joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8f80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6a4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
push fcn.00401b70
push fcn.00401b20
push 0xb
push 4
lea eax, [ebp - 0x58]
push eax
call fcn.0057ab2e
mov byte [ebp - 4], 1
push str.C:Program_FilesPioletMy_Shared_Folder
lea ecx, [ebp - 0x58]
call fcn.004055d0
push str.C:Program_FileseMuleIncoming
lea ecx, [ebp - 0x54]
call fcn.004055d0
push str.C:Program_FileseDonkey2000incoming
lea ecx, [ebp - 0x50]
call fcn.004055d0
push str.C:Program_FilesAresMy_Shared_Folder
lea ecx, [ebp - 0x4c]
call fcn.004055d0
push str.C:Program_FilesmorpheusMy_Shared_Folder
lea ecx, [ebp - 0x48]
call fcn.004055d0
push str.C:Program_FilesVagaaDownloads
lea ecx, [ebp - 0x44]
call fcn.004055d0
push str.C:Program_FilesKazaaMy_Shared_Folder
lea ecx, [ebp - 0x40]
call fcn.004055d0
push str.C:Program_FilesPocoDownloads
lea ecx, [ebp - 0x3c]
call fcn.004055d0
push str.C:Program_FilesOpenExtDownloads
lea ecx, [ebp - 0x38]
call fcn.004055d0
push str.C:Program_FilesPPDownloads
lea ecx, [ebp - 0x34]
call fcn.004055d0
push str.C:Program_Files_vMuleIncoming
lea ecx, [ebp - 0x30]
call fcn.004055d0
mov dword [ebp - 0x18], esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea esp, [esp]
cmp esi, 0xb
jge 0x4e90b8
mov eax, dword [ebp + esi*4 - 0x58]
mov dword [ebp - 0x1c], eax
push eax
lea ecx, [ebp - 0x14]
call fcn.00401f30
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
push eax
call edi
mov ebx, eax
mov dword [ebp - 0x28], ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b70
cmp ebx, 0xffffffff
je 0x4e90b2
test bl, 0x10
je 0x4e90b2
mov eax, dword [ebp + esi*4 - 0x58]
mov dword [ebp - 0x2c], eax
push eax
mov ecx, dword [0x6613fc]
call fcn.00487a40
inc esi
mov dword [ebp - 0x18], esi
jmp 0x4e9060
mov byte [ebp - 4], 0
push fcn.00401b70
push 0xb
push 4
lea ecx, [ebp - 0x58]
push ecx
call fcn.0057988b
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4edde0
Capabilities:
Check for time delay via gettickcount
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, dword [ebp + 0x14]
imul ebx, ebx, 0x3e8
xor esi, esi
add ebx, eax
call edi
cmp eax, ebx
ja 0x4ede86
mov edi, dword [ebp + 8]
lea ecx, [ecx]
lea eax, [esp + 0x10]
push eax
push 0
lea ecx, [esp + 0x128]
push ecx
push 0
lea eax, [edi + 1]
push eax
mov dword [esp + 0x138], edi
mov dword [esp + 0x134], 1
mov dword [esp + 0x24], 5
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jl 0x4edece
je 0x4ede7c
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 0
sub edx, esi
push edx
lea ecx, [esi + eax]
push ecx
push edi
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x4edf0e
add esi, eax
cmp esi, dword [ebp + 0x10]
jae 0x4edf4e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebx
jbe 0x4ede10
xor eax, eax
jmp 0x4ede90
mov cl, byte [eax + str.Timeout]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x4ede90
push 0x63375c
lea edx, [esp + 0xa0]
mov ecx, 0x21
lea esi, [esp + 0x1c]
lea edi, [esp + 0xa0]
mov dword [esp + 0x9c], 0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.0057a113
xor eax, eax
mov cl, byte [eax + str.Socket]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x4eded0
push 0x63374c
lea eax, [esp + 0xa0]
mov ecx, 0x21
lea esi, [esp + 0x1c]
lea edi, [esp + 0xa0]
mov dword [esp + 0x9c], 0
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0057a113
xor eax, eax
mov cl, byte [eax + str.Socket]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x4edf10
mov ecx, 0x21
lea esi, [esp + 0x18]
lea edi, [esp + 0x9c]
mov dword [esp + 0x98], 0
rep movsd dword es:[edi], dword [esi]
push 0x63374c
lea ecx, [esp + 0xa0]
push ecx
call fcn.0057a113
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ee6b8
Capabilities:
Terminate thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d72a8
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x844]
test eax, eax
je 0x4ee77e
mov eax, dword [esi + 0x850]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
push eax
mov dword [esi + 0x848], 0
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 5
mov ecx, dword [esi + 0x844]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4ee722
cmp dword [esp + 0x10], 0x103
jne 0x4ee722
push 0x64
call ebx
mov eax, dword [esi + 0x850]
push eax
call ebp
dec edi
test edi, edi
jg 0x4ee6f0
xor ebp, ebp
cmp edi, ebp
jne 0x4ee775
push 1
lea edx, [esi + 0x854]
push edx
lea ecx, [esp + 0x1c]
call fcn.005789d4
mov dword [esp + 0x28], ebp
mov eax, dword [esi + 0x844]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push str.WARNING:_Terminating_Vagaaa_Neighbour_Server_thread.
