joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eb8c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x68], eax
xor eax, eax
push eax
push eax
push ecx
push 0x458f70
push eax
push eax
call fcn.004a2a30
add esp, 0x18
mov ecx, esi
push eax
call fcn.0046f070
mov edi, dword [esi]
inc edi
cmp edi, 1
jbe 0x4eb918
cmp edi, 2
setae bl
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004c2100
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push ebx
push 0x71
push str.InitializeThread
push 1
call fcn.004c1f00
lea ecx, [esp + 0x4c]
push 0x519835
push str.Failed_to_create_thread_for_async_http_requests
call fcn.004be8c0
mov ecx, esi
call fcn.004c1f40
cmp byte [ebx + 0xb], 0
jns 0x4eb8fd
push dword [esp + 4]
call fcn.00493d6d
add esp, 4
jmp 0x4eb8fd

Function at 0x4ebff0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.004ad646
add esp, 4
add eax, eax
add eax, 2
push eax
push ebx
push 1
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x66a7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x66a805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x66a878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x66a83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x66a86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x66a86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x66a831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x66a7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x42905a
Capabilities:
Hash data with crc32

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4292a4
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, eax
test esi, esi
not ecx
jmp 0x429092
test dl, 3
je 0x429094
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x6445d0]
dec esi
jne 0x42907a
mov ebx, edx
cmp esi, 0x1f
jbe 0x429247
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x644dd0]
xor eax, dword [edx*4 + 0x6451d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6449d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6445d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x644dd0]
xor eax, dword [edx*4 + 0x6451d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6449d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6445d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x644dd0]
xor eax, dword [edx*4 + 0x6451d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6449d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6445d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x644dd0]
xor eax, dword [edx*4 + 0x6451d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6449d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6445d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x644dd0]
xor eax, dword [edx*4 + 0x6451d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6449d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6445d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x644dd0]
xor eax, dword [edx*4 + 0x6451d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6449d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6445d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x644dd0]
xor eax, dword [edx*4 + 0x6451d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6449d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6445d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x644dd0]
xor eax, dword [edx*4 + 0x6451d0]
sub esi, 0x20
shr ecx, 0x10
movzx edx, cl
xor eax, dword [edx*4 + 0x6449d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6445d0]
jmp 0x429096
cmp esi, 3
jbe 0x429285
xor ecx, dword [ebx]
sub esi, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x644dd0]
add ebx, 4
shr ecx, 0x10
xor eax, dword [edx*4 + 0x6451d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6449d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6445d0]
jmp 0x429247
mov edx, ebx
test esi, esi
je 0x4292a0
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x6445d0]
dec esi
jmp 0x429289
mov eax, ecx
not eax
pop ebx
pop esi
pop ebp
ret
Function at 0x42a008
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov edi, dword [ebp + 8]
test edi, edi
je 0x42a027
mov ebx, dword [edi + 0x1c]
test ebx, ebx
je 0x42a027
cmp dword [edi + 0x20], 0
je 0x42a027
cmp dword [edi + 0x24], 0
jne 0x42a031
mov eax, 0xfffffffe
jmp 0x42a131
mov dword [edi + 0x2c], 2
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [ebx + 0x14], 0
test eax, eax
jns 0x42a066
neg eax
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x18]
cmp edx, 1
sbb eax, eax
and eax, 0x47
add eax, 0x2a
cmp edx, 2
mov dword [ebx + 4], eax
jne 0x42a089
push 0
push 0
push 0
call fcn.0042905a
jmp 0x42a094
push 0
push 0
push 0
call fcn.0042b970
add esp, 0xc
mov dword [edi + 0x30], eax
mov dword [ebx + 0x28], 0
push ebx
call fcn.0042bd2f
pop edi
mov ecx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x44]
add eax, eax
cld
mov dword [ebx + 0x3c], eax
mov word [edi + ecx*2 - 2], 0
xor eax, eax
lea ecx, [ecx + ecx - 2]
rep stosb byte es:[edi], al
imul edx, dword [ebx + 0x84], 0xc
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
movzx eax, word [edx + 0x646612]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0
movzx eax, word [edx + 0x646610]
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x78], 2
movzx eax, word [edx + 0x646614]
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x60], 2
movzx eax, word [edx + 0x646616]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x48], 0
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x42eafb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3b4
mov eax, dword [0x65f060]
mov esi, dword [ebp + 8]
test eax, eax
je 0x42eb2e
push 0x118
push eax
lea eax, [ebp - 0x14c]
push eax
call sub.msvcrt.dll_strncpy
add esp, 0xc
mov byte [ebp - 0x34], 0
jmp 0x42eb87
call fcn.0042e972
test eax, eax
je 0x42eb76
lea ebx, [ebp - 0x3bc]
push ebx
push 0x118
call sub.KERNEL32.DLL_GetTempPathW
mov eax, ebx
call fcn.0042ea21
mov ebx, eax
test eax, eax
je 0x42eb87
push 0x118
push eax
lea eax, [ebp - 0x14c]
push eax
call sub.msvcrt.dll_strncpy
push ebx
mov byte [ebp - 0x34], 0
call fcn.0042f550
add esp, 0x10
jmp 0x42eb87
lea eax, [ebp - 0x14c]
push eax
push 0x118
call sub.KERNEL32.DLL_GetTempPathA
cld
or ecx, 0xffffffff
xor eax, eax
lea edi, [ebp - 0x14c]
repne scasb al, byte es:[edi]
not ecx
lea ebx, [ecx - 1]
jmp 0x42eba7
cmp byte [ebx + ebp - 0x14d], 0x5c
jne 0x42ebab
dec ebx
test ebx, ebx
jg 0x42eb9c
mov byte [ebx + ebp - 0x14c], 0
lea eax, [ebp - 0x14c]
mov edi, esi
push eax
push str._s_sqlite_
push esi
call sub.msvcrt.dll_sprintf
cld
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov ebx, 0xe
lea edi, [ecx - 1]
lea eax, [esi + edi]
push eax
push 0xf
call fcn.0043f3d0
add esp, 0x14
movzx ax, byte [edi + esi]
xor edx, edx
mov ecx, 0x3e
div cx
and edx, 0x3f
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi], al
inc edi
dec ebx
jns 0x42ebe7
mov byte [edi + esi], 0
push esi
call fcn.0042eab3
pop edi
test eax, eax
jne 0x42ebb3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x42f087
Capabilities:
Get file attributes

