joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53ce60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x59d1a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0
call fcn.0053b6e0
mov ecx, eax
call fcn.0053afe0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x53cfb9
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x18], 0x45
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x18], 0x57
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x18], 0x6f
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x69
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x18], 0x65
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x18], 0x6e
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x18], 0x74
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x18], 0x48
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x18], 0x78
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x18], 0x77
mov eax, 1
imul ecx, eax, 0x11
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0x12
jae 0x53cf24
jmp 0x53cf29
call fcn.005217d1
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x18], 0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x18], 0x53
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x18], 0x6f
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x18], 0x6b
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x18], 0x6f
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x18], 0x57
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x18], 0x64
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x73
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x53cfb9
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052154a
mov esp, ebp
pop ebp
ret
Function at 0x53cfd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x59d1a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0
call fcn.0053b6e0
mov ecx, eax
call fcn.0053afe0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x53d137
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x64
mov edx, 1
imul eax, edx, 0x13
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x14
jae 0x53d020
jmp 0x53d025
call fcn.005217d1
mov ecx, dword [ebp - 0x24]
mov byte [ebp + ecx - 0x18], 0
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x18], 0x6e
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x18], 0x6f
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x6f
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x18], 0x6f
mov edx, 1
imul eax, edx, 0x11
mov byte [ebp + eax - 0x18], 0x45
mov ecx, 1
shl ecx, 4
mov byte [ebp + ecx - 0x18], 0x6b
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x18], 0x6b
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx - 0x18], 0x6f
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x18], 0x48
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x18], 0x57
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x18], 0x68
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x18], 0x77
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x18], 0x55
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x18], 0x73
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x18], 0x69
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x18], 0x6f
mov eax, 1
imul ecx, eax, 0x12
mov byte [ebp + ecx - 0x18], 0x78
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x18], 0x6e
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x53d137
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052154a
mov esp, ebp
pop ebp
ret
Function at 0x53d150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x59d1a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
call fcn.0053b6e0
mov ecx, eax
call fcn.0053afe0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x53d253
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x10], 0x69
mov edx, 1
imul eax, edx, 0xb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xc
jae 0x53d1a0
jmp 0x53d1a5
call fcn.005217d1
mov ecx, dword [ebp - 0x1c]
mov byte [ebp + ecx - 0x10], 0
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x10], 0x46
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x10], 0x57
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x10], 0x64
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x10], 0x6f
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x10], 0x6e
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x10], 0x77
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x10], 0x57
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x10], 0x6e
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x10], 0x64
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x10], 0x69
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x53d253
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052154a
mov esp, ebp
pop ebp
ret
Function at 0x53d270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x59d1a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
