_closesocket
jmp 0x4a52f4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5311
lea eax, [ebp - 4]
call fcn.00403bc8
ret
Function at 0x4a5358
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.004099f8
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x24]
call fcn.00409510
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x4bcfa0]
mov eax, dword [eax]
call fcn.0044be18
mov dword [ebp - 0x134], 1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x1c], 1
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wsock32.dll_select
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x4a53d5
mov byte [ebp - 9], 0
jmp 0x4a542a
cmp dword [ebp - 0x14], 0
jle 0x4a53e1
mov byte [ebp - 9], 1
jmp 0x4a542a
call fcn.004099f8
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2c]
call fcn.00409510
mov eax, dword [ebp - 0x2c]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov ebx, 0x3e8
cdq
idiv ebx
sub ecx, eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 8]
jle 0x4a5383
mov byte [ebp - 9], 0
mov al, byte [ebp - 9]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a5434
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
jne 0x4a5456
mov dword [ebp - 0x18], 0x8000
mov byte [ebp - 0x1d], 1
jmp 0x4a5460
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x1d], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004a5358
test al, al
jne 0x4a548b
cmp dword [ebp - 0x1c], 0
jg 0x4a5483
mov dword [ebp - 0x10], 0xffffffff
jmp 0x4a54d3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
jmp 0x4a54d3
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x4a54ad
cmp byte [ebp - 0x1d], 0
je 0x4a54b5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x4a54d3
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
cmp dword [ebp - 0x18], 0
jg 0x4a5465
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x4a54dc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 0
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x1c]
mov eax, 0x7f6
call fcn.004a50e8
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x4a5528
mov dword [ebp - 0x10], 0xfffffec4
jmp 0x4a554a
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jne 0x4a54f6
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4a554a
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4046c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437bb0
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4047e3
push ecx
lea ecx, [esi + 0x18]
call fcn.00423ee0
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4047fa
push ecx
lea ecx, [esi + 0x24]
call fcn.00423df0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44a210
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
mov dword [esi], 0
call ebx
test ax, ax
jge 0x44a23b
or dword [esi], 0x2000000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a258
or dword [esi], 0x4000000
test edi, edi
je 0x44a26e
mov ecx, dword [0x657a4c]
push 0x657768
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a27d
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x44da30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480f20
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44db53
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d250
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44db6a
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d160
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46c210
Capabilities:
Encode data using xor

Disassembly:
push cs
xor byte [esi + 0x22], ch
outsb dx, byte [esi]
and ah, byte [ebx]
pop ecx
xchg ebp, eax
outsb dx, byte [esi]
and ah, byte [ebx]
pop ecx
xchg ebp, eax
das
and eax, 0x54fd93cd
cmp dh, ch
sbb byte [eax + 0x26ef3608], cl
xor byte [edi], 0x42
outsb dx, byte [esi]
loop 0x46c20e
push 0x37
jb 0x46c271
pop esi
dec ecx
dec esp
mov ch, 0x23
invalid
dec esp
or al, 0xf7
invalid
Function at 0x496dc0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca2b0
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496ee3
push ecx
lea ecx, [esi + 0x18]
call fcn.004b65e0
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496efa
push ecx
lea ecx, [esi + 0x24]
call fcn.004b64f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ca3e0
Capabilities:
Encode data using xor

Disassembly:
adc edx, dword [ecx - 0x4e8d833a]
stosd dword es:[edi], eax
and dword [0x2f8243df], edx
invalid