joyce8/EMBER2024-capa huggingface dataset:
Function at 0x528740
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, eax
mov eax, dword [edi]
push eax
call ebx
mov ecx, dword [edi + 4]
push ecx
mov esi, eax
call ebx
mov edx, dword [ebp]
push edx
mov edi, eax
call ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 4]
push eax
call ebx
mov ecx, dword [ebp + 8]
push ecx
mov dword [esp + 0x24], eax
call ebx
mov edx, dword [ebp + 0xc]
push edx
mov dword [esp + 0x1c], eax
call ebx
mov dword [esp + 0x14], eax
mov edx, 0x10
xor ecx, ecx
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x20]
mov ebx, edi
shl ebx, 4
add ebx, dword [esp + 0x10]
sub ecx, 0x61c88647
xor eax, ebx
lea ebx, [ecx + edi]
xor eax, ebx
add esi, eax
mov eax, esi
shr eax, 5
add eax, dword [esp + 0x14]
mov ebx, esi
shl ebx, 4
add ebx, dword [esp + 0x18]
sub edx, 1
xor eax, ebx
lea ebx, [ecx + esi]
xor eax, ebx
add edi, eax
test edx, edx
ja 0x528791
push esi
mov esi, dword [sym.imp.WS2_32.dll_htonl]
call esi
mov ebx, dword [esp + 0x24]
push edi
mov dword [ebx], eax
call esi
pop edi
pop esi
pop ebp
mov dword [ebx + 4], eax
pop ebx
add esp, 0xc
ret

Function at 0x528800
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, eax
mov eax, dword [esi]
push edi
push eax
call ebx
mov ecx, dword [esi + 4]
push ecx
mov edi, eax
call ebx
mov edx, dword [ebp]
push edx
mov esi, eax
call ebx
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 4]
push eax
call ebx
mov ecx, dword [ebp + 8]
push ecx
mov dword [esp + 0x18], eax
call ebx
mov edx, dword [ebp + 0xc]
push edx
mov dword [esp + 0x14], eax
call ebx
mov dword [esp + 0x20], eax
mov edx, 0x10
mov ecx, 0xe3779b90
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x20]
mov ebx, edi
shl ebx, 4
add ebx, dword [esp + 0x10]
sub edx, 1
xor eax, ebx
lea ebx, [ecx + edi]
xor eax, ebx
sub esi, eax
mov eax, esi
shr eax, 5
add eax, dword [esp + 0x14]
mov ebx, esi
shl ebx, 4
add ebx, dword [esp + 0x18]
xor eax, ebx
lea ebx, [ecx + esi]
xor eax, ebx
sub edi, eax
add ecx, 0x61c88647
test edx, edx
ja 0x528854
push edi
mov edi, dword [sym.imp.WS2_32.dll_htonl]
call edi
mov ebx, dword [esp + 0x24]
push esi
mov dword [ebx], eax
call edi
pop edi
pop esi
pop ebp
mov dword [ebx + 4], eax
pop ebx
add esp, 0xc
ret
Function at 0x5291f0
Capabilities:
Access peb ldr_data
Get ntdll base address
Reference http user-agent string

Disassembly:
push 0xffffffffffffffff
push 0x5351a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov byte [esi + 0x40], al
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov cl, byte [esp + 0xb]
mov dword [esp + 0x18], edi
mov byte [esi + 0x50], cl
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov byte [esp + 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esi + 0x18]
mov dword [esi + 0x6c], eax
push edx
push str.Mozilla_5.0__Windows__U__Windows_NT_6.1__en_US__AppleWebKit_534.10__KHTML__like_Gecko__Chrome_7.0.536.2_Safari_534.10
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov word [esi + 0x24], di
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
call fcn.005292b0
mov dword [esi + 0x14], eax
lea eax, [esi + 0x60]
push 0x80
push eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov byte [esi + 0x3c], 1
mov byte [esi + 0x3d], 1
call fcn.0052a690
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x52969f
Capabilities:
Parse url

Disassembly:
sub esp, 0x95c
push ebx
mov ebx, dword [esp + 0x968]
push ebp
push esi
mov esi, ecx
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x14]
mov ebp, ecx
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0x3c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x6c], eax
je 0x5296ef
push 0
push 0x61f838
push 0x7eb
call fcn.005229b0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x95c
ret 8
lea ecx, [esp + 0x16c]
lea eax, [esp + 0x6c]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x10]
xor eax, eax
push ecx
push eax