call fcn.0053b6e0
mov ecx, eax
call fcn.0053afe0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x53d388
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x14], 0x73
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x14], 0x67
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x14], 0x61
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x14], 0x73
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x14], 0x74
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x14], 0x65
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x14], 0x73
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x14], 0x65
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x14], 0x57
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x14], 0x50
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x14], 0x6f
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x14], 0x4d
mov edx, 1
imul eax, edx, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xd
jae 0x53d34e
jmp 0x53d353
call fcn.005217d1
mov ecx, dword [ebp - 0x20]
mov byte [ebp + ecx - 0x14], 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x53d388
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052154a
mov esp, ebp
pop ebp
ret
Function at 0x885058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8851a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x88507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88506a
add dl, dl
jne 0x885089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8850dc
xor eax, eax
add dl, dl
jne 0x885096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88517d
add dl, dl
jne 0x8850a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8850b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8850bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8850c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8850d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x885075
mov eax, 1
add dl, dl
jne 0x8850ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8850f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8850e1
sub eax, ebx
mov ebx, 1
jne 0x885128
mov ecx, 1
add dl, dl
jne 0x88510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x885119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x885105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x885075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x885136
cmp eax, 0x7d00
jae 0x88516d
cmp eax, 0x500
jb 0x885168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x885075
cmp eax, 0x7f
ja 0x885170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x885075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x88519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x885075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4014c8
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4014da
mov eax, dword [0x4e408b]
shl eax, 2
mov dword [0x4e408f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004c40c8
pop edx
call fcn.004c402c
call fcn.004c4108
push 0
call fcn.004c554c
pop ecx
push 0x4e4034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4e4093], eax
push 0
jmp fcn.004cb030
Function at 0x42c85c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42c998
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x42c9b0
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0042df68
mov eax, dword [ebp - 4]
call fcn.0042d7f8
xor edx, edx
push ebp
push 0x42c97b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
jne 0x42c91a
test si, si
jne 0x42c8cc
mov eax, dword [ebp - 8]
call fcn.004b1524
mov esi, eax
cmp esi, 0xffff
jbe 0x42c8cc
call fcn.004c0a00
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10290]
push eax
call sub.WSOCK32.DLL_send
test eax, eax
je 0x42c91a
cmp eax, 0xffffffff
jle 0x42c8fb
sub ebx, eax
jmp 0x42c90a
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0042de9c
test ebx, ebx
je 0x42c91a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
je 0x42c8cf
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
je 0x42c965
mov eax, dword [ebp - 4]
mov byte [eax + 0x10090], 0
mov ecx, 0x42c9c8
mov dl, 1
mov eax, dword [0x42bff8]
call fcn.004b34d8
call fcn.004c126c
mov eax, dword [ebp - 4]
cmp word [eax + 0x1028a], 0
je 0x42c965
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1028c]
call dword [ebx + 0x10288]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c982
mov eax, dword [ebp - 4]
call fcn.0042d850
ret
Function at 0x42cec8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004c1aac
xor eax, eax
push ebp
push 0x42d090
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x42d0a8
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.0042df68
push 0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4a1aac]
call fcn.004a66cc
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x42d020
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
jne 0x42cfdb
mov eax, dword [ebp - 4]
