joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0658
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00450b80
xor eax, eax
push ebp
push 0x4b07ed
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x4b07bb
xor edx, edx
push ebp
push 0x4b07b4
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00450bec
mov eax, dword [ebp - 8]
test eax, eax
je 0x4b06c7
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4b06c7
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00450370
test eax, eax
je 0x4b06d0
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4b0789
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x4b0778
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00450bec
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4b0732
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4b0732
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.00450370
test eax, eax
je 0x4b073b
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.00450c24
lea ecx, [esi + 2]
mov edx, ebx
call fcn.0044e578
call sub.USER32.DLL_EmptyClipboard
mov eax, dword [ebp - 0x10]
push eax
push 0xd
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b077f
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
mov ecx, dword [0x504b30]
mov dl, 1
mov eax, dword [0x431bac]
call fcn.0043bd94
call fcn.0044facc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b07f4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00450b90
ret
Function at 0x4be128
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x509f9c], 0
je 0x4be269
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x504898]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x4be269
mov eax, dword [0x509fa0]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x509f9c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4be238
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x509f9c]
call fcn.0041a50c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4be230
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1ea], 0
je 0x4be230
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x4be230
mov eax, dword [ebp - 0x14]
call fcn.004c9b0c
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x4be230
push ebp
call fcn.004be0e4
pop ecx
test al, al
jne 0x4be230
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.0044f280
test al, al
je 0x4be230
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.0044f280
cmp byte [ebp - 1], 0
je 0x4be230
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.00430484
test al, al
je 0x4be230
mov edx, dword [ebp - 0x14]
mov eax, dword [0x509fa0]
call fcn.004bd83c
inc edi
dec ebx
jne 0x4be18d
mov eax, dword [0x509fa0]
cmp dword [eax + 8], 0
jle 0x4be250
mov eax, dword [0x509fa0]
call fcn.004bd8f4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4be269
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004bdf48
pop ecx
test al, al
jne 0x4be269
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c66b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.USER32.DLL_GetMessagePos
call fcn.0043046c
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.004c06f0
test ebx, ebx
jne 0x4c670b
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.004c6534
mov ebx, eax
test ebx, ebx
je 0x4c6801
cmp esi, ebx
je 0x4c6734
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4c6749
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x4c6781
add eax, 0xffffff5f
sub eax, 2
jb 0x4c6799
dec eax
sub eax, 2
jb 0x4c67ad
dec eax
sub eax, 2
jb 0x4c67a3
jmp 0x4c67b7
add eax, 0xfffffdff
sub eax, 2
jb 0x4c6799
dec eax
sub eax, 2
jb 0x4c67ad
dec eax
sub eax, 2
jb 0x4c67a3
jmp 0x4c67b7
mov byte [esp + 0x120], 0
jmp 0x4c67bf
mov byte [esp + 0x120], 2
jmp 0x4c67bf
mov byte [esp + 0x120], 1
jmp 0x4c67bf
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.USER32.DLL_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0049ae6c
mov esi, eax
call fcn.004bcf28
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.004c20b0
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x4c6803
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x4ebf44
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4ebf60
call fcn.004ed53c
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4ebf7f
test bl, 1
je 0x4ebf7f
call fcn.004f3be4
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4ec160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004ed0b8
test byte [ebp + 0xd], 0xc0
jne 0x4ec184
mov eax, dword [0x502368]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4ec191
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4ec1be
je 0x4ec1d0