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x42f0e8
call fcn.0042e972
test eax, eax
jne 0x42f0b3
cld
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor eax, eax
cmp ecx, 0x104
ja 0x42f0e8
mov eax, ebx
call fcn.0042e9ba
mov edi, eax
test eax, eax
je 0x42f0d1
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
push edi
call fcn.0042f550
pop ecx
jmp 0x42f0d9
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
je 0x42f0e8
xor eax, eax
test bl, 0x10
setne al
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x42f47a
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x65f090], 0
push ebx
mov esi, dword [ebp + 8]
jne 0x42f4c1
call fcn.0042f40e
cmp dword [0x65f090], 0
jne 0x42f4bc
call sub.KERNEL32.DLL_TlsAlloc
mov dword [0x65f080], eax
inc eax
jne 0x42f4b2
call fcn.0042f419
xor eax, eax
jmp 0x42f541
mov dword [0x65f090], 1
call fcn.0042f419
push dword [0x65f080]
call sub.KERNEL32.DLL_TlsGetValue
test esi, esi
mov ebx, eax
jle 0x42f509
test eax, eax
jne 0x42f53f
push 0xc
call fcn.0042e950
mov ebx, eax
pop eax
test ebx, ebx
je 0x42f53f
mov eax, dword [0x6477e4]
mov dword [ebx], eax
mov eax, dword [0x6477e8]
mov dword [ebx + 4], eax
mov eax, dword [0x6477ec]
mov dword [ebx + 8], eax
push ebx
push dword [0x65f080]
call sub.KERNEL32.DLL_TlsSetValue
jmp 0x42f53f
test eax, eax
setne al
shr esi, 0x1f
test eax, esi
je 0x42f53f
push 0xc
push 0x6477e4
push ebx
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x42f53f
push ebx
call fcn.0042e962
push 0
xor ebx, ebx
push dword [0x65f080]
call sub.KERNEL32.DLL_TlsSetValue
pop eax
mov eax, ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x451e00
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
cmp edx, 1
push edi
mov edi, eax
push esi
mov eax, 0x17
push ebx
mov esi, edx
push ecx
jle 0x451e91
jmp 0x451e20
movzx eax, byte [ebx + 0x64ade0]
jmp 0x451e91
movzx eax, byte [edi]
movzx eax, byte [eax + 0x6477f0]
lea ecx, [eax*4]
movzx eax, byte [edi + edx - 1]
movzx eax, byte [eax + 0x6477f0]
imul eax, eax, 3
xor ecx, eax
xor ecx, edx
mov edx, 0x7f
mov eax, ecx
mov ebx, edx
cdq
idiv ebx
movzx eax, byte [edx + str.Pk_]
mov ebx, eax
dec ebx
js 0x451e8c
movzx eax, byte [ebx + 0x64ac60]
cmp eax, esi
jne 0x451e83
movzx eax, word [ebx + ebx + 0x64ace0]
add eax, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHERE
push esi
push edi
push eax
call fcn.0042f6cb
add esp, 0xc
test eax, eax
je 0x451e17
movzx eax, byte [ebx + 0x64abe0]
jmp 0x451e57
mov eax, 0x17
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x451e99
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
pop ebp
jmp fcn.00451e00
Function at 0x46b5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 0xc]
mov bl, byte [esi]
movzx eax, bl
mov edx, eax
and edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp + 8], 0xff
jg 0x46b638
test al, 2
je 0x46b638
mov edx, 8
mov eax, dword [ebp + 8]
mov edi, edx
mov ecx, dword [ebp + 8]
cdq
idiv edi
and ecx, 7
movzx eax, byte [esi + eax + 1]
sar eax, cl
test al, 1
jne 0x46b7eb
inc esi
and bl, 2
je 0x46b641
add esi, 0x20
movzx ebx, byte [esi]
inc esi
test ebx, ebx
je 0x46b802
cmp ebx, 1
jne 0x46b6a3
movzx eax, byte [esi]
inc esi
mov dword [ebp - 0x14], eax
cmp eax, 0xbf
jle 0x46b696
and eax, 0x3f
movzx edx, byte [eax + 0x64f790]
imul ebx, edx, 6
mov ecx, dword [edx*4 + 0x64f7d0]
and dword [ebp - 0x14], ecx
mov cl, bl
shl dword [ebp - 0x14], cl
mov eax, edx
dec edx
test eax, eax
jle 0x46b696
movzx eax, byte [esi]
sub ebx, 6
and eax, 0x3f
mov cl, bl
inc esi
shl eax, cl
or dword [ebp - 0x14], eax
jmp 0x46b67c
mov edi, dword [ebp - 0x14]
cmp dword [ebp + 8], edi
jne 0x46b641
jmp 0x46b7eb
cmp ebx, 2
mov cl, byte [esi]
jne 0x46b754
movzx ecx, cl
inc esi
mov dword [ebp - 0x14], ecx
cmp ecx, 0xbf
jle 0x46b6f7
mov eax, ecx
and eax, 0x3f
movzx edx, byte [eax + 0x64f790]
imul ebx, edx, 6
mov eax, dword [edx*4 + 0x64f7d0]
and ecx, eax
mov dword [ebp - 0x14], ecx
mov cl, bl
shl dword [ebp - 0x14], cl
mov eax, edx
dec edx
test eax, eax
jle 0x46b6f7
movzx eax, byte [esi]
sub ebx, 6
and eax, 0x3f
mov cl, bl
inc esi
shl eax, cl
or dword [ebp - 0x14], eax
jmp 0x46b6dd
movzx ebx, byte [esi]
inc esi
cmp ebx, 0xbf
jle 0x46b736
mov eax, ebx
and eax, 0x3f
movzx edx, byte [eax + 0x64f790]
imul edi, edx, 6
and ebx, dword [edx*4 + 0x64f7d0]
mov ecx, edi
shl ebx, cl
mov eax, edx
dec edx
test eax, eax
jle 0x46b736
movzx eax, byte [esi]
sub edi, 6
and eax, 0x3f
mov ecx, edi
inc esi
shl eax, cl
or ebx, eax
jmp 0x46b71d
mov edi, dword [ebp - 0x14]
cmp dword [ebp + 8], edi
setge dl
xor eax, eax
cmp dword [ebp + 8], ebx
setle al
test edx, eax
je 0x46b641
jmp 0x46b7eb
mov edx, pe_nt_image_headers32
mov eax, dword [ebp + 8]
mov edi, edx
cdq
idiv edi
mov dword [ebp - 0x18], eax
movzx eax, byte [eax + 0x6596b0]
shl eax, 7
add eax, edx
movzx edx, cl
movzx eax, word [eax + eax + 0x64f8b0]
cmp edx, 4
lea eax, [eax*8 + 0x65b8b0]
ja case.default.0x46b787
jmp dword [edx*4 + 0x65cb50]
cmp ebx, 3
jne 0x46b7fa
jmp 0x46b7eb
mov cl, byte [eax + 1]
xor edi, edi
cmp cl, 9
setne dl
xor eax, eax
cmp cl, 5
setne al
test edx, eax
je 0x46b7b5
cmp cl, 8
je 0x46b7b5
mov di, 1
xor eax, eax
cmp ebx, 3
sete al
cmp edi, eax
jmp 0x46b7e9
movzx eax, byte [eax + 1]
movzx edx, byte [esi + 1]
cmp edx, dword [eax*4 + 0x64f710]
jmp 0x46b7dc
mov al, byte [eax + 1]
jmp 0x46b7d9
mov al, byte [eax]
cmp byte [esi + 1], al
setne dl
cmp ebx, 3
sete al
xor eax, edx
test al, 1
je 0x46b7fa
xor eax, eax
cmp dword [ebp - 0x10], 0
sete al
jmp 0x46b805
xor eax, eax
jmp 0x46b805
add esi, 2
jmp 0x46b641
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x46ddbd
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa0
lea ebx, [ebp - 0xa4]
push 0x94
push 0x4cf250
push ebx
call fcn.00478620
add esp, 0xc
cmp dword [0x65f360], 0
jne 0x46de49
push ebx
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x46de06
cmp dword [ebp - 0x94], 2
jne 0x46de06
mov dword [0x65f320], 1
mov dword [0x65f390], 1
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x65f340], eax
push eax
push 0
push 0x46da85
push 3
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x65f330], eax
push 1
call sub.WINMM.DLL_timeBeginPeriod
push 0x46d90b
call fcn.004012d0
mov dword [0x65f360], 1
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x46de4e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
jmp 0x46df31
mov ecx, dword [ebp - 0x20]
sub ecx, 0x100
cmp ecx, 5
ja 0x46deee
mov eax, 1
shl eax, cl
test al, 0x33
je 0x46deee
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x46deee
cmp eax, 0x12
jbe 0x46de8c
sub eax, 0x5b
cmp eax, 1
ja 0x46deee
mov dword [0x65f350], 0
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x46dea9
or dword [0x65f350], 1
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x46debc
or dword [0x65f350], 2
push 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x46decf
or dword [0x65f350], 4
push 0x5b
call sub.USER32.dll_GetKeyState
test ax, ax
js 0x46dee7
push 0x5c
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x46deee
or dword [0x65f350], 8
mov eax, dword [ebp - 0x24]
call fcn.0046d92a
test eax, eax
je 0x46df22
push dword [ebp - 0x24]
jmp 0x46df00
push ebx
call sub.USER32.dll_GetParent
mov ebx, eax
test eax, eax
je 0x46df22
call fcn.0046d92a
test eax, eax
jne 0x46deff
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.USER32.dll_IsDialogMessageA
test eax, eax
jne 0x46df31
lea ebx, [ebp - 0x24]
push ebx
call sub.USER32.dll_TranslateMessage
push ebx
call sub.USER32.dll_DispatchMessageA
lea eax, [ebp - 0x24]
push 1
push 0
push 0
push 0
push eax
call sub.USER32.dll_PeekMessageA
test eax, eax
jne 0x46de5a
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x46df4f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xff
push 0xffffffffffffffff
push 0
push 0
push 0
call sub.USER32.dll_MsgWaitForMultipleObjects
leave
jmp fcn.0046de4e