lea edx, [eax + 0x30]
mov ecx, 0x10000
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
push 0
push ebx
mov eax, dword [ebp - 0x10]
sub eax, ebx
cmp eax, 0x10000
jbe 0x42cf5f
call fcn.004c0a00
mov edx, dword [ebp - 4]
lea eax, [edx + eax + 0x30]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10290]
push eax
call sub.WSOCK32.DLL_send
test eax, eax
je 0x42cfdb
cmp eax, 0xffffffff
jle 0x42cfac
sub ebx, eax
mov edx, dword [ebp - 4]
add dword [edx + 0x1008c], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x100ca], 0
je 0x42cfbb
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x100cc]
call dword [esi + 0x100c8]
jmp 0x42cfbb
lea ecx, [ebp - 0x14]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0042de9c
mov eax, dword [0x4f5230]
mov eax, dword [eax]
call fcn.0045fbdc
test ebx, ebx
je 0x42cfdb
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
je 0x42cf4b
mov eax, dword [ebp - 0xc]
call fcn.004a61b0
push edx
push eax
mov eax, dword [ebp - 0xc]
call fcn.004a61e4
cmp edx, dword [esp + 4]
jne 0x42cff6
cmp eax, dword [esp]
pop edx
pop eax
je 0x42d00a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
je 0x42cf22
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d027
mov eax, dword [ebp - 0xc]
call fcn.004c0ac0
ret
Function at 0x42d0d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004c1aac
xor eax, eax
push ebp
push 0x42d2a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x42d2bc
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.0042df68
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100bc], edx
mov eax, dword [ebp - 4]
call fcn.0042d7f8
xor eax, eax
push ebp
push 0x42d281
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4a1aac]
call fcn.004a66cc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42d219
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x42d1f3
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x30
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10290]
push eax
call sub.WSOCK32.DLL_recv
mov ebx, eax
test ebx, ebx
jle 0x42d1b7
mov eax, dword [ebp - 4]
lea edx, [eax + 0x30]
mov ecx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004a6414
mov eax, dword [ebp - 4]
add dword [eax + 0x100bc], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100c2], 0
je 0x42d1af
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x100c4]
call dword [esi + 0x100c0]
mov eax, dword [ebp - 4]
call fcn.0042d7f8
cmp ebx, 0xffffffff
jne 0x42d1e3
call sub.WSOCK32.DLL_WSAGetLastError
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10094], esi
cmp esi, 0x2749
je 0x42d203
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0042de9c
test ebx, ebx
je 0x42d203
mov eax, dword [0x4f5230]
mov eax, dword [eax]
call fcn.0045fbdc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
je 0x42d153
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d220
mov eax, dword [ebp - 0xc]
call fcn.004c0ac0
ret
Function at 0x42d2e4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42d4b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x42d4d0
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.0042df68
mov eax, esi
call fcn.004c160c
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100bc], edx
mov eax, dword [ebp - 4]
call fcn.0042d7f8
xor eax, eax
push ebp
push 0x42d49c
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x42d415
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x30
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10290]
push eax
call sub.WSOCK32.DLL_recv
mov ebx, eax
test ebx, ebx
je 0x42d43b
cmp ebx, 1
jle 0x42d3df
mov eax, dword [esi]
call fcn.004c18c4
mov edi, eax
lea edx, [edi + ebx]
mov eax, esi
call fcn.004c1c48
mov eax, esi
call fcn.004c1b14
inc edi
dec edi
test eax, eax
je 0x42d396
cmp edi, dword [eax - 4]
jb 0x42d39b
call fcn.004c0a00
inc edi
lea edx, [eax + edi - 1]
mov eax, dword [ebp - 4]
add eax, 0x30
mov ecx, ebx
call fcn.004bfcf4
mov eax, dword [ebp - 4]
add dword [eax + 0x100bc], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100c2], 0
je 0x42d3d5
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x100c4]
call dword [ebx + 0x100c0]
mov eax, dword [ebp - 4]
call fcn.0042d7f8
jmp 0x42d409
inc ebx
jne 0x42d409
call sub.WSOCK32.DLL_WSAGetLastError
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10094], ebx
cmp ebx, 0x2749
je 0x42d43b
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0042de9c
mov eax, dword [0x4f5230]
mov eax, dword [eax]
call fcn.0045fbdc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
jne 0x42d43b
cmp dword [ebp - 8], 0xffffffff
je 0x42d344
mov eax, dword [esi]
call fcn.004c18c4
cmp eax, dword [ebp - 8]
jl 0x42d344
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
je 0x42d486
mov eax, dword [ebp - 4]
mov byte [eax + 0x10090], 0
mov ecx, 0x42d4e8
mov dl, 1
mov eax, dword [0x42bff8]
call fcn.004b34d8
call fcn.004c126c
mov eax, dword [ebp - 4]
cmp word [eax + 0x1028a], 0
