joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f7d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49fa34
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x49f837
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0049f29c
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e038
cmp al, 1
jne 0x49f837
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0049f5b4
test al, al
je 0x49f9c3
cmp dword [ebp - 8], 0
jge 0x49f855
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0049f29c
mov eax, dword [ebp - 0x210]
call fcn.00404db0
cmp ebx, eax
jge 0x49f89f
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0049f29c
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x634c6c]
and eax, 0xff
bt dword [edx], eax
jae 0x49f89f
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x49f8b3
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049f7b0
cmp ebx, dword [ebp - 8]
je 0x49f9b5
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x49f8df
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403eb8
and eax, 0x7f
movzx eax, word [eax*2 + 0x5e4b74]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x49f9a2
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403eb8
and eax, 0x7f
movzx eax, word [eax*2 + 0x5e4b74]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0046f82c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403eb8
and eax, 0x7f
movzx eax, word [eax*2 + 0x5e4b74]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0046f82c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f9a9
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x49fa16
cmp dword [ebp - 8], 0
jge 0x49f9ce
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0049f29c
mov eax, dword [ebp - 0x218]
call fcn.00404db0
cmp eax, dword [ebp - 8]
jg 0x49fa08
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0049f29c
mov eax, dword [ebp - 0x21c]
call fcn.00404db0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049f7b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fa3b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404b14
ret
Function at 0x4bc6a8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x637034
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4bc6ca
shr eax, 1
xor eax, 0xedb88320
jmp 0x4bc6cc
shr eax, 1
dec edx
jne 0x4bc6b8
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4bc6b1
mov byte [0x637434], 1
pop esi
pop ebx
ret

Function at 0x4bc6e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x637434], 0
jne 0x4bc6ff
call fcn.004bc6a8
mov eax, edi
dec eax
test eax, eax
jl 0x4bc728
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x637034]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4bc709
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4becac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4becdd
dec al
je 0x4bed19
dec al
je 0x4bed5d
dec al
je 0x4bedc8
jmp 0x4bee52
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4bee52
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4beced
jmp 0x4bee52
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4bee52
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4bed29
jmp 0x4bee52
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4bee52
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4bed8b
xor ebp, ebp
jmp 0x4bed9c
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4beda5
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4bed6d
jmp 0x4bee52
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4bee52
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4bee20
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004bc730
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4beddc
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4da778
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x4da895
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x368]
test eax, eax
je 0x4da87f
cmp dword [eax + 0x410], 0
je 0x4da87f
cmp byte [ebx + 0x30c], 0
je 0x4da800
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x304]
cmp eax, 0x1f4
jb 0x4da7d9
lea eax, [ebx + 0x308]
call fcn.00404af0
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x304], eax
lea eax, [ebx + 0x308]
mov edx, dword [ebp - 4]
call fcn.00404db8
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x308]
call fcn.00404b88
mov eax, dword [ebp - 4]
call fcn.00404db0
test eax, eax
jle 0x4da86f
mov eax, dword [ebp - 4]
call fcn.00404db0
dec eax
jne 0x4da846
mov eax, dword [ebp - 4]
call fcn.00404fb0
push eax
mov eax, ebx
call fcn.004db3ac
push eax
push 0x18f
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x410]
call fcn.0046f82c
push eax
call sub.user32.dll_SendMessageA
jmp 0x4da872
mov eax, dword [ebp - 4]
call fcn.00404fb0
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x410]
call fcn.0046f82c
push eax
call sub.user32.dll_SendMessageA
jmp 0x4da872
or eax, 0xffffffff
test eax, eax
jl 0x4da87f
mov edx, eax
mov eax, ebx
call fcn.004db3b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da89c
lea eax, [ebp - 4]
call fcn.00404af0
ret
Function at 0x4da8a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4da9f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x368]
test eax, eax
je 0x4da9c8
cmp dword [eax + 0x410], 0
je 0x4da9c8
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x304]
cmp eax, 0xc8
jbe 0x4da9c8
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x304], eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00469044
mov eax, dword [ebp - 0xc]
call fcn.00404db0
dec eax
jne 0x4da948
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00469044
mov eax, dword [ebp - 0x10]
call fcn.00404fb0
push eax
mov eax, ebx
call fcn.004db3ac
push eax
push 0x18f
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x410]
call fcn.0046f82c
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
jmp 0x4da97b
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00469044
mov eax, dword [ebp - 0x14]
call fcn.00404fb0
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x410]
call fcn.0046f82c
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
test esi, esi
jl 0x4da9c8
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00469044
mov edx, esi
mov eax, ebx
call fcn.004db3b8
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00469044
mov eax, dword [ebp - 4]
call fcn.00404db0
mov edx, eax
mov eax, ebx
call fcn.004daa58
mov eax, dword [ebp - 8]
call fcn.00404db0
push eax
mov eax, dword [ebp - 4]
call fcn.00404db0
pop edx
sub edx, eax
mov eax, ebx
call fcn.004daa74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da9f7
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404b14
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b14
ret
Function at 0x4dfa4c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
xor ebx, ebx
call fcn.0053fd10
test al, al
je 0x4dfb53
mov eax, dword [esi + 4]
mov edx, dword [0x4ca97c]
call fcn.00403e48
test al, al
je 0x4dfb53
mov ebx, dword [esi + 4]
cmp byte [ebx + 0x30d], 0
je 0x4dfabc
cmp byte [esi + 0x558], 0
jne 0x4dfabc
push 0xffffffffffffffec
mov eax, esi
call fcn.0046f82c
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.0046f82c
push eax
call sub.user32.dll_SetWindowLongA
jmp 0x4dfaf2
cmp byte [ebx + 0x30d], 0
jne 0x4dfaf2
cmp byte [esi + 0x558], 0
je 0x4dfaf2
push 0xffffffffffffffec
mov eax, esi
call fcn.0046f82c
push eax
call sub.user32.dll_GetWindowLongA
and eax, 0xfff7ffff
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.0046f82c
push eax
call sub.user32.dll_SetWindowLongA
mov al, byte [ebx + 0x30d]
mov byte [esi + 0x558], al
mov al, byte [esi + 0x559]
cmp al, byte [ebx + 0x30f]
je 0x4dfb53
cmp byte [ebx + 0x30d], 0
je 0x4dfb53
cmp byte [ebx + 0x30e], 0
je 0x4dfb35
mov eax, esi
call fcn.0046f82c
xor edx, edx
call fcn.0053fd4c
mov byte [esi + 0x559], 0
jmp 0x4dfb53
mov eax, esi
call fcn.0046f82c
mov dl, byte [ebx + 0x30f]
call fcn.0053fd4c
mov al, byte [ebx + 0x30f]
mov byte [esi + 0x559], al
push 0x51
push 0
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
mov eax, esi
call fcn.0046f82c
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, esi
call fcn.00468f64
call fcn.0053fd10
test al, al
je 0x4dfbf4
test ebx, ebx
je 0x4dfbf4
cmp byte [ebx + 0x30e], 0
je 0x4dfbf4
cmp byte [ebx + 0x30d], 0
je 0x4dfbf4
mov eax, dword [0x634984]
mov eax, dword [eax]
call fcn.0048986c
xor edi, edi
xor ebp, ebp
call sub.kernel32.dll_GetTickCount_1
sub eax, ebp
cmp eax, 5
jbe 0x4dfbdc
call sub.kernel32.dll_GetTickCount_1
mov ebp, eax
add edi, 0xa
xor eax, eax
mov al, byte [ebx + 0x30f]
cmp edi, eax
jle 0x4dfbce
mov edi, eax
mov eax, esi
call fcn.0046f82c
mov edx, edi
call fcn.0053fd4c
mov eax, dword [0x634984]
mov eax, dword [eax]
call fcn.0048986c
xor eax, eax
mov al, byte [ebx + 0x30f]
cmp edi, eax
jl 0x4dfbaa
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x54e794
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x54e7a9
add esp, 0xfffffff0