lea edx, [esp + 0x54]
push ebp
push ebx
mov dword [esp + 0x34], pe_nt_image_headers32
mov dword [esp + 0x50], 0x800
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0x20
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x5296e0
mov ecx, esi
call fcn.00529fb0
mov edx, dword [esp + 0x20]
push edx
call fcn.00529340
push ebx
mov dword [esi + 4], eax
call fcn.0052a350
push eax
call fcn.00529340
push ebp
push ebx
mov dword [esi + 8], eax
call fcn.00529390
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esi], eax
mov ax, word [esp + 0x3c]
push edx
mov word [esi + 0x24], ax
mov dword [esi + 0x28], ecx
call fcn.00529340
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x988]
push eax
call fcn.00529340
add esp, 0x1c
mov ecx, esi
mov dword [esi + 0x10], eax
call fcn.00529f70
mov ecx, esi
call fcn.00529650
test eax, eax
je 0x5296e0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x95c
ret 8
Function at 0x402af0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
push eax
xor ebx, ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x4a6368
push reloc.dsound.dll_DirectSoundCreate
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402ce2
mov ax, word [esi + 0x4e598]
cmp ax, bx
jl 0x402b41
cmp ax, 0x64
jge 0x402b41
movsx edx, ax
inc edx
mov dword [esp + 0xc], edx
jmp 0x402b45
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.advapi32.dll_RegSetValueExA]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push ebx
push 0x4a6360
push ecx
call edi
test eax, eax
jne 0x402cd7
mov ax, word [esi + 0x4e5de]
cmp ax, bx
jl 0x402b85
cmp ax, 0xc8
jge 0x402b85
movsx eax, ax
inc eax
mov dword [esp + 0xc], eax
jmp 0x402b89
mov dword [esp + 0xc], ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push ebx
push 0x4a6354
push edx
call edi
test eax, eax
je 0x402bb5
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov ax, word [esi + 0x4e5e0]
cmp ax, bx
jl 0x402bd1
cmp ax, 0xc8
jge 0x402bd1
movsx ecx, ax
inc ecx
mov dword [esp + 0xc], ecx
jmp 0x402bd5
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push ebx
push 0x4a6348
push eax
call edi
test eax, eax
je 0x402c01
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov ax, word [esi + 0x4e5e2]
cmp ax, bx
jl 0x402c1d
cmp ax, 0xc8
jge 0x402c1d
movsx edx, ax
inc edx
mov dword [esp + 0xc], edx
jmp 0x402c21
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push ebx
push 0x4a633c
push ecx
call edi
test eax, eax
jne 0x402cd7
mov ax, word [esi + 0x4e5e4]
cmp ax, bx
jl 0x402c5b
cmp ax, 0xc8
jge 0x402c5b
movsx eax, ax
inc eax
mov dword [esp + 0xc], eax
jmp 0x402c5f
mov dword [esp + 0xc], ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push ebx
push 0x4a6330
push edx
call edi
test eax, eax
je 0x402c8b
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov ax, word [esi + 0x4e5e6]
cmp ax, bx
jl 0x402ca7
cmp ax, 0xc8
jge 0x402ca7
movsx ecx, ax
inc ecx
mov dword [esp + 0xc], ecx
jmp 0x402cab
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push ebx
push 0x4a6324
push eax
call edi
test eax, eax
je 0x402cd7
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4084a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49fe6b
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push eax
lea ecx, [esp + 0x18]
push 0x4a6680
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x14]
push 0
push 0
push 3
push 0
push 0
push connect
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x408595
push edi
push 0
push 0
push 0x14
push ebx
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x14]
push 4
push ecx
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
xor edi, edi
cmp word [esp + 0x4c], di
jle 0x40858d
push ebp
xor ebp, ebp
cmp ebp, dword [esp + 0x10]
jge 0x408583
push 0x54
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x40], 0
je 0x40856b
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x48]
push edx
push edi
lea edx, [esi + 0x6004]
push ecx
push edx
push ebx
mov ecx, eax
call fcn.00488d30
jmp 0x40856d
xor eax, eax
movsx ecx, word [esp + 0x4c]
add ecx, ebp
mov dword [esp + 0x40], 0xffffffff
mov dword [esi + ecx*4 + 0x36078], eax
inc edi
inc ebp
cmp di, word [esp + 0x50]
jl 0x408528
pop ebp
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov ecx, dword [esp + 0x30]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10

Function at 0x4085b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49fe8b
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push eax
lea ecx, [esp + 0x18]
push 0x4a6680
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x14]
push 0
push 0
push 3
push 0
push 0
push connect
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4086a5
push edi
push 0
push 0
push 0x14
push ebx
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x14]
push 4
push ecx
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
xor edi, edi
cmp word [esp + 0x4c], di
jle 0x40869d
push ebp
xor ebp, ebp
cmp ebp, dword [esp + 0x10]
jge 0x408693
push 0x54
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x40], 0
je 0x40867b
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x48]
push edx
push edi
lea edx, [esi + 0x6004]
push ecx
push edx
push ebx
mov ecx, eax
call fcn.00488d30
jmp 0x40867d
xor eax, eax
movsx ecx, word [esp + 0x4c]
add ecx, ebp
mov dword [esp + 0x40], 0xffffffff
mov dword [esi + ecx*4 + 0x498f8], eax
inc edi
inc ebp
cmp di, word [esp + 0x50]
jl 0x408638
pop ebp
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov ecx, dword [esp + 0x30]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10
Function at 0x4086c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49feab
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push eax
lea ecx, [esp + 0x18]
push 0x4a6680
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x14]
push 0
push 0
push 3
push 0
push 0
push connect
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4087b5
push edi
push 0
push 0
push 0x14
push ebx
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x14]
push 4
push ecx
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
xor edi, edi
cmp word [esp + 0x4c], di
jle 0x4087ad
push ebp
xor ebp, ebp
cmp ebp, dword [esp + 0x10]
jge 0x4087a3
push 0x54
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x40], 0
je 0x40878b
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x48]
push edx
push edi
lea edx, [esi + 0x6004]
push ecx
push edx
push ebx
mov ecx, eax
call fcn.00488d30
jmp 0x40878d
xor eax, eax
movsx ecx, word [esp + 0x4c]
add ecx, ebp
mov dword [esp + 0x40], 0xffffffff
mov dword [esi + ecx*4 + 0x4a0c8], eax
inc edi
inc ebp
cmp di, word [esp + 0x50]
jl 0x408748
pop ebp
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov ecx, dword [esp + 0x30]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10
Function at 0x414010
Capabilities:
Get file size

Disassembly:
sub esp, 0x204
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x114]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
movsx eax, byte [esp + 0x218]
push eax
lea ecx, [esp + 0x118]
push 0x4a7024
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
or ecx, 0xffffffff
mov edi, 0x4a7018
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4a7014
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4a7014
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x114]
or ecx, 0xffffffff
push eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
push 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4a700c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
lea eax, [esp + 0x28]
push connect
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp esi, 0xffffffff
mov ebx, eax
je 0x41416f
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [esp + 0x14]
push 0x4a7008
push ecx
call fcn.0049274b
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4141cc
lea edi, [ebx + 1]
push edi
call fcn.00491cd3
mov ecx, edi
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 1
and ecx, 3
push ebx
rep stosb byte es:[edi], al
push esi
call fcn.0049275e
mov ecx, dword [esp + 0x24]
add esp, 0x14
push esi
call fcn.004141e0
push esi
call fcn.00491cc8
push ebp
call fcn.00492564
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret 4
Function at 0x432e60
Capabilities:
Check http status code

Disassembly:
push ebx
mov bx, word [esp + 8]
push esi
push edi
mov di, word [esp + 0x14]
cmp bx, 0x142
mov esi, ecx
jle 0x432ee0
cmp bx, 0x163
jge 0x432ee0
cmp di, 0x1b2
jle 0x432ee0
cmp di, 0x1db
jge 0x432ee0
mov eax, dword [esi + 0x4e4c8]
test eax, eax
je 0x433131
mov eax, dword [esi + 0x4e5fc]
dec eax
je 0x432ec0
dec eax
je 0x432eb4
dec eax
jne 0x432ed1
push 0
push 0
push 0
push 0
push 0x24
jmp 0x432eca
push 0
push 0
push 0
push 0
push 0x25
jmp 0x432eca
push 0
push 0
push 0
push 0
push 0x26
mov ecx, esi
call fcn.00431bf0
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.0043cc00
cmp bx, 0x16a
jle 0x432f28
cmp bx, 0x194
jge 0x432f28
cmp di, 0x1b2
jle 0x432f28
cmp di, 0x1db
jge 0x432f28
push 0
push 0
push 0
push 0
push 0
push 0
push 0xa0b
push 0xfa314dc
mov ecx, esi
call fcn.00404de0
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.0043cc00
cmp bx, 0x19d
jl 0x432f7e
cmp bx, 0x1be
jg 0x432f7e
cmp di, 0x1b2
jle 0x432f7e
cmp di, 0x1db
jge 0x432f7e
lea ecx, [esi + 0x4e298]
call fcn.00491a60
cmp eax, 1
jne 0x432f5e
push eax
mov ecx, esi
call fcn.00432950
jmp 0x432f6f
push 0
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.00431bf0
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.0043cc00
cmp bx, 0x1c5
jl 0x432fd5
cmp bx, 0x1e6
jg 0x432fd5
cmp di, 0x1b2
jle 0x432fd5
cmp di, 0x1db
jge 0x432fd5
lea ecx, [esi + 0x4e2a4]
call fcn.00491a60
cmp eax, 1
jne 0x432fb5
push 2
mov ecx, esi
call fcn.00432950
jmp 0x432fc6
push 0
push 0
push 0
push 0
push 2
mov ecx, esi
call fcn.00431bf0
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.0043cc00
cmp bx, 0x1ea
jl 0x43302c
cmp bx, 0x20a
jg 0x43302c
cmp di, 0x1b2
jle 0x43302c
cmp di, 0x1db
jge 0x43302c
lea ecx, [esi + 0x4e2b0]
call fcn.00491a60
cmp eax, 1
jne 0x43300c
push 3
mov ecx, esi
call fcn.00432950
jmp 0x43301d
push 0
push 0
push 0
push 0
push 3
mov ecx, esi
call fcn.00431bf0
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.0043cc00
cmp bx, 0x20e
jl 0x433083
cmp bx, 0x228
jg 0x433083
cmp di, 0x1b2
jle 0x433083
cmp di, 0x1db
jge 0x433083
lea ecx, [esi + 0x4e340]
call fcn.00491a60
cmp eax, 1
jne 0x433063
push 0xf
mov ecx, esi
call fcn.00432950
jmp 0x433074
push 0
push 0
push 0
push 0
push 0xf
mov ecx, esi
call fcn.00431bf0
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.0043cc00
cmp bx, 0x22c
jl 0x4330da
cmp bx, 0x24b
jg 0x4330da
cmp di, 0x1b2
jle 0x4330da
cmp di, 0x1db
jge 0x4330da
lea ecx, [esi + 0x4e304]
call fcn.00491a60
cmp eax, 1
jne 0x4330ba
push 0xa
mov ecx, esi
call fcn.00432950
jmp 0x4330cb
push 0
push 0
push 0
push 0
push 0xa
mov ecx, esi
call fcn.00431bf0
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.0043cc00
cmp bx, 0x24d
jl 0x433131
cmp bx, 0x26d
jg 0x433131
cmp di, 0x1b2
jle 0x433131
cmp di, 0x1db
jge 0x433131
lea ecx, [esi + 0x4e370]
call fcn.00491a60
cmp eax, 1
jne 0x433111
push 0x13
mov ecx, esi
call fcn.00432950
jmp 0x433122
push 0
push 0
push 0
push 0
push 0x13
mov ecx, esi
call fcn.00431bf0
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.0043cc00
pop edi
pop esi
pop ebx
ret 8
Function at 0x4403c0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4a0b3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ax, word [0x4a7618]
push esi
push edi
push 0
push 0
push 3
mov dword [esp + 0x28], ecx
mov cl, byte [0x4a761a]
push 0
push 0
push connect
push 0x4a7600
mov word [esp + 0x2c], ax
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2b], 0
xor bl, bl
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x18], edi
je 0x440432
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x4a7008