je 0x42d486
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1028c]
call dword [ebx + 0x10288]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d4a3
mov eax, dword [ebp - 4]
call fcn.0042d850
ret
Function at 0x42dda4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x42de70
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x42de84
mov dl, 4
mov eax, ebx
call fcn.0042df68
mov byte [ebx + 0x10298], 0
mov si, word [ebx + 0x10290]
cmp si, 0xffff
je 0x42de5a
movzx eax, si
push eax
call sub.WSOCK32.DLL_closesocket
test eax, eax
jne 0x42de4c
test byte [ebx + 0x1c], 8
jne 0x42de09
cmp word [ebx + 0x10052], 0
je 0x42de09
mov edx, ebx
mov eax, dword [ebx + 0x10054]
call dword [ebx + 0x10050]
cmp byte [ebx + 0x10091], 0
jne 0x42de5a
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x42de2c
call fcn.004c0a00
mov word [ebx + 0x10290], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x10294]
push eax
movzx eax, si
push eax
call sub.WSOCK32.DLL_WSAAsyncSelect
jmp 0x42de5a
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.0042de9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42de77
lea eax, [ebp - 4]
call fcn.004c160c
ret

Function at 0x42e010
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x42e04c
mov dl, 8
mov eax, ebx
call fcn.0042df68
push 2
push 1
lea eax, [ebx + 0x30]
push eax
movzx eax, word [ebx + 0x10290]
push eax
call sub.WSOCK32.DLL_recv
test eax, eax
jle 0x42e03e
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x42e05c
Capabilities:
Set socket configuration

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x42e1ec
mov dl, 8
mov eax, ebx
call fcn.0042df68
cmp dword [ebx + 0x100a4], 0
jne 0x42e092
lea eax, [ebx + 0x30]
mov edx, dword [ebx + 0x10274]
call fcn.004b15bc
push eax
call sub.WSOCK32.DLL_inet_addr
mov dword [ebx + 0x10268], eax
jmp 0x42e0ac
lea eax, [ebx + 0x30]
mov edx, dword [ebx + 0x100a4]
call fcn.004b15bc
push eax
call sub.WSOCK32.DLL_inet_addr
mov dword [ebx + 0x10268], eax
cmp dword [ebx + 0x10268], 0xffffffff
jne 0x42e1e2
xor eax, eax
mov dword [ebx + 0x10268], eax
mov eax, ebx
call fcn.0042d7f8
mov byte [ebx + 0x100d0], 0
push 0x400
mov eax, dword [ebx + 0x10278]
push eax
lea eax, [ebx + 0x30]
push eax
push 0x466
mov eax, dword [ebx + 0x10294]
push eax
call sub.WSOCK32.DLL_WSAAsyncGetHostByName
push 2
call sub.KERNEL32.DLL_Sleep
mov eax, dword [0x4f5230]
mov eax, dword [eax]
call fcn.0045fbdc
cmp byte [ebx + 0x100d0], 0
jne 0x42e11e
cmp byte [ebx + 0x100b1], 0
jne 0x42e11e
cmp byte [ebx + 0x10090], 0
je 0x42e0f0
mov eax, ebx
call fcn.0042d850
cmp byte [ebx + 0x100b1], 0
je 0x42e144
mov ecx, 0x42e204
mov dl, 1
mov eax, dword [0x42bfa0]
call fcn.004b34d8
call fcn.004c126c
cmp byte [ebx + 0x10090], 0
je 0x42e163
mov ecx, 0x42e224
mov dl, 1
mov eax, dword [0x42bfa0]
call fcn.004b34d8
call fcn.004c126c
cmp byte [ebx + 0x100b0], 0
jne 0x42e182
mov ecx, 0x42e244
mov dl, 1
mov eax, dword [0x42bfa0]
call fcn.004b34d8
call fcn.004c126c
lea eax, [ebx + 0x10268]
mov edx, dword [ebx + 0x10278]
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx]
mov byte [eax], dl
mov edx, dword [ebx + 0x10278]
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx + 1]
mov byte [eax + 1], dl
mov edx, dword [ebx + 0x10278]
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx + 2]
mov byte [eax + 2], dl
mov edx, dword [ebx + 0x10278]
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx + 3]
mov byte [eax + 3], dl
cmp word [ebx + 0x1006a], 0
je 0x42e1e2
mov edx, ebx
mov eax, dword [ebx + 0x1006c]
call dword [ebx + 0x10068]
pop ebx
ret

Function at 0x431c08
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x431b54
call sub.USER32.DLL_EnumWindows
ret

Function at 0x431d2c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x431da9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00431778
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
push 0
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x431d51
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004313d0
cmp dword [ebp - 4], 0
je 0x431d93
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004c1abc
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.USER32.DLL_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431db0
lea eax, [ebp - 4]
call fcn.004c160c
ret
Function at 0x443004
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004c160c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x443053
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.004c1874
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44b210
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x44b216
ret

Function at 0x44d820
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x44d871
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x44d858
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x44d848
jmp 0x44d871
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x44d859
pop ebx
mov esp, ebp
pop ebp
ret