joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e570
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44e5a8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44e589
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44e598
or bl, 4
test esi, 0x20000000
je 0x44e5a3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x454c50
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x454c62
add esp, 0xfffffff0
call fcn.00403408
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004197f0
mov eax, dword [0x45def8]
mov dword [eax + 4], ebx
mov dword [eax], 0x454ff4
mov eax, dword [0x45df04]
mov dword [eax + 4], ebx
mov dword [eax], 0x455000
mov eax, ebx
call fcn.0045500c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411ae8]
call fcn.004030b4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411ae8]
call fcn.004030b4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411ae8]
call fcn.004030b4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411ae8]
call fcn.004030b4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411ae8]
call fcn.004030b4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x451428
push eax
push 0
push 0
mov eax, dword [0x45e054]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41b23c]
call fcn.0041c8d8
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41b23c]
call fcn.0041c8d8
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41b23c]
call fcn.0041c8d8
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045542c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x455308
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x455308
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x455308
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x454d9f
call fcn.00403460
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4550ec
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x455297
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x455278
mov dl, 1
mov eax, dword [0x411f04]
call fcn.004030b4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403e34
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x455267
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004430d4
test al, al
je 0x45525a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4552a8
lea eax, [ebp - 0x254]
call fcn.00408d54
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45525a
xor eax, eax
push ebp
push 0x455253
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4552e0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45523c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040a4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45523c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45525a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45515d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004159e0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45529e
lea eax, [ebp - 0x260]
call fcn.00403e34
ret

Function at 0x455bcc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45fbb0]
cmp byte [eax + 0xa5], 0
jne 0x455c3d
cmp dword [0x45fbc8], 0
jne 0x455bfe
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x455b88
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45fbc8], eax
cmp dword [0x45fbc4], 0
jne 0x455c19
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45fbc4], eax
cmp dword [0x45fbcc], 0
jne 0x455c3d
push esp
push 0
push 0
push 0x455b2c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x45fbcc], eax
pop edx
ret
Function at 0x455d34
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x455d4b
add esp, 0xfffffff0
call fcn.00403408
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004197f0
mov eax, dword [0x45e040]
cmp word [eax + 2], 0
jne 0x455d73
mov eax, dword [0x45e040]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045749c
mov eax, dword [0x45e0f0]
cmp word [eax + 2], 0
jne 0x455d8d
mov eax, dword [0x45e0f0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00457694
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411ae8]
call fcn.004030b4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411ae8]
call fcn.004030b4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41bc44]
call fcn.00422e54
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x455f14
mov eax, dword [0x45df5c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00423224
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x457c34
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45df5c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c500
test eax, eax
je 0x455e82
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408748
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c528
test eax, eax
je 0x455e96
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004040a4
mov eax, dword [0x45de50]
cmp byte [eax], 0
jne 0x455eca
mov eax, ebx
call fcn.0045603c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00457e10
mov eax, ebx
call fcn.004587d4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x455f0a
call fcn.00403460
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4562bc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45fbb0]
cmp dword [eax + 0x30], 0
je 0x456366
cmp dword [ebx + 0x94], 0
jne 0x456360
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45624c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x456360
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x456326
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x456360
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413e50
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x456335
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x456ec8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x456efd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f24
jmp 0x456f0a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403e88
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x457fec
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45802d
mov eax, esi
call fcn.0043e6bc
test al, al
je 0x45802d
mov eax, dword [ebx + 0x84]
call fcn.0043e3b8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45802d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043e3b8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x459188
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x459211
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x45fbd8
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x4591fb
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040af0c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x459228
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x45e154]
mov dl, 1
mov eax, dword [0x45897c]
call fcn.0040b830
call fcn.00403870
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459218
lea eax, [ebp - 0x1c]
call fcn.00403e34
ret
Function at 0x4598b8
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.004597dc
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004032e0
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x45991c
call fcn.004590d0
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x45990e
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004032e0
pop esi
pop ebx
ret