push 0x4a7600
call fcn.0049274b
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
jne 0x44045e
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
lea esi, [edi + 2]
push ebp
push esi
call fcn.00491cd3
mov ecx, esi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
mov dword [esp + 0x28], ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push eax
push 1
push ecx
push ebp
call fcn.0049275e
lea edx, [esp + 0x28]
push edx
push ebp
call fcn.0049290b
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x440587
mov eax, dword [esp + 0x20]
lea ebp, [eax + 0x4cd8c]
mov al, byte [esp + 0x13]
test al, al
je 0x440558
movsx eax, al
dec eax
jne 0x44056a
movsx eax, bl
dec eax
je 0x440508
dec eax
jne 0x44056a
mov edx, dword [ebp]
or ecx, 0xffffffff
xor eax, eax
add edx, 0x19
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xor bl, bl
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [esp + 0x13], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
add ebp, 4
rep movsb byte es:[edi], byte [esi]
jmp 0x44056a
push 0x3c
call fcn.00491cd3
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x30], 0
je 0x44052b
mov ecx, eax
call fcn.0048f990
jmp 0x44052d
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp], eax
lea edx, [eax + 4]
xor eax, eax
mov dword [esp + 0x30], ecx
mov bl, 2
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x44056a
mov edx, dword [edi]
mov ecx, 0x4a75f8
cmp edx, dword [ecx]
jne 0x44056a
mov byte [esp + 0x13], 1
mov bl, 1
lea eax, [esp + 0x14]
push eax
push 0
call fcn.0049290b
mov edi, eax
add esp, 8
test edi, edi
jne 0x4404b6
mov ebp, dword [esp + 0x24]
push ebp
call fcn.00491cc8
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00492564
mov ecx, dword [esp + 0x30]
add esp, 8
mov eax, 1
mov dword fs:[0], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x446860
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
lea eax, [ecx - 9]
cmp eax, 0x88
ja case.0x446879.12
xor edx, edx
mov dl, byte [eax + 0x446a7c]
jmp dword [edx*4 + 0x446a6c]
mov dword [esi + 0x4e280], 1
pop esi
ret 4
mov dword [esi + 0x4e288], 1
pop esi
ret 4
cmp byte [esi + 0x4e830], 4
jne case.default.0x4468c3
mov eax, dword [esi + 0x4e280]
test eax, eax
je 0x4469f6
lea eax, [ecx - 0x30]
cmp eax, 9
ja case.default.0x4468c3
jmp dword [eax*4 + 0x446b08]
push 0
push 0
push 0
push 0
push 3
mov ecx, esi
call fcn.00431bf0
mov word [esi + 0x2fc], 9
pop esi
ret 4
push 0
push 0
push 0
push 0
push 3
mov ecx, esi
call fcn.00431bf0
mov word [esi + 0x2fc], 0
pop esi
ret 4
push 0
push 0
push 0
push 0
push 3
mov ecx, esi
call fcn.00431bf0
mov word [esi + 0x2fc], 1
pop esi
ret 4
push 0
push 0
push 0
push 0
push 3
mov ecx, esi
call fcn.00431bf0
mov word [esi + 0x2fc], 2
pop esi
ret 4
push 0
push 0
push 0
push 0
push 3
mov ecx, esi
call fcn.00431bf0
mov word [esi + 0x2fc], 3
pop esi
ret 4
push 0
push 0
push 0
push 0
push 3
mov ecx, esi
call fcn.00431bf0
mov word [esi + 0x2fc], 4
pop esi
ret 4
push 0
push 0
push 0
push 0
push 3
mov ecx, esi
call fcn.00431bf0
mov word [esi + 0x2fc], 5
pop esi
ret 4
push 0
push 0
push 0
push 0
push 3
mov ecx, esi
call fcn.00431bf0
mov word [esi + 0x2fc], 6
pop esi
ret 4
push 0
push 0
push 0
push 0
push 3
mov ecx, esi
call fcn.00431bf0
mov word [esi + 0x2fc], 7
pop esi
ret 4
push 0
push 0
push 0
push 0
push 3
mov ecx, esi
call fcn.00431bf0
mov word [esi + 0x2fc], 8
pop esi
ret 4
mov eax, dword [esi + 0x4e4d8]
test eax, eax
jne case.default.0x4468c3
push 0x12
call dword [sym.imp.user32.dll_GetAsyncKeyState]
and eax, 0xffff8000
test ax, ax
jne case.default.0x4468c3
lea eax, [esi + 0x4ea6c]
mov dword [esi + 0x4e4d8], 1
mov dword [esi + 0x4dd30], eax
lea eax, [esi + 0x4e75f]
mov dword [esi + 0x4e5cc], 0xa
mov dword [esi + 0x4e5d0], 0x19e
mov dword [eax], 0
mov byte [esi + 0x4e75e], 0x40
mov esi, dword [esi + 0x4dd30]
test esi, esi
je 0x446a5f
mov dword [esi], 0
mov dword [eax], 0
pop esi
ret 4