sub ecx, 0x100
je 0x4ec1e2
sub ecx, 0x100
je 0x4ec1eb
sub ecx, 0x100
je 0x4ec1d9
jmp 0x4ec1f4
sub ecx, 0x600
je 0x4ec1eb
sub ecx, 0x100
je 0x4ec1d0
jmp 0x4ec1f4
mov dword [ebp - 8], 1
jmp 0x4ec1fb
mov dword [ebp - 8], 2
jmp 0x4ec1fb
mov dword [ebp - 8], 4
jmp 0x4ec1fb
mov dword [ebp - 8], 5
jmp 0x4ec1fb
mov dword [ebp - 8], 3
test byte [ebp + 0xd], 1
je 0x4ec222
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x501de0]
test al, 0x80
je 0x4ec21b
mov ebx, 0x80
jmp 0x4ec234
mov ebx, 1
jmp 0x4ec234
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4ec234
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4ec246
je 0x4ec24f
dec eax
je 0x4ec258
jmp 0x4ec261
mov dword [ebp - 4], SysStringLen
jmp 0x4ec270
mov dword [ebp - 4], 0x40000000
jmp 0x4ec270
mov dword [ebp - 4], 0xc0000000
jmp 0x4ec270
push 1
call fcn.004ed4d0
pop ecx
mov ebx, eax
jmp 0x4ec370
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4ec28c
sub eax, 0x10
je 0x4ec290
sub eax, 0x10
je 0x4ec297
sub eax, 0x10
je 0x4ec29e
jmp 0x4ec29e
xor edi, edi
jmp 0x4ec2a3
mov edi, 1
jmp 0x4ec2a3
mov edi, 2
jmp 0x4ec2a3
mov edi, 3
test byte [ebp + 0xc], 4
je 0x4ec2bb
cmp dword [ebp - 4], 0x80000000
jne 0x4ec2b9
mov edi, 1
jmp 0x4ec2bb
xor edi, edi
mov dword [ebp - 0x14], 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
and edx, 0x80
cmp edx, 1
sbb ecx, ecx
neg ecx
mov dword [ebp - 0xc], ecx
push 0
push ebx
mov ecx, dword [ebp - 8]
push ecx
lea eax, [ebp - 0x14]
push eax
push edi
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4ec329
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4ec31e
test byte [ebp + 0xd], 1
je 0x4ec319
mov ebx, 0x50
jmp 0x4ec31e
mov ebx, 2
push ebx
call fcn.004ed4d0
pop ecx
mov ebx, eax
jmp 0x4ec370
mov edi, esi
push edi
call fcn.004ec0c4
pop ecx
test eax, eax
je 0x4ec33d
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4ec349
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004ed1f8
add esp, 8
mov ebx, eax
inc eax
jne 0x4ec370
push 4
call fcn.004ed4d0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004ed0ec
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f0388
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004eacf8
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
call fcn.004eada8
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004eada8
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x50301d
lea ecx, [ebp - 0x200]
push ecx
call fcn.004eacf8
add esp, 8
push 0xa
lea ecx, [ebp - 0x200]
push ecx
call fcn.004eada8
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov eax, dword [ebx]
push eax
call fcn.004f1828
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4f0499
push esi
call fcn.004eada8
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004eada8
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.004e9f74
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4f0470
xor eax, eax
jmp 0x4f0520
push esi
call fcn.004eada8
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004eada8
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004eac27
add esp, 0xc
jmp 0x4f04d9
mov edi, dword [ebx + 0x24]
push edi
call fcn.004eada8
pop ecx
push eax
push esi
call fcn.004eada8
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004eada8
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004e9f94
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4f04d9
xor eax, eax
jmp 0x4f0520
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004eacf8
add esp, 8
push 0x50301f
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004eacf8
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call fcn.004eacf8
add esp, 8
push 0x503021
mov edx, dword [ebx + 0x24]
push edx
call fcn.004eacf8
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f3b78
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x4f3ba5
jmp 0x4f3bdc
call fcn.004f3b28
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004eada8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004eada8
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4f3c60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x50365c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4f3d3a
cmp dword [0x503658], 0
jne 0x4f3d3a
cmp dword [0x503858], 0
je 0x4f3cf4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004f3630
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4f3cda
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004f3630
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4f3cda
lea ebx, [ebp - 0x84]
jmp 0x4f3cdb
inc ebx
call fcn.004f3c18
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4f3d75