Function at 0x459940
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.004042f4
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402b00
test ebx, ebx
je 0x45998b
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x459a68
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x459a99
mov ecx, dword [0x45e090]
mov dl, 1
mov eax, dword [0x45897c]
call fcn.0040b7f4
call fcn.00403870
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x459ac6
mov ecx, dword [0x45e038]
mov dl, 1
mov eax, dword [0x45897c]
call fcn.0040b7f4
call fcn.00403870
xor eax, eax
push ebp
push 0x459b42
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.004032e0
cmp byte [ebp + 8], 0
je 0x459b1e
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004599d0
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.004598b8
jmp 0x459b38
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004593bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x459b5f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x459d40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00459678
xor eax, eax
push ebp
push 0x459eb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x459e9b
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x459d8b
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x459d95
call fcn.0040391c
jmp 0x459eb8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00415a90
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x459e90
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x459e43
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x459e30
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004032e0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.00459cf8
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x459ec4]
cmp dl, byte [eax + 0x28]
je 0x459e97
call fcn.0040b718
jmp 0x459e97
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00415ab0
jmp 0x459e97
cmp ecx, ebx
jge 0x459e5f
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00415ab0
jmp 0x459d95
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00415a90
cmp edx, dword [esp + 4]
jne 0x459e7f
cmp eax, dword [esp]
pop edx
pop eax
jne 0x459d95
push ebp
call fcn.00459cf8
pop ecx
jmp 0x459e97
push ebp
call fcn.00459cf8
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459eb8
mov eax, dword [ebp - 4]
call fcn.00459684
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459ec8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459fea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00459678
xor eax, eax
push ebp
push 0x459fcd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x459f18
call fcn.0040391c
jmp 0x459fd4
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x459fb7
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x459fb7
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004032e0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x459fb7
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040af0c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x45a004
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x45e154]
mov dl, 1
mov eax, dword [0x45897c]
call fcn.0040b830
call fcn.00403870
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459fd4
mov eax, dword [ebp - 4]
call fcn.00459684
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459ff1
lea eax, [ebp - 0x28]
call fcn.00403e34
ret
Function at 0x45a050
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45a19a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00459678
xor eax, eax
push ebp
push 0x45a17d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x45a0b5
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x45a0b5
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x45a167
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x45a0c8
call fcn.0040391c
jmp 0x45a184
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x45a167
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x45a167
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004032e0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x45a167
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040af0c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x45a1b4
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x45e154]
mov dl, 1
mov eax, dword [0x45897c]
call fcn.0040b830
call fcn.00403870
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a184
mov eax, dword [ebp - 4]
call fcn.00459684
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a1a1
lea eax, [ebp - 0x28]
call fcn.00403e34
ret

Function at 0x45b008
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x45e0d4]
mov eax, dword [eax]
call fcn.00457208
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp esi, eax
ja 0x45b013
pop esi
pop ebx
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x5808483e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x62d874e4
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4019e0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x414
mov eax, dword [0x408258]
xor eax, esp
mov dword [esp + 0x410], eax
lea eax, [esp]
push 1
push eax
call fcn.00402a60
add esp, 8
cmp word [esp], 0
mov edx, str.FFModulesAviSynthPlugins
lea eax, [esp]
je 0x401a20
add eax, 2
cmp word [eax], 0
jne 0x401a11
lea ebx, [ebx]
movzx ecx, word [edx]
mov word [eax], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x401a20
push 0x104
lea ecx, [esp + 0x20c]
push ecx
push str.HKLMSoftwareAviSynthplugindir2_5
call fcn.00402fe0
add esp, 0xc
test al, al
jne 0x401a66
xor al, al
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00404656
add esp, 0x414
ret
lea edx, [esp + 0x208]
lea eax, [esp]
call fcn.00401b80
test eax, eax
jne 0x401a4f
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SoftwareAviSynth
push 0x80000002
call esi
push str.CLSIDE6D6B700_124D_11D4_86F3_DB80AFD98778
push 0x80000000
call esi
push str.AVIFileExtensionsAVS
push 0x80000000
call esi
push str.Media_TypeExtensions.avs
push 0x80000000
call esi
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
mov al, 1
call fcn.00404656
add esp, 0x414
ret
Function at 0x402980
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x260
mov eax, dword [0x408258]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
mov ebx, dword [esp + 0x26c]
push esi
mov esi, dword [esp + 0x27c]
xor eax, eax
push edi
mov edi, dword [esp + 0x270]
push 0x44
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
call sub.MSVCR80.dll_memset
xor ecx, ecx
add esp, 0xc
cmp byte [esp + 0x27c], cl
mov dword [esp + 0x1c], 0x44
sete cl
test esi, esi
mov dword [esp + 0x48], 1
mov word [esp + 0x4c], cx
jne 0x402a07
test edi, edi
je 0x402a07
lea esi, [esp + 0x60]
mov edx, esi
push edx
push edi
call fcn.00402930
add esp, 8
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
cmp byte [esp + 0x278], 0
je 0x402a44
test bl, bl
je 0x402a44
mov edx, dword [esp + 0xc]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x268]
pop edi
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00404656
add esp, 0x260
ret
Function at 0x404656
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408258]
jne 0x404660
repz ret
jmp fcn.00404c2b

Function at 0x100738c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x10073d3
cmp edx, 0x10
jl 0x10073bf
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x10073ac
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x10073d3
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x10073cb
and edx, 3
cmp edx, 3
jne 0x10073e7
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x10073ec
cmp edx, 2
jne 0x10073f8
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x10073fd
cmp edx, 1
jne 0x1007403
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret