joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4889f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ea6e9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x10], ebx
call fcn.004d7b9e
mov eax, dword [esp + 0x60]
xor ebp, ebp
push eax
lea ecx, [ebx + 0x24]
mov dword [esp + 0x5c], ebp
call fcn.004d8345
mov dword [ebx + 0x2c], ebp
mov dword [ebx + 0x28], vtable.CFont.0
mov dword [ebx + 0x60], 0x4f68e0
mov dword [ebx + 0x64], ebp
mov dword [ebx + 0x68], 0x11
mov dword [ebx + 0x6c], ebp
mov dword [ebx + 0x70], ebp
mov dword [ebx + 0x74], ebp
mov dword [ebx + 0x78], 0xa
lea ecx, [esp + 0x14]
push ebp
push ecx
push 0x3c
push 0x1f
mov byte [esp + 0x68], 3
mov dword [ebx], 0x4f6878
mov dword [ebx + 0x1c], ebp
mov dword [ebx + 0x20], ebp
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov edi, 0x51c2e0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], 0xfffffff4
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
lea ecx, [ebx + 0x28]
call fcn.004db4db
push 0x12
call fcn.00464670
mov ecx, eax
call fcn.00464f00
mov dword [ebx + 0x30], eax
lea esi, [ebx + 0x3c]
xor eax, eax
xor ecx, ecx
mov dword [esi], eax
xor edx, edx
mov dword [ebx + 0x34], eax
pop edi
mov dword [esi + 4], ecx
mov dword [ebx + 0x38], ebp
mov dword [ebx + 0x4c], ebp
mov dword [ebx + 0x50], ebp
mov dword [esi + 8], edx
mov dword [ebx + 0x54], 1
mov dword [ebx + 0x58], ebp
mov dword [ebx + 0x5c], ebp
mov dword [esi + 0xc], ebp
mov eax, ebx
pop esi
mov ecx, dword [esp + 0x48]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret 4

Function at 0x491eb0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, ecx
mov ebx, dword [ebp + 0x1e0]
test bl, 0x80
jne 0x491f8b
push esi
push edi
mov edi, ebx
and edi, 2
call fcn.0045ee30
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, edi
neg esi
sbb esi, esi
and esi, 3
add esi, 3
test bl, 8
jne 0x491f18
test edi, edi
jne 0x491f0c
and ebx, 4
or ebx, 0x10
shr ebx, 2
jmp 0x491f16
and bl, 4
neg bl
sbb ebx, ebx
add ebx, 8
mov esi, ebx
mov eax, dword [ebp + 0x1e4]
mov edi, 1
test eax, eax
je 0x491f2c
mov edi, 2
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebp + 0x1c]
jne 0x491f3e
mov edi, 3
jmp 0x491f64
mov ebx, dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, ebx
jne 0x491f64
push 0
push 0
push 0x129
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
test al, 1
jne 0x491f64
mov edi, 4
mov ecx, ebp
call fcn.004d7a68
test eax, eax
jne 0x491f74
mov edi, 5
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push edi
push esi
push eax
call fcn.00425b20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x492557
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x20
lea eax, [esp + 0x10]
push esi
mov esi, ecx
push eax
push 0
mov ecx, dword [esi + 0x1c]
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
cmp eax, dword [esi + 0x1e4]
je 0x4925d1
mov edx, dword [esi + 0x1c]
push 0
push 0
push edx
mov dword [esi + 0x1e4], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x1e4]
test eax, eax
je 0x4925d1
mov eax, dword [esi + 0x1c]
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0xffffffff
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov ecx, esi
call fcn.004d4d6b
pop esi
add esp, 0x20
ret 0xc

Function at 0x4946c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
mov esi, dword [ecx + 0xcc]
test esi, esi
push edi
mov dword [esp + 8], ecx
je 0x49475c
mov edi, dword [esi + 0x44]
xor eax, eax
mov al, byte [esp + 0x11]
cmp al, 2
jne 0x49475c
test edi, edi
je 0x49475c
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
push ebp
lea ecx, [esi + 8]
push ebx
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x494705
mov eax, dword [edi + 0x2c]
jmp 0x494727
mov eax, dword [esi + 4]
mov ecx, ebp
test eax, eax
jne 0x494710
mov ecx, ebx
mov eax, dword [esi + 0x20]
add eax, ecx
mov ecx, dword [edi + 0x3c]
cmp eax, ecx
jl 0x494725
mov edx, dword [edi + 0x38]
add ecx, edx
cmp eax, ecx
jl 0x494727
mov eax, ecx
mov edi, dword [esp + 0x10]
push eax
mov ecx, edi
call fcn.00494620
mov eax, dword [esp + 0x18]
pop ebp
cmp eax, 0x202
mov dword [esi], 1
pop ebx
je 0x494753
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x49475c
push 0
mov ecx, edi
call fcn.00494520
pop edi
pop esi
pop ecx
ret 0xc

Function at 0x498330
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4eb358
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
mov ebp, ecx
push esi
mov dword [ebp + 8], 0
call fcn.004db532
mov esi, dword [esp + 0x48]
test esi, esi
je 0x4983d7
push edi
mov edi, dword [esp + 0x48]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
pop edi
je 0x4983d7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4983d7
cmp ebx, 0xa
jb 0x4983d7
push 0
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.004dcd31
lea eax, [esp + 0xc]
mov ecx, ebp
push eax
mov dword [esp + 0x40], 0
call fcn.004983f0
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x3c], 0xffffffff
call fcn.004dcd7f
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 8
mov ecx, dword [esp + 0x34]
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 8
Function at 0x49d540
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4eba78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x34]
push esi
mov esi, ecx
push eax
lea ecx, [esp + 8]
call fcn.0049dac0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
sub esp, 0x10
mov dword [esp + 0x30], 0
mov ecx, esp
push esi
mov dword [ecx], edx
mov edx, dword [esp + 0x44]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x48]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x18]
call fcn.0049dba0
lea ecx, [esp + 4]
mov dword [esp + 0x20], 0xffffffff
call fcn.0049ad20
mov ecx, dword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14

Function at 0x4a7e50
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
mov esi, dword [ecx + 0x100]
test esi, esi
push edi
mov dword [esp + 8], ecx
je 0x4a7ee9
mov edi, dword [esi + 0x34]
xor eax, eax
mov al, byte [esp + 0x11]
cmp al, 2
jne 0x4a7ee9
test edi, edi
je 0x4a7ee9
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
push ebp
lea ecx, [esi + 4]
push ebx
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4a7e95
mov eax, dword [edi + 0x2c]
jmp 0x4a7eba
mov edx, dword [esi + 0x34]
mov ecx, ebp
mov eax, dword [edx + 0x58]
test eax, eax
jne 0x4a7ea3
mov ecx, ebx
mov eax, dword [esi + 0x1c]
add eax, ecx
mov ecx, dword [edi + 0x40]
cmp eax, ecx
jl 0x4a7eb8
mov edx, dword [edi + 0x3c]
add ecx, edx
cmp eax, ecx
jl 0x4a7eba
mov eax, ecx
mov esi, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.004a7dd0
mov eax, dword [esp + 0x18]
pop ebp
cmp eax, 0x202
pop ebx
je 0x4a7ee0
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x4a7ee9
push 0
mov ecx, esi
call fcn.004a7cd0
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x4ba2e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4edc3f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x518a4c]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x28], 1
call fcn.004d1aea
mov esi, dword [esp + 0x30]
add esp, 0x14
lea eax, [esp + 4]
mov ecx, esi
push eax
call fcn.004d804c
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004d82d7
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4d415d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x4d417f
cmp dword [edi + 0x3c], 0
jne 0x4d417f
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.004de47b
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.004d41ac
pop edi
pop esi
pop ebx
ret 8

Function at 0x4d5815
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4d584d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004d877e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004d8756
jmp 0x4d5859
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d585d
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x527750
mov ecx, edi
call fcn.004d8460
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x4d58b0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4d58c3
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.004d877e
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.004d8756
jmp 0x4d58c3
mov ecx, esi
call fcn.004d77d5
test eax, eax
je 0x4d58c3
push edi
mov ecx, eax
call fcn.004d5815
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x4d70cb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d710d
call fcn.004de47b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d710d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d7104
xor eax, eax
jmp 0x4d7115
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d711b
pop edi
pop esi
pop ebx
ret 4
Function at 0x4decd2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4ded00
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ded1e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004dec38
jmp 0x4ded1e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ded1e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004dec38
test edi, edi
mov eax, edi
jne 0x4ded08
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x4df622
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.004de47b
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4df65f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4df65f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4df663
xor eax, eax
jmp 0x4df6e1
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.004d94ba
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x4df69b
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x4df685
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.004df7d2
push ebx
mov edi, eax
call fcn.004d94e3
test edi, edi
pop ecx
je 0x4df6dd
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.004df59b
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.004df6e6
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x4e1f5c
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x4e1f84
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x4e1f95
push 2
call edi
test ax, ax
jge 0x4e1f95
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.004d4e04
cmp dword [esi + 0x30], ebx
jne 0x4e206f
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.004d4e04
cmp eax, dword [esp + 0x34]
jne 0x4e206f
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x4e200b
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x4e2050
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x4e206f
cmp eax, 0x205
je 0x4e206f
cmp eax, 0x201
je 0x4e206f
cmp eax, 0x204
je 0x4e206f
cmp eax, ebx
jne 0x4e2036
cmp dword [esp + 0x1c], 0x1b
je 0x4e206f
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x528f2c]
jbe 0x4e2065
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x4e1fc8
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x4264d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00425c26
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00425bdb
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
call dword [ecx]
Function at 0x426f9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb bh, bh
jne 0x426fb7
call fcn.00425bdb
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x427da9
invalid
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00425b87
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x427023
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x42706c
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x427016
call fcn.00425c16
stosb byte es:[edi], al
and bl, al
adc eax, dword [eax - 0x72b5b]
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
fprem
invalid
call dword [esi + eax*8 - 0x7b]
invalid
clc
invalid
dec dword [edi - 0x3a]
test ebx, ebx
clc
invalid
dec dword [ecx - 0x3a]
test esp, ebx
clc
invalid
dec dword [eax - 0x3a]
test ebp, ebx
clc
invalid
call [esi + eax*8 - 0x7b]
fdivp st(0)
invalid
call dword [ecx - 0x3a]
test edi, ebx
clc
invalid
jmp [ebp - 0x3a]
test eax, esp
clc
invalid
dec dword [edi - 0x3a]
test ecx, esp
clc
invalid
call dword [edx - 0x3a]
test edx, esp
clc
invalid
dec dword [ecx - 0x3a]
test ebx, esp
clc
invalid
call [eax - 0x3a]
test esp, esp
clc
invalid
call [esi - 0x3a]
test ebp, esp
clc
invalid
dec dword [ecx - 0x3a]
test esi, esp
clc
invalid
invalid
cmp eax, 0xffeb17e8
dec esi
inc ebx
inc ecx
or byte [ebp - 0x72b7b], 0xff
push eax
call fcn.00425c26
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00425bdb
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.00425c16
outsd dx, dword [esi]
xor esp, eax
jae 0x4270bc
test esi, ebx
clc
invalid
test eax, ebp
clc
invalid
Function at 0x10001130
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x114]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x11c]
lea ecx, [esp + 4]
test eax, eax
push ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
push 0
je 0x10001178
lea edx, [esp + 0x14]
push edx
push 0
jmp 0x1000117f
lea edx, [esp + 0x14]
push 0
push edx
lea eax, [esi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x10001197
pop esi
add esp, 0x10c
ret 0xc
jge 0x100011ab
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
pop esi
add esp, 0x10c
ret 0xc
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x10c
ret 0xc
Function at 0x100023b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
test eax, eax
push edi
mov ebx, ecx
jne 0x100023c7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
mov edi, dword [esp + 0x18]
test edi, edi
ja 0x100023d8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
mov eax, dword [ebx + 0x1c]
push 1
push 0xf
push eax
mov ecx, ebx
call fcn.10001130
test eax, eax
jne 0x100023fa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
xor esi, esi
test edi, edi
jbe 0x1000242f
mov ebp, dword [sym.imp.WS2_32.dll_send]
mov edx, dword [esp + 0x14]
mov ecx, edi
sub ecx, esi
push 0
push ecx
mov ecx, dword [ebx + 0x1c]
lea eax, [esi + edx]
push eax
push ecx
call ebp
test eax, eax
jle 0x100023f1
add esi, eax
mov dword [0x10007434], 0
cmp esi, edi
jb 0x10002406
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8

Function at 0x100024b0
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
push edi
mov dword [esp + 0x10], ecx
ja 0x100024cb
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
mov eax, dword [ecx + 0x1c]
push 0
push 0xf
push eax
call fcn.10001130
test eax, eax
jne 0x100024ec
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov edx, eax
xor ebp, ebp
mov dword [esp + 0x18], edx
test ebx, ebx
jbe 0x1000255d
jmp 0x10002507
mov edx, dword [esp + 0x18]
mov ecx, ebx
xor eax, eax
mov esi, ecx
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, ebx
sub ecx, ebp
push ecx
push edx
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jle 0x100024e2
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push esi
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add ebp, esi
add esp, 0x10
cmp ebp, ebx
mov dword [0x10007434], 0
jb 0x10002503
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 8