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x503660
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004eada8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x503663
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4f3d75
cmp dword [0x503658], 0
je 0x4f3d54
cmp dword [0x503658], 0xffffffff
je 0x4f3d75
push esi
call dword [0x503658]
pop ecx
mov eax, dword [0x50365c]
test eax, eax
je 0x4f3d75
cmp dword [0x50365c], 0xffffffff
je 0x4f3d75
cmp byte [eax], 0
je 0x4f3d75
push esi
push eax
call fcn.004f3b78
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f460c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x50ad00], 0
jne 0x4f468d
cmp dword [0x50ad20], 0
jne 0x4f463c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x50ad20], eax
test eax, eax
jne 0x4f463c
push str.GetEnvironmentStrings_failed
call fcn.004f3d8c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x50ad20]
jmp 0x4f4650
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004eada8
pop ecx
mov edi, eax
test eax, eax
jne 0x4f4648
lea edi, [ebp + 1]
push edi
call fcn.004e9f74
pop ecx
mov ebx, eax
mov dword [0x50ad04], ebx
test ebx, ebx
jne 0x4f467a
xor eax, eax
jmp 0x4f4750
push edi
mov edx, dword [0x50ad20]
push edx
push ebx
call fcn.004eaa40
add esp, 0xc
jmp 0x4f46ad
xor esi, esi
mov ebx, dword [0x50ad00]
jmp 0x4f46a7
push eax
call fcn.004eada8
pop ecx
test eax, eax
jne 0x4f46a3
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4f4697
lea ebx, [esi + 4]
push 4
mov dword [0x50ad08], ebx
inc ebx
push ebx
call fcn.004e9ed8
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4f46d0
xor eax, eax
jmp 0x4f4750
cmp dword [0x50ad00], 0
jne 0x4f4701
xor esi, esi
mov ebx, dword [0x50ad04]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4f46f2
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004eada8
pop ecx
mov edi, eax
test eax, eax
jne 0x4f46e8
jmp 0x4f4732
xor esi, esi
mov ebx, dword [0x50ad00]
mov eax, dword [esp]
mov edi, eax
jmp 0x4f472c
push eax
call fcn.004eada8
pop ecx
test eax, eax
je 0x4f4721
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4f4725
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4f4710
mov eax, dword [0x50ad00]
test eax, eax
je 0x4f4742
push eax
call fcn.004e9f84
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x50ad00], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x466e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4d4008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4d6ee0
xor edx, edx
push esi
mov ecx, eax
push edi
mov edi, dword [ebp + 8]
cmp ecx, fcn.00466e70
je 0x466eab
cmp dword [eax], 0x2f2a2a2f
je 0x466ea8
dec eax
cmp eax, fcn.00466e70
jne 0x466e96
jmp 0x466eab
lea edx, [eax + 4]
mov ecx, dword [edx]
movq xmm0, qword [edx + 4]
xor ecx, 0xfefefdfc
mov eax, dword [edx + 0xc]
mov esi, ecx
shr esi, 0x10
mov word [ebp - 0x18], si
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], eax
cmp si, cx
je 0x466ee3
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470463
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x18]
xor edx, edx
mov byte [ebp - 0x11], al
shr esi, 8
push ebx
mov ebx, 0xc
mov eax, esi
div ebx
lea eax, [esi + 1]
movzx ecx, byte [ebp + edx - 0x10]
xor edx, edx
div ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x10]
xor edx, edx
or ecx, eax
lea eax, [esi + 2]
div ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x10]
xor edx, edx
or ecx, eax
lea eax, [esi + 3]
div ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x10]
or ecx, eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ebx, 0x19810419
mov cl, byte [ebp - 0x11]
rol eax, cl
mov ecx, 4
xor al, bl
ror eax, 8
ror ebx, 8
loop 0x466f45
mov bl, al
rol eax, 8
mov bh, al
mov al, bl
ror eax, 8
mov al, bh
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
pop ebx
mov dword [edi], eax
xor ecx, ebp
pop edi
mov eax, 1
pop esi
call fcn.00470463
mov esp, ebp
pop ebp
ret
Function at 0x468d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4d4008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x877ed8], 0
je 0x468f07
push str.access.dat
push 0x4d72f8
lea eax, [ebp - 0x108]
push str._s_s
push eax
call dword [0x4b528c]
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [0x4b5060]
mov dword [ebp - 0x114], eax
cmp eax, 0xffffffff
je 0x468f07
push 0
push dword [edi + 0x877ed8]
call dword [sym.imp.PAL.dll_PalListGetDataCount]
add esp, 8
test eax, eax
je 0x468ee4
mov esi, eax
shl esi, 5
add esi, eax
push 0
push esi
call dword [sym.imp.PAL.dll_PalMemoryAlloc]
mov ebx, eax
add esp, 8
mov dword [ebp - 0x10c], ebx
test ebx, ebx
je 0x468f07
push 0
push dword [edi + 0x877ed8]
call dword [sym.imp.PAL.dll_PalListFind]
mov edi, eax
add esp, 8
test edi, edi
je 0x468e62
push 0
push 0
push edi
call dword [sym.imp.PAL.dll_PalListGetData]
push 0x21
push eax
push ebx
call fcn.0047a5c0
push edi
add ebx, 0x21
call dword [sym.imp.PAL.dll_PalListFindNext]
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x468e35
mov ebx, dword [ebp - 0x10c]
mov ecx, esi
mov dword [ebp - 0x110], esi
and ecx, 3
je 0x468e79
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x110], eax
mov edi, dword [ebp - 0x10c]
mov cl, 4
mov edx, dword [ebp - 0x110]
mov eax, 0xff987dee
xor dword [edi], eax
mov eax, 0x84df873
xor dword [edi], eax
ror byte [edi], cl
add edi, 4
add cl, 1
and cl, 0xff
sub edx, 4
jne 0x468e87
push 0
lea eax, [ebp - 0x118]
push eax
push esi
mov esi, dword [ebp - 0x114]
push ebx
push esi
call dword [0x4b518c]
push ebx
call dword [sym.imp.PAL.dll_PalMemoryFree]
add esp, 4
push esi
call dword [0x4b5188]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470463
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x114]
push esi
call dword [0x4b5188]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470463
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00470463
mov esp, ebp
pop ebp
ret

Function at 0x46e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], 0x84df873
mov dword [ebp - 0x14], 0xff987dee
and eax, 3
je 0x46e9da
sub edx, eax
mov dword [ebp - 8], edx
push edi
mov edi, dword [ebp - 0xc]
mov cl, byte [ebp - 4]
mov edx, dword [ebp - 8]
rol byte [edi], cl
add cl, 1
and cl, 0xff
mov eax, dword [ebp - 0x10]
xor dword [edi], eax
mov eax, dword [ebp - 0x14]
xor dword [edi], eax
add edi, 4
sub edx, 4
jne 0x46e9e4
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00406dc2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00406dc2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00406dc2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00406dc2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00406dc2
mov dword [0x41203c], eax
call fcn.00406dc2
test eax, eax
jge 0x402550
push 8
call fcn.00406dc2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00406dc2
pop ecx
push 1
call fcn.00406dc2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00406dc2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00406dc2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00406dc2
jmp 0x402495

Function at 0x406dc2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x406dd1
pop dword [ebp - 0x3c]
mov eax, 0x406dd1
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x36971
push 0
mov eax, 0x160cdcb1
add eax, 0xea340427
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x21a792a9
add ecx, 0xde58aa85
mov esi, eax
mov edi, 0x44bbf50c
add edi, 0xbb8546b8
add edi, dword [ebp - 0x3c]
mov edx, 0x11c38842
xor dword [ebp - 0x2c], edi
mov ebx, dword [edi]
add dword [ebp - 0x38], 0x1b02c380
sub ebx, edx
add dword [ebp - 0x30], 0x4a0556c7
mov dword [esi], ebx
sub dword [ebp - 4], ecx
add esi, 0x29738822
sub esi, 0x2973881e
add edi, 0xc343e95a
add edi, 0x3cbc16aa
loop 0x406e25
add eax, 0x77f77ba4
add eax, 0x88096be7
xor ebx, ebx
add ebx, eax
add eax, 0xb5596096
add eax, 0x4aa69f6f
mov ecx, 0xd62c2f45
sub ecx, 0xd5ec2f45
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10002aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [eax + 0x70], 0
mov dword [eax + 0x4c], ecx
jne 0x10002ab3
mov dword [eax + 0x70], 1
mov dword [eax + 0x54], ecx
mov edx, ecx
sub edx, dword [eax + 0x54]
cmp edx, 0x2710
jge 0x10002ac8
cmp edx, 0xffffd8f0
jge 0x10002acd
mov dword [eax + 0x54], ecx
jmp 0x10002ad1
test edx, edx
js 0x10002aec
mov edx, dword [eax + 0x50]
add dword [eax + 0x54], edx
push esi
push edi
mov edi, ecx
sub edi, dword [eax + 0x54]
pop edi
pop esi
js 0x10002ae7
add edx, ecx
mov dword [eax + 0x54], edx
jmp fcn.100024b0
ret

Function at 0x10002c60
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x1002c61c]
xor eax, esp
mov dword [esp + 0x198], eax
push edi
xor edi, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi], vtable.CTcpSocket.0
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, vtable.CBuffer.0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], eax
lea eax, [esp + 8]
push eax
push 0x202
mov dword [esi + 0x58], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
lea ecx, [esi + 0x18]
push ecx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x19c]
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x14], edi
pop edi
xor ecx, esp
mov dword [esi + 0x64], 0xffffffff
mov eax, esi
call fcn.1000d867
mov esp, ebp
pop ebp
ret