call fcn.00404020
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x54e884
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.005494d4
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.004190c0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x28], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.004190c0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x40], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.004190c0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x38], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.004190c0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x30], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.004190e8
push esi
lea edi, [esi + 0x44]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x54], 0
mov byte [esi + 0x55], 0
mov byte [esi + 0x56], 0
mov byte [esi + 0x57], 0
mov byte [esi + 0x58], 0
mov byte [esi + 0x59], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54e88b
lea eax, [ebp - 4]
call fcn.00404af0
ret
Function at 0x567b80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov eax, dword [edi]
call fcn.00568864
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
push ebp
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00567aa0
pop ecx
call fcn.0053fd10
test al, al
je 0x567c28
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x60], 0
je 0x567c28
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.0046f82c
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.0046f82c
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x61], 0
je 0x567c11
mov eax, dword [edi]
call fcn.0046f82c
xor edx, edx
call fcn.0053fd4c
jmp 0x567c28
mov eax, dword [edi]
call fcn.0046f82c
mov edx, dword [edi]
mov edx, dword [edx + 0x220]
mov dl, byte [edx + 0x62]
call fcn.0053fd4c
push 0x51
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [edi]
call fcn.0046f82c
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, dword [edi]
call fcn.00468f64
mov eax, dword [edi]
mov ebx, dword [eax + 0x220]
cmp byte [ebx + 0x61], 0
je 0x567cc1
cmp byte [ebx + 0x60], 0
je 0x567cc1
call fcn.0053fd10
test al, al
je 0x567cc1
mov eax, dword [0x634984]
mov eax, dword [eax]
call fcn.0048986c
xor ebx, ebx
xor esi, esi
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 5
jbe 0x567cb1
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
add ebx, 0xa
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jle 0x567ca3
mov ebx, eax
mov eax, dword [edi]
call fcn.0046f82c
mov edx, ebx
call fcn.0053fd4c
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jl 0x567c7b
mov eax, dword [edi]
call fcn.00568da4
mov eax, dword [edi]
call fcn.0046f82c
push eax
call sub.user32.dll_SetCapture
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56bf2c
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp], eax
xor ebx, ebx
mov eax, ebx
shr eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [edx + eax*4 + 0x20]
shr ecx, 0x10
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
mov edi, eax
imul edi, ecx
mov dword [esp + 8], edi
movzx edi, byte [edx + ebx*4]
imul edi, dword [esp + 8]
movzx ebp, byte [edx + ebx*4 + 1]
imul ebp, eax
add edi, ebp
xor eax, eax
mov al, byte [edx + ebx*4 + 2]
imul eax, esi
add edi, eax
xor eax, eax
mov al, byte [edx + ebx*4 + 3]
imul eax, ecx
add edi, eax
inc edi
mov dword [esp + 4], edi
mov eax, dword [esp + 0xc]
mov ecx, dword [edx + eax*4 + 0x20]
and ecx, 0xffff
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
mov edi, eax
imul edi, ecx
mov dword [esp + 8], edi
movzx edi, byte [edx + ebx*4 + 4]
imul edi, dword [esp + 8]
movzx ebp, byte [edx + ebx*4 + 5]
imul ebp, eax
add edi, ebp
xor eax, eax
mov al, byte [edx + ebx*4 + 6]
imul eax, esi
add edi, eax
xor eax, eax
mov al, byte [edx + ebx*4 + 7]
imul eax, ecx
add edi, eax
inc edi
mov eax, edi
mov ecx, dword [esp + 4]
shl ecx, 0x10
mov esi, eax
and esi, 0xffff
or ecx, esi
mov esi, dword [esp]
mov edi, dword [esp + 0xc]
mov dword [esi + edi*4], ecx
mov ecx, dword [esp + 4]
and ecx, 0xffff0000
shr eax, 0x10
or ecx, eax
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x10], ecx
add ebx, 2
cmp ebx, 8
jne 0x56bf38
mov eax, dword [esp + 0x10]
mov ecx, eax
shr ecx, 0x10
mov ebx, dword [esp + 0x1c]
mov esi, ebx
shl esi, 0x10
or ecx, esi
mov dword [edx + 0x20], ecx
shl eax, 0x10
mov ecx, dword [esp + 0x14]
mov esi, ecx
shr esi, 0x10
or eax, esi
mov dword [edx + 0x24], eax
shl ecx, 0x10
mov eax, dword [esp + 0x18]
shr eax, 0x10
or ecx, eax
mov dword [edx + 0x28], ecx
mov eax, dword [esp + 0x18]
shl eax, 0x10
shr ebx, 0x10
or eax, ebx
mov dword [edx + 0x2c], eax
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x570c8c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x570c94
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x570e86
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x570e9c
mov eax, esi
call fcn.0056e89c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404b44
lea ecx, [ebp - 0x10]
mov edx, 0x570eb0
mov eax, esi
call fcn.0056e89c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404b44
lea ecx, [ebp - 0x14]
mov edx, 0x570ec8
mov eax, esi
call fcn.0056e89c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404b44
lea ecx, [ebp - 0x18]
mov edx, 0x570ee4
mov eax, esi
call fcn.0056e89c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404b44
lea ecx, [ebp - 0x1c]
mov edx, 0x570f00
mov eax, esi
call fcn.0056e89c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404b44
lea ecx, [ebp - 0x24]
mov edx, 0x570f18
mov eax, esi
call fcn.0056e89c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004094ac
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409a24
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x570f30
mov eax, esi
call fcn.0056e89c
mov eax, dword [ebp - 0x28]
call fcn.004a80ac
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x570f40
mov eax, esi
call fcn.0056e89c
mov eax, dword [ebp - 0x2c]
call fcn.004a80ac
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x570f58
mov eax, esi
call fcn.0056e89c
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409a24
inc eax
je 0x570e29
lea ecx, [ebp - 0x34]
mov edx, 0x570f58
mov eax, esi
call fcn.0056e89c
mov eax, dword [ebp - 0x34]
call fcn.004099e8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040b4cc
fstp qword [ebp - 0x3c]
wait
call fcn.0040b85c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x570e44
lea ecx, [ebp - 0x40]
mov edx, 0x570f58
mov eax, esi
call fcn.0056e89c
mov eax, dword [ebp - 0x40]
call fcn.004a80ac
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x570f68
mov eax, esi
call fcn.0056e89c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x570e8d
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404b14
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404b14
ret
Function at 0x57e7c4
Capabilities:
Capture public ip
Create http request
Create process on windows
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x57e9e1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x57e8ef
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x57e9f0
call sub.wininet.dll_InternetOpenA
mov ebx, eax
test ebx, ebx
jne 0x57e842
push 1
push 0
push 0
push 0x57e9f4
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57e9bb
push 0
push 0x84000002
push 0
push 0
push 0x57ea0c
push ebx
call sub.wininet.dll_InternetOpenUrlA
mov esi, eax
test esi, esi
jne 0x57e885
push ebx
call sub.wininet.dll_InternetCloseHandle
push 1
push 0
push 0
push 0x57e9f4
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57e9bb
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x409]
xor ecx, ecx
mov edx, 0x401
call fcn.00403374
lea eax, [ebp - 8]
push eax
push 0x400
lea eax, [ebp - 0x409]
push eax
push esi
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x57e8cb
lea eax, [ebp - 4]
lea edx, [ebp - 0x409]
mov ecx, 0x401
call fcn.00404d60
jmp 0x57e8df
push 1
push 0
push 0
push 0x57e9f4
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57e8f9
mov edx, dword [ebp - 4]
mov eax, 0x57ea38
call fcn.004050f4
test eax, eax
je 0x57e9a7
lea eax, [ebp - 0x414]
push eax
mov ecx, 0x57ea50
mov edx, 0x57ea5c
mov eax, dword [ebp - 4]
call fcn.0056afc8
push dword [ebp - 0x414]
push 0x57ea68
lea edx, [ebp - 0x418]
mov eax, dword [0x63485c]
mov eax, dword [eax]
mov eax, dword [eax + 0x9d8]
call fcn.0040987c
push dword [ebp - 0x418]
lea eax, [ebp - 0x410]
mov edx, 3
call fcn.00404e70
mov edx, dword [ebp - 0x410]
mov eax, dword [0x638528]
mov eax, dword [eax + 0x344]
call fcn.0049f394
lea eax, [ebp - 0x41c]
push eax
mov ecx, 0x57ea50
mov edx, 0x57ea5c
mov eax, dword [ebp - 4]
call fcn.0056afc8
mov edx, dword [ebp - 0x41c]
mov eax, dword [0x638528]
mov eax, dword [eax + 0x368]
call fcn.0049f394
jmp 0x57e9bb
push 1
push 0
push 0
push 0x57e9f4
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57e9e8
lea eax, [ebp - 0x41c]
mov edx, 4
call fcn.00404b14
lea eax, [ebp - 4]
call fcn.00404af0
ret