joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dfc8
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x44dff9
mov ecx, dword [0x484e58]
mov dl, 1
mov eax, dword [0x44cba0]
call fcn.0040ad34
call fcn.00403650
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x44e026
mov ecx, dword [0x484c78]
mov dl, 1
mov eax, dword [0x44cba0]
call fcn.0040ad34
call fcn.00403650
xor eax, eax
push ebp
push 0x44e0aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.004030d4
cmp byte [ebp + 8], 0
je 0x44e084
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0044df30
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0044dd98
jmp 0x44e0a0
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0044d930
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44e0c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44e2a8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044dbbc
xor edx, edx
push ebp
push 0x44e408
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x44e3f2
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x44e2f2
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x44e2fc
call fcn.004036f0
jmp 0x44e40f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004110b4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 4]
mov ebx, eax
test ebx, ebx
jle 0x44e3e7
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x44e3a5
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x44e395
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.004030d4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0044e260
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x44e418]
cmp dl, byte [eax + 0x28]
je 0x44e3ee
call fcn.0040ac1c
jmp 0x44e3ee
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004110c4
jmp 0x44e3ee
cmp eax, ebx
jge 0x44e3be
mov edx, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004110c4
jmp 0x44e2fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004110b4
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004110d0
cmp ebx, eax
jne 0x44e2fc
push ebp
call fcn.0044e260
pop ecx
jmp 0x44e3ee
push ebp
call fcn.0044e260
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e40f
mov eax, dword [ebp - 4]
call fcn.0044dbc8
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e41c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e53e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044dbbc
xor eax, eax
push ebp
push 0x44e521
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x44e46c
call fcn.004036f0
jmp 0x44e528
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x44e50b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x44e50b
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.004030d4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x44e50b
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040a438
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x44e558
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x484d88]
mov dl, 1
mov eax, dword [0x44cba0]
call fcn.0040ad70
call fcn.00403650
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e528
mov eax, dword [ebp - 4]
call fcn.0044dbc8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e545
lea eax, [ebp - 0x28]
call fcn.00403c20
ret
Function at 0x44e5a4
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e6ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044dbbc
xor eax, eax
push ebp
push 0x44e6d1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x44e609
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x44e609
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x44e6bb
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x44e61c
call fcn.004036f0
jmp 0x44e6d8
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x44e6bb
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x44e6bb
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.004030d4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x44e6bb
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040a438
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x44e708
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x484d88]
mov dl, 1
mov eax, dword [0x44cba0]
call fcn.0040ad70
call fcn.00403650
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e6d8
mov eax, dword [ebp - 4]
call fcn.0044dbc8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e6f5
lea eax, [ebp - 0x28]
call fcn.00403c20
ret

Function at 0x450144
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402c08
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x484e74]
cmp byte [edx + 8], 0
je 0x4501a8
mov edx, dword [0x484e6c]
cmp dword [edx], 2
jne 0x4501a8
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x4501ac
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x450264
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00450144
test al, al
je 0x450246
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403d08
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x450246
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404064
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00404064
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403dd8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x4501ff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45026b
lea eax, [ebp - 0x2c]
call fcn.00403c20
lea eax, [ebp - 0xc]
call fcn.00403c20
ret

Function at 0x450274
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x45032c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00450144
test al, al
je 0x45030e
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403d08
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x45030e
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404064
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00404064
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403dd8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x4502c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450333
lea eax, [ebp - 0x2c]
call fcn.00403c20
lea eax, [ebp - 0xc]
call fcn.00403c20
ret
Function at 0x4504c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0044fd88
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404064
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x45051e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x484c98]
mov dl, 1
mov eax, dword [0x44fc14]
call fcn.0040ad70
call fcn.00403650
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x450528
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404064
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x450580
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x484e80]
mov dl, 1
mov eax, dword [0x44fc14]
call fcn.0040ad70
call fcn.00403650
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0044fdb8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x454c24
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x454d60
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x454d78
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.00455ce4
mov eax, dword [ebp - 4]
call fcn.00455574
xor edx, edx
push ebp
push 0x454d43
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x454ce2
test si, si
jne 0x454c94
mov eax, dword [ebp - 8]
call fcn.00408b94
mov esi, eax
cmp esi, 0xffff
jbe 0x454c94
call fcn.00402e38
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x454ce2
cmp eax, 0xffffffff
jle 0x454cc3
sub ebx, eax
jmp 0x454cd2
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.00455c18
test ebx, ebx
je 0x454ce2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x454c97
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x454d2d
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x454d90
mov dl, 1
mov eax, dword [0x45420c]
call fcn.0040ac78
call fcn.00403650
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x454d2d
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454d4a
mov eax, dword [ebp - 4]
call fcn.004555cc
ret
Function at 0x455b20
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x455bec
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x455c00
mov dl, 4
mov eax, ebx
call fcn.00455ce4
mov byte [ebx + 0x10290], 0
mov si, word [ebx + 0x10288]
cmp si, 0xffff
je 0x455bd6
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x455bc8
test byte [ebx + 0x20], 8
jne 0x455b85
cmp word [ebx + 0x1004a], 0
je 0x455b85
mov edx, ebx
mov eax, dword [ebx + 0x1004c]
call dword [ebx + 0x10048]
cmp byte [ebx + 0x10089], 0
jne 0x455bd6
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x455ba8
call fcn.00402e38
mov word [ebx + 0x10288], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x1028c]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x455bd6
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.00455c18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455bf3
lea eax, [ebp - 4]
call fcn.00403c20
ret

Function at 0x455d8c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x455dc8
mov dl, 8
mov eax, ebx
call fcn.00455ce4
push 2
push 1
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x455dba
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x456508
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push esi
push 0
push 0x419
push ebx
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret

Function at 0x4573c0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov edi, eax
cmp dword [edi + 0x218], 0
jne 0x4573e4
cmp word [edi + 0x21c], 0
je 0x4574ab
test bl, bl
je 0x4573f1
mov si, word [edi + 0x21c]
jmp 0x4573f3
xor esi, esi
cmp dword [edi + 0x218], 0
jne 0x457437
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [esp + 0x105]
push eax
push 0
push 0x4574b8
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
lea eax, [edi + 0x218]
lea edx, [esp + 0x105]
mov ecx, 0x105
call fcn.00403e50
test si, si
je 0x457476
lea eax, [esp + 0x105]
mov edx, dword [edi + 0x218]
call fcn.00408c58
mov edx, eax
mov eax, dword [edi + 0x200]
call fcn.004564d8
movzx eax, word [edi + 0x21c]
mov edx, eax
shl edx, 0x14
mov eax, dword [edi + 0x200]
call fcn.004564f0
test al, al
jmp 0x4574ab
lea eax, [esp + 0x105]
mov edx, dword [edi + 0x214]
call fcn.00408c58
mov edx, eax
mov eax, dword [edi + 0x200]
call fcn.004564d8
mov eax, dword [edi + 0x218]
call fcn.00408900
lea eax, [edi + 0x218]
call fcn.00403c20
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x45985c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404064
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x459875
test al, 0x10
jne 0x459879
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x46003c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x46006a
mov eax, ebx
call fcn.00460ae0
cmp dword [ebx + 0x3c], 0
je 0x460063
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4600db
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x4600cd
cmp dword [ebx + 8], 0
je 0x46008c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x46009e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4600cd
cmp dword [ebx + 8], 0
je 0x46007f
cmp eax, 3
je 0x4600b1
dec eax
jne 0x46007f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46007f
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x46007f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4600f9
cmp dword [ebx + 0x10], 0xcc
je 0x4600f9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00460104
pop ebx
ret

Function at 0x471da4
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
push 0xffffffffffffffff
push 0
push 0x471e3c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_EnableWindow
push 0xffffffffffffffff
push 0
push 0x471e4c
push 0
push 0
push 0x471e60
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_EnableWindow
xor eax, eax
mov dword [esp], eax
xor ebx, ebx
push 0
lea eax, [esp + 4]
push eax
push ebx
push 0x24
call sub.user32.dll_SystemParametersInfoA
push 0
lea eax, [esp + 4]
push eax
push ebx
push 0x61
call sub.user32.dll_SystemParametersInfoA
mov edx, 0x471e70
mov eax, dword [esi + 0x2d4]
call fcn.0042bf38
xor edx, edx
mov eax, dword [0x485bc8]
call fcn.0042bf38
mov eax, dword [0x485bc8]
mov eax, dword [eax + 0x2d0]
mov eax, dword [eax + 0x208]
mov edx, dword [eax]
call dword [edx + 0x40]
pop edx
pop esi
pop ebx
ret

Function at 0x472630
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404054
mov eax, dword [ebp - 8]
call fcn.00404054
xor eax, eax
push ebp
push 0x4726aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push esi
call sub.user32.dll_GetAsyncKeyState
test al, 1
je 0x47268d
call fcn.004726bc
test al, al
je 0x472680
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
call fcn.00403c74
jmp 0x47268f
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00403c74
jmp 0x47268f
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4726b1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403c44
ret
Function at 0x47294c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp bl, 0x90
jne 0x4729a2
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
neg al
sbb ebx, ebx
neg ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x47298d
and byte [ebp - 0x72], 0xfe
jmp 0x472991
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x472a28
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x472a28
mov eax, ebx
and eax, 0xff
bt dword [0x484988], eax
jae 0x4729f8
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00472900
pop ecx
cmp byte [ebp - 1], 0
je 0x472a23
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00472900
pop ecx
jmp 0x472a23
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00472900
pop ecx
cmp byte [ebp - 1], 0
je 0x472a23
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00472900
pop ecx
dec si
jne 0x4729b8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x472a30
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
and edx, 0xff
bt dword [0x484988], edx
jae 0x472a68
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.00472900
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.00472900
pop ecx
pop ebx
pop ebp
ret
Function at 0x473e08
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
xor eax, eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x474025
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x22c]
xor eax, eax
call fcn.004029c8
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.004089bc
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
mov ecx, 0x474038
call fcn.00403eec
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.0040588e
lea eax, [ebp - 0x1d0]
call fcn.00405a96
call fcn.004027e4
mov edx, 0x474050
lea eax, [ebp - 0x1d0]
call fcn.00404238
call fcn.00405ca7
call fcn.004027e4
push 0x474060
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.004029c8
push dword [ebp - 0x234]
push 0x474070
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.00403f60
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x1d0]
call fcn.00404238
call fcn.00405ca7
call fcn.004027e4
push 0x47407c
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.004029c8
push dword [ebp - 0x23c]
push 0x474070
push 0x474090
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.00403f60
mov edx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d0]
call fcn.00404238
call fcn.00405ca7
call fcn.004027e4
push 0x474060
push dword [ebp - 4]
push 0x474070
lea eax, [ebp - 0x240]
mov edx, 3
call fcn.00403f60
mov edx, dword [ebp - 0x240]
lea eax, [ebp - 0x1d0]
call fcn.00404238
call fcn.00405ca7
call fcn.004027e4
lea eax, [ebp - 0x1d0]
call fcn.00405994
call fcn.004027e4
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.00402c08
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404064
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x473fff
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47402c
lea eax, [ebp - 0x240]
mov edx, 7
call fcn.00403c44
lea eax, [ebp - 4]
call fcn.00403c20
ret