Function at 0x46e467
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x65f320], 0
mov eax, dword [ebp + 8]
je 0x46e490
push 0xa
push 0
push 0
push eax
call fcn.0047191b
mov dword [esp], eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteW
jmp 0x46e4a8
push 0xa
push 0
push 0
push eax
call fcn.00471901
mov dword [esp], eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x20
leave
setg al
movzx eax, al
ret
Function at 0x46e636
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x66de70], 0
mov eax, dword [ebp + 8]
je 0x46e65d
push eax
call fcn.0047191b
mov dword [esp], eax
call sub.msvcrt.dll__wgetenv
pop edx
mov dword [ebp + 8], eax
leave
jmp fcn.00470b1a
push eax
call fcn.00471901
mov dword [esp], eax
call sub.msvcrt.dll_getenv
pop ecx
mov dword [ebp + 8], eax
leave
jmp fcn.00470aa5
Function at 0x46ebd4
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00471901
mov dword [esp], eax
call sub.WSOCK32.DLL_gethostbyname
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x46ec04
movsx edx, word [ecx + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
movsx edx, word [ecx + 0xa]
mov dword [eax], edx
mov eax, dword [ecx + 0xc]
leave
ret

Function at 0x46ec06
Capabilities:
Connect socket

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
push edi
sub esp, 0x10
cmp dword [ebp + 0x10], 2
jne 0x46ec54
cld
xor eax, eax
lea edi, [ebp - 0x14]
mov ecx, 4
rep stosd dword es:[edi], eax
movzx eax, word [ebp + 0x18]
mov word [ebp - 0x14], 2
push eax
call sub.WSOCK32.DLL_htons
push dword [ebp + 0x14]
push dword [ebp + 0xc]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
call fcn.00478620
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [ebp + 8]
call sub.WSOCK32.DLL_connect
mov edi, dword [ebp - 4]
leave
ret

Function at 0x46eff2
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
push 0x46efe9
call fcn.004012d0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x66de40], eax
lea edx, [eax + 0x20]
add eax, 0x40
mov dword [0x66de60], edx
mov dword [0x66de50], eax
leave
ret

Function at 0x472c27
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x66de80
call sub.KERNEL32.DLL_InitializeCriticalSection
call sub.KERNEL32.DLL_TlsAlloc
push 0xb8
mov dword [0x669b10], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
mov dword [eax + 4], 0
lea eax, [eax + 8]
push pe_nt_image_headers32
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
push 2
push 0
mov dword [ebx + 0xb4], eax
lea eax, [ebx + 0xb0]
push 0
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_DuplicateHandle
add esp, 0x10
test eax, eax
jne 0x472cb2
push 0xffffffffffffffff
call sub.msvcrt.dll_exit
push ebx
push dword [0x669b10]
call sub.KERNEL32.DLL_TlsSetValue
mov eax, dword [0x669ae0]
mov dword [ebx], eax
mov dword [0x669ae0], ebx
mov dword [0x669b00], ebx
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x472cd6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x2d0
lea ebx, [ebp - 0x2d8]
push 0xb8
call sub.msvcrt.dll_malloc
mov esi, eax
mov eax, dword [ebp + 8]
push pe_nt_image_headers32
push 0
mov dword [esi + 4], eax
lea eax, [esi + 8]
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x88], 0
mov dword [esi + 8], eax
lea eax, [esi + 0xb4]
push eax
push 4
push esi
push 0x472b90
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push 0x2cc
mov dword [esi + 0xb0], eax
push 0x4d16b0
push ebx
call fcn.00478620
push ebx
push dword [esi + 0xb0]
call sub.KERNEL32.DLL_GetThreadContext
mov eax, dword [ebp - 0x214]
add esp, 0x1c
mov dword [esi + 0x8c], eax
cmp dword [0x66dea0], 0
je 0x472d75
push 0x66de80
call sub.KERNEL32.DLL_EnterCriticalSection
mov ebx, 0x669af0
mov edx, dword [0x669af0]
test edx, edx
je 0x472da0
cmp dword [edx + 0x88], 0
je 0x472d9a
mov eax, dword [edx]
mov dword [ebx], eax
push edx
call fcn.004785d0
pop ecx
jmp 0x472d9c
mov ebx, edx
mov edx, dword [ebx]
jmp 0x472d80
mov eax, dword [0x669ae0]
mov dword [0x669ae0], esi
mov dword [esi], eax
cmp dword [0x66dea0], 0
je 0x472dc0
push 0x66de80
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, esi
mov dword [0x66dea0], 1
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x472e48
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 0xb0]
call sub.KERNEL32.DLL_ResumeThread
leave
ret

Function at 0x472e5b
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2d0
call fcn.00472e25
mov esi, dword [0x669ae0]
mov edi, eax
test esi, esi
je 0x472f1b
cmp esi, edi
je 0x472f14
push dword [esi + 0xb0]
call sub.KERNEL32.DLL_SuspendThread
lea ebx, [ebp - 0x2dc]
push 0x2cc
push 0x4d197c
push ebx
call fcn.00478620
push ebx
push dword [esi + 0xb0]
call sub.KERNEL32.DLL_GetThreadContext
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x94], eax
mov eax, dword [ebp - 0x23c]
mov dword [esi + 0x98], eax
mov eax, dword [ebp - 0x238]
mov dword [esi + 0x9c], eax
mov eax, dword [ebp - 0x234]
mov dword [esi + 0xa0], eax
mov eax, dword [ebp - 0x230]
mov dword [esi + 0xa4], eax
mov eax, dword [ebp - 0x22c]
mov dword [esi + 0xa8], eax
mov eax, dword [ebp - 0x228]
mov dword [esi + 0xac], eax
mov eax, dword [ebp - 0x218]
mov dword [esi + 0x90], eax
add esp, 0xc
mov esi, dword [esi]
jmp 0x472e74
mov eax, dword [0x669ae0]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x472f28
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
call fcn.00472e25
mov ebx, dword [0x669ae0]
mov esi, eax
test ebx, ebx
je 0x472f51
cmp ebx, esi
je 0x472f4d
push dword [ebx + 0xb0]
call sub.KERNEL32.DLL_ResumeThread
mov ebx, dword [ebx]
jmp 0x472f3a
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret