joyce8/EMBER2024-capa huggingface dataset:
Function at 0x532be0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x532c51
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x532c4a
push ebx
mov ebx, dword [ebp + 8]
push edi
push dword [ebx]
call fcn.004ab0d5
mov edi, eax
pop ecx
add edi, 4
je 0x532c48
push esi
lea ecx, [edi + 2]
push ecx
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x532c47
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x532c47
push edi
push eax
mov ecx, ebx
call fcn.004b03c8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop ebp
ret

Function at 0x5361bf
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov dword [ebp - 4], ecx
call fcn.0056a15a
mov edi, dword [ebp + 8]
mov ebx, edi
mov eax, dword [ebp + 0xc]
sar eax, 0x10
movzx edx, al
lea eax, [edi - 0x30]
cmp eax, 9
ja 0x536201
lea eax, [edx - 0x47]
cmp eax, 0xb
ja case.0x5361f2.74
movzx eax, byte [eax + 0x536247]
jmp dword [eax*4 + 0x53623f]
add edi, 0x10030
jmp case.0x5361f2.74
push 1
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx eax, ax
test eax, eax
cmovne edi, eax
cmp ebx, 0x20
jae case.0x5361f2.74
test byte [0xe1cd00], 6
push 0
pop eax
cmovne ebx, eax
mov ecx, dword [ebp - 4]
push ebx
push edi
call fcn.0054fb5c
pop edi
pop ebx
leave
ret 8
Function at 0x536253
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0xe14344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14c], esi
call fcn.0056a15a
mov ebx, dword [ebp + 8]
xor edi, edi
cmp ebx, 0x77
ja 0x5363b2
je case.0x5363c5.120
cmp ebx, 0x2d
ja 0x536386
je case.0x5363c5.120
cmp ebx, 0x23
ja 0x53636d
je case.0x5363c5.120
mov eax, ebx
sub eax, 0x10
je case.0x5363c5.144
sub eax, 1
je case.0x5363c5.144
sub eax, 1
je case.0x5363c5.144
dec eax
sub eax, 1
je case.0x5363c5.144
sub eax, 0xd
je case.0x5363c5.120
sub eax, 1
je case.0x5363c5.120
push 1
mov ecx, esi
call fcn.0054fb86
push edi
push 0x103
push 0x102
push dword [esi + 0x78]
mov byte [ebp - 0x141], al
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x536438
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 2
push ebx
call esi
push edi
push ebx
mov dword [ebp - 0x148], eax
call esi
mov esi, eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
xor edi, edi
lea eax, [ebp - 0x24]
push edi
push 8
push eax
lea eax, [ebp - 0x124]
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
je 0x53640f
xor eax, eax
mov word [ebp - 0x24], ax
jmp 0x536413
mov eax, ebx
sub eax, 0x24
je case.0x5363c5.120
sub eax, 1
je case.0x5363c5.120
sub eax, 1
je case.0x5363c5.120
sub eax, 1
jmp 0x5362d2
cmp ebx, 0x71
ja 0x5363ab
je case.0x5363c5.120
mov eax, ebx
sub eax, 0x2e
je case.0x5363c5.120
sub eax, 0x2d
je case.0x5363c5.144
sub eax, 1
je case.0x5363c5.144
sub eax, 1
je case.0x5363c5.144
sub eax, 0x13
jmp 0x5362db
mov eax, ebx
sub eax, 0x72
jmp 0x536372
lea eax, [ebx - 0x78]
cmp eax, 0x2d
ja case.0x5363c5.136
movzx eax, byte [eax + 0x53646b]
jmp dword [eax*4 + 0x53645f]
push 1
mov ecx, esi
call fcn.0054fb86
mov ecx, esi
mov bl, al
call fcn.00563bd3
jmp 0x53643e
push 1
mov ecx, esi
call fcn.0054fb86
push 0
or ebx, 0x10000
mov byte [ebp - 0x141], al
push ebx
mov ecx, esi
call fcn.0054fb5c
test al, al
jne 0x53644c
cmp byte [ebp - 0x141], al
jne 0x53644c
xor edi, edi
jmp 0x536442
mov ax, word [ebp - 0x24]
mov ecx, dword [ebp - 0x14c]
movzx eax, ax
push eax
mov eax, dword [ebp - 0x148]
movzx eax, ax
push eax
call fcn.0054fb5c
test al, al
jne 0x53644c
cmp byte [ebp - 0x141], al
jmp 0x536440
mov bl, byte [ebp - 0x141]
test bl, bl
jne 0x53644c
push edi
call fcn.00547c14
test eax, eax
je 0x53644e
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00d1eeae
leave
ret 4
Function at 0x547111
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], eax
test byte [ebp + 0x10], 0x10
mov esi, ebx
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
je 0x547198
push ebx
push ebx
push 0x10
push eax
call sub.IMM32.dll_ImmGetCompositionStringW
mov edi, eax
test edi, edi
jle 0x547198
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
call fcn.004ab9b8
pop ecx
pop ecx
push edi
mov esi, eax
push esi
push 0x10
push dword [ebp - 8]
call sub.IMM32.dll_ImmGetCompositionStringW
mov al, byte [esi + ebx]
cmp al, 1
je 0x547170
cmp al, 3
je 0x547170
inc ebx
cmp ebx, edi
jl 0x547160
mov dword [ebp - 4], ebx
mov eax, ebx
cmp ebx, edi
jge 0x54718e
mov cl, byte [esi + eax]
cmp cl, 1
je 0x547186
cmp cl, 3
jne 0x54718b
inc eax
cmp eax, edi
jl 0x547179
mov dword [ebp - 4], eax
push esi
call fcn.00d75412
mov esi, dword [ebp - 4]
pop ecx
mov eax, dword [ebp - 0x10]
cmp ebx, esi
mov edi, ebx
cmovl edi, esi
mov esi, dword [ebp - 0xc]
mov esi, dword [esi]
lea edx, [esi + ebx]
lea ecx, [edi + esi]
mov dword [eax], edx
cmp edx, ecx
cmovl ebx, edi
add ebx, esi
pop edi
pop esi
mov dword [eax + 4], ebx
pop ebx
leave
ret 0xc

Function at 0x5471c0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push 4
mov eax, 0xda62c9
call fcn.00d1eedf
xor esi, esi
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
mov edi, eax
test edi, edi
jle 0x54721e
push esi
mov dword [ebp - 4], esi
call fcn.00d75412
mov eax, edi
shr eax, 1
inc eax
push 2
push eax
call fcn.004af9e6
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x10], esi
push edi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
mov ecx, dword [ebp + 8]
push esi
call fcn.004ac269
push esi
call fcn.00d75412
pop ecx
jmp 0x547226
mov ecx, dword [ebp + 8]
call fcn.004ac30d
mov eax, dword [ebp + 8]
call fcn.00d1eebc
ret 0xc
Function at 0x547231
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push edi
mov edi, ebx
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
cmp dword [ebp + 0xc], eax
je 0x5472f9
test byte [ebp + 0x10], 0x20
je 0x5472f9
push eax
push eax
push 0x20
push dword [ebp + 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
mov edi, eax
test edi, edi
jle 0x5472f9
and dword [ebp + 0x10], 0
lea ecx, [ebp + 0x10]
push esi
mov esi, edi
shr esi, 2
push esi
mov dword [ebp - 8], esi
call fcn.004a9dfb
push edi
push dword [ebp + 0x10]
push 0x20
push dword [ebp + 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
test eax, eax
jle 0x5472ef
xor eax, eax
inc eax
mov dword [ebp + 0xc], eax
cmp esi, eax
jbe 0x5472ef
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
lea ebx, [edi + 4]
mov edi, dword [edi]
mov esi, edi
cmp edi, dword [ebx]
cmovl esi, dword [ebx]
mov edx, dword [eax]
lea ecx, [edx + edi]
lea eax, [edx + esi]
mov dword [ebp - 0x10], ecx
cmp ecx, eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
cmovl edi, esi
add edi, edx
push eax
mov dword [ebp - 0xc], edi
call fcn.004aa3dd
mov eax, dword [ebp + 0xc]
lea edi, [ebx]
inc eax
mov dword [ebp + 0xc], eax
cmp eax, dword [ebp - 8]
jb 0x5472ae
mov ebx, dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.00d75412
pop ecx
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x548744
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xda7754
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
push esi
push edi
mov eax, dword [0xe14344]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x14], edx
push dword [edx + 0x2c]
cmp byte [edx + 0x4d], 0
push dword [edx + 0x28]
mov ecx, dword [ebx + 0xc]
setne al
push dword [edx + 0x30]
movzx edi, byte [edx + 0x4c]
mov esi, dword [edx + 0x44]
mov byte [ebp - 0x18], al
mov eax, dword [edx + 0x40]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
call fcn.0054a17b
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
push edi
push esi
push dword [ebp - 0x20]
movups xmm0, xmmword [ecx + 0x18]
push dword [eax + 4]
movss xmm4, dword [ecx + 0x14]
push dword [eax]
lea eax, [ebp - 0x30]
push dword [ecx + 0x3c]
push dword [ecx + 0x38]
push dword [ecx + 0x34]
push dword [ebx + 0xc]
sub esp, 0x14
movups xmmword [esp + 4], xmm0
movss dword [esp], xmm4
push dword [ecx + 0x10]
push dword [ecx + 4]
push dword [ecx]
push dword [ecx + 0x30]
mov ecx, dword [ebx + 0xc]
push eax
call fcn.0054a17b
mov edx, dword [ebp - 0x14]
push dword [eax + 4]
push dword [eax]
mov eax, dword [edx + 0x48]
push ecx
mov ecx, esp
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
call fcn.005231a4
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x54d140
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 8
mov eax, 0xda7f2b
call fcn.00d1eedf
xor edi, edi
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [esi], edi
call fcn.004ac30d
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 1
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x54d1bd
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x54d1b7
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x54d1b7
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
shr eax, 1
lea ecx, [ebp - 0x14]
push eax
push ebx
call fcn.004ac281
push eax
mov ecx, esi
call fcn.004ad1ba
lea ecx, [ebp - 0x14]
call fcn.004ace26
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
call fcn.00d1eebc
ret

Function at 0x56a15a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
push 0x10
call ebx
movzx esi, ax
shr esi, 0xf
push 0x11
and esi, 1
call ebx
shr eax, 0xf
mov edi, esi
or edi, 2
and al, 1
push 0x12
cmove edi, esi
call ebx
mov ebx, edi
shr eax, 0xf
or ebx, 4
and al, 1
push 0xa5
cmove ebx, edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, ebx
call edi
shr eax, 0xf
test al, 1
je 0x56a1bc
push 0xa3
call edi
shr eax, 0xf
test al, 1
jne 0x56a1bc
and esi, 0xfffffffd
or esi, 4
mov eax, dword [0xe1cd00]
and eax, 0x70
pop edi
or eax, esi
pop esi
mov dword [0xe1cd00], eax
pop ebx
ret

Function at 0x56a97c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
and ecx, 1
mov eax, ebx
shl ecx, 4
mov edx, ecx
or edx, 0x20
and al, 2
mov eax, dword [0xe1cd00]
cmove edx, ecx
and eax, 0xffffff8f
mov ecx, edx
or ecx, 0x40
and bl, 0x10
pop ebx
cmove ecx, edx
or ecx, eax
mov dword [0xe1cd00], ecx
pop ebp
jmp fcn.0056a15a

Function at 0x5767ee
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0xda9cb8
call fcn.00d1ef12
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 0x14], ebx
call fcn.00576963
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
push edi
push ebx
push dword [ebp - 0x14]
push 0x57679d
push ebx
push ebx
call fcn.00d7aa0d
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x576835
call fcn.00d1eed0
ret 4
push 6
mov dword [edi], ebx
call fcn.00d1cf4d
int3
Function at 0x5c9a16
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0xc99754
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push 0xc9976d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0xc9a3b0
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
push eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], eax
add ecx, 0x14
push 0xdae41c
call fcn.0043a959
ret
Function at 0xd28cc0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
push edi
lea edi, [esi + eax]
cmp esi, edi
jae 0xd28cf6
mov al, byte [esi]
push eax
call fcn.00d37620
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0xd28cd8
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret
Function at 0xd359e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
jne 0xd35a00
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0xddfecc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0xddfedc
push esi
mov dword [ebp - 8], ebx
call fcn.00d8b69e
add esp, 8
test eax, eax
je 0xd35a4c
test ebx, ebx
je 0xd35a3c
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0xd35a75
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0xd35a75
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0xd35b38
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xd35a91
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0xe14374]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0xd35b2e
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0xd35b2e
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xd35ad0
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xd35af0
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0xd35b05
mov eax, dword [ebp - 8]
test eax, eax
je 0xd35b25
push 8
push 0
push ebx
call eax
jmp 0xd35b2c
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0xe14378]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0xd35b90
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0xe14344]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [ebp + 8], 2
je 0xd35be9
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0xd35bd6
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0xd35bd0
shr eax, 8
cmp al, 2
je 0xd35be9
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00d1eeae
mov esp, ebp
pop ebp
ret
call fcn.00d65b20
test eax, eax
jne 0xd35c4d
push str.iphlpapi.dll
call fcn.00d359e0
add esp, 4
mov dword [0xe1e0e8], eax
test eax, eax
je 0xd35c25
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0xe1e0e4]
test eax, eax
cmovne ecx, eax
mov dword [0xe1e0e4], ecx
push 3
push 2
push 0
push 0
push 6
call fcn.00d65730
add esp, 0x14
test al, al
setne byte [0xe1e8c4]
push 0xe1e8c8
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00d1eeae
mov esp, ebp
pop ebp
ret

Function at 0xd38570
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0xd3859b
cmp dword [esi + 0x84], 0
je 0xd3859b
push 2
push 3
push esi
call fcn.00d37d60
push dword [ebp + 0xc]
call fcn.00d38030
add esp, 0x10
jmp 0xd385aa
push dword [ebp + 0xc]
call fcn.00d38030
add esp, 4
test esi, esi
je 0xd385be
cmp dword [esi + 0x84], 0
je 0xd385be
push 3
push esi
call fcn.00d37da0
add esp, 8
pop esi
pop ebp
ret
Function at 0xd42d20
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0xd42d3b
cmp dword [edi], 0
jne 0xd42d4d
test esi, esi
je 0xd42d44
cmp dword [esi], 0
jne 0xd42d4d
test ebx, ebx
je 0xd42d96
cmp dword [ebx], 0
je 0xd42d96
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push eax
call fcn.00d6a290
add esp, 0xc
test ebx, ebx
je 0xd42d68
cmp dword [ebx], 0
jne 0xd42d6a
xor ebx, ebx
test esi, esi
je 0xd42d73
cmp dword [esi], 0
jne 0xd42d75
xor esi, esi
test edi, edi
je 0xd42d7e
cmp dword [edi], 0
jne 0xd42d80
xor edi, edi
push eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.00d42cd0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xd462b0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.00d29620
push dword [ebp + 8]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x10], xmm0
call fcn.00d44560
push dword [ebp + 0xc]
mov edi, eax
call fcn.00d44560
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0xd46337
lea eax, [ebp - 0x20]
push eax
call fcn.00d29620
movups xmm0, xmmword [ebp - 0x10]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.00d296d0
add esp, 0x20
test edx, edx
ja 0xd4635a
jb 0xd46325
cmp eax, 0x3e8
ja 0xd4635a
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push esi
push edi
call ebx
test eax, eax
je 0xd462f0
test edi, edi
je 0xd46344
push edi
call fcn.00d75412
add esp, 4
test esi, esi
je 0xd46351
push esi
call fcn.00d75412
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0xd46367
push edi
call fcn.00d75412
add esp, 4
test esi, esi
je 0xd46374
push esi
call fcn.00d75412
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xd46770
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0xd468ca
push esi
mov esi, dword [ebp - 0xc]
test esi, esi
je 0xd468b6
push edi
nop dword [eax]
mov eax, dword [esi + 0x14]
test eax, eax
je 0xd467cc
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xd467c0
sub eax, edx
inc eax
jmp 0xd467ce
xor eax, eax
cmp dword [esi + 4], 2
mov dword [ebp - 4], eax
jne 0xd46872
cmp dword [esi + 0x18], 0
je 0xd46872
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0xd46872
cmp ecx, 0x10
jb 0xd46872
add eax, 0x30
push eax
call dword [0xe14374]
mov edi, eax
add esp, 4
test edi, edi
je 0xd468ab
mov ecx, dword [esi]
lea edx, [edi + 0x20]
mov dword [edi], ecx
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0x10
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], edx
mov eax, dword [esi + 0x18]
movups xmm0, xmmword [eax]
movups xmmword [edx], xmm0
test ecx, ecx
je 0xd46860
lea eax, [edx + 0x10]
push ecx
mov dword [edi + 0x14], eax
push dword [esi + 0x14]
push eax
call fcn.00d70d30
add esp, 0xc
mov eax, dword [ebp - 8]
test ebx, ebx
cmove ebx, edi
test eax, eax
je 0xd4686f
mov dword [eax + 0x1c], edi
mov dword [ebp - 8], edi
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0xd467b0
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
pop edi
test eax, eax
je 0xd4688f
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0xd468b2
push ebx
call fcn.00d46740
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 8
jmp 0xd46880
test ebx, ebx
jne 0xd468c2
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xd46c30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.00d7aa0d
add esp, 0x18
test eax, eax
je 0xd46c52
cmp eax, 0xffffffff
jne 0xd46c54
xor eax, eax
pop ebp
ret

Function at 0xd46db0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00d712b0
add esp, 0xc
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
pop ebp
ret