push 3
push 0x661308
call fcn.0046abf0
add esp, 0xc
push 0x64
call ebx
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0057897a
pop edi
mov dword [esi + 0x844], ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4f0e50
Capabilities:
Check for time delay via gettickcount
Get number of processors

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x5d76a6
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov esi, ecx
call ebp
mov dword [esi + 0x88c], eax
mov ecx, dword [0x661414]
push 1
lea eax, [esi + 0x8bc]
push eax
push 0x1a0a
push str.tou.downbt.com
call fcn.00492e80
mov dword [0x661674], 1
call ebp
mov dword [esi + 0x30], eax
mov dword [esi + 0x88c], eax
xor ebx, ebx
call ebp
mov eax, dword [esi + 0x848]
test eax, eax
je 0x4f0ff0
mov eax, dword [esi + 0x850]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call ebp
mov edi, eax
test byte [0x66165c], 1
mov dword [esi + 0x88c], edi
jne 0x4f0f04
or dword [0x66165c], 1
mov dword [esp + 0x20], 0
mov eax, dword [esi + 0x30]
mov dword [0x661658], eax
mov dword [esp + 0x20], 0xffffffff
jmp 0x4f0f09
mov eax, dword [0x661658]
mov ecx, edi
sub ecx, eax
cmp ecx, 0xea60
jbe 0x4f0f2e
test eax, eax
jbe 0x4f0f2e
cmp edi, eax
jbe 0x4f0f2e
push 0
push ecx
call fcn.004d2f10
add esp, 8
mov dword [0x661658], edi
cmp dword [esi + 0x88c], 0xea60
jbe 0x4f0fd7
push 0
push str.SetupName
lea ecx, [esp + 0x18]
push 0x5e3704
push ecx
call fcn.004a5b30
mov dword [esp + 0x30], 1
push 0
push str.NeedRunSetup
push 0x5e3704
call fcn.004a5670
add esp, 0x1c
test eax, eax
je 0x4f0fb1
call ebp
sub eax, dword [0x6613b8]
sub eax, ebx
cmp eax, 0x5265c00
jbe 0x4f0fb1
call ebp
mov edx, dword [0x6613b8]
push ecx
mov ebx, eax
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x5fdc88
sub ebx, edx
call fcn.00406630
mov byte [esp + 0x24], 1
mov ecx, 0x661308
call fcn.004e74c0
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4f0fd7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [0x661418]
call fcn.004f0290
mov eax, dword [esi + 0x848]
test eax, eax
jne 0x4f0ec1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x4f2760
Capabilities:
Download url
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x5d7910
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
push edi
mov dword [esp + 0x1c], 1
mov edi, dword [esp + 0x24]
mov eax, dword [edi - 0xc]
test eax, eax
jl 0x4f27a8
push str.http:__
push edi
call fcn.0057d120
add esp, 8
test eax, eax
je 0x4f27a8
sub eax, edi
mov dword [esp + 0x10], eax
jns 0x4f27fd
push str.http:__
lea ecx, [esp + 0x14]
call fcn.00460950
mov byte [esp + 0x1c], 2
lea ecx, [esp + 0x24]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
call fcn.004d0420
add esp, 0xc
mov byte [esp + 0x1c], 3
push eax
lea ecx, [esp + 0x28]
call fcn.00495070
mov byte [esp + 0x1c], 2
lea ecx, [esp + 0xc]
call fcn.00401b70
mov byte [esp + 0x1c], 1
lea ecx, [esp + 0x10]
call fcn.00401b70
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
push ebp
lea ecx, [esp + 0x14]
call fcn.00401f30
mov byte [esp + 0x1c], 4
mov eax, dword [eax]
push 0
push 0
push eax
push edi
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov esi, eax
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f2844
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
neg esi
sbb esi, esi
mov byte [esp + 0x1c], 0
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f2867
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov dword [esp + 0x1c], 0xffffffff
lea eax, [ebp - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f2889
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4f3970
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edi
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Directory_shell_
push 0x80000000
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x4f39f1
mov ecx, dword [esp + 8]
push ecx
call edi
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5fe214
push 0x80000000
call esi
test eax, eax
jne 0x4f39f1
push 0x1d
push str.explorer__vagaa:__share_1_
push 1
push eax
mov eax, dword [esp + 0x18]
push 0x5e418a
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call edi
call fcn.0052e5e0
cmp eax, 4
je 0x4f3a33
lea edx, [esp + 0xc]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push 0x80000002
mov dword [esp + 0x18], 0
call dword [0x652b0c]
test eax, eax
jne 0x4f3a33
mov eax, dword [esp + 0xc]
push str.889D2FEB_5411_4565_8998_1DD2C5261283
push eax
call dword [0x652af8]
mov ecx, dword [esp + 0xc]
push ecx
call edi
push 1
push 0x80
push 0x5e8040
push 0x5e3704
push 0
push str.URL:Vagaa_P2P
push 0x5e3704
call fcn.004f2340
push 1
push 0x80
push 0x5e8040
push 0x5e3704
push 0
push str.URL:eDonkey2000_Protocol
push str.ed2k
call fcn.004f2340
push 1
push 0x80
push 0x5e8040
push 0x5e3704
push 0
push str.URL:vagaa_Protocol
push 0x5e3704
call fcn.004f2340
add esp, 0x54
push 1
push 0x80
push str.VGTT
push 0x5e3704
push str..vgtt
push str.VGTT
push str.VGTT
call fcn.004f2340
mov edx, dword [0x6613bc]
mov eax, dword [edx + 0x418]
add esp, 0x1c
test eax, eax
pop edi
pop esi
je 0x4f3b02
push 1
push 0x80
push str.TORRENT
push 0x5e3704
push 0x5ea260
push str.TORRENT_File
push str.bittorrent
call fcn.004f2340
add esp, 0x1c
add esp, 8
ret
push str.bittorrent
call fcn.004f1630
add esp, 4
add esp, 8
ret
Function at 0x4f68c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d7d50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov bl, byte [edi + 0x88c]
mov ecx, 0x671698
call fcn.00407480
mov esi, eax
mov al, byte [esp + 0x30]
mov byte [esi + 0x36], bl
push str.Transfer
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov byte [esi + 0x34], 0xc5
mov byte [esi + 0x35], al
lea ebx, [esi + 0x30]
call fcn.0057a0fd
add esp, 4
push eax
push str.Transfer
mov ecx, ebx
call fcn.004053c0
push 0x30
mov ecx, esi
call fcn.00406fc0
push 1
mov ecx, esi
call fcn.00406fc0
mov edx, dword [0x6613bc]
mov eax, dword [edx + 0x330]
xor ecx, ecx
test eax, eax
setne cl
add ecx, 5
push ecx
mov ecx, esi
call fcn.004070a0
push 4
push 0x26
lea ecx, [esp + 0x14]
call fcn.00500860
mov dword [esp + 0x28], 0
push esi
mov ecx, eax
call fcn.00500640
or ebx, 0xffffffff
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0xc]
call fcn.004076d0
push 1
push 0x20
lea ecx, [esp + 0x14]
call fcn.00500860
mov dword [esp + 0x28], 1
push esi
mov ecx, eax
call fcn.00500640
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0xc]
call fcn.004076d0
push 2
push 0x23
lea ecx, [esp + 0x14]
call fcn.00500860
mov dword [esp + 0x28], 2
push esi
mov ecx, eax
call fcn.00500640
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0xc]
call fcn.004076d0
mov eax, dword [0x6613bc]
mov ecx, dword [eax + 0x330]
test ecx, ecx
je 0x4f6a12
push 1
push 0x25
lea ecx, [esp + 0x14]
call fcn.00500860
mov dword [esp + 0x28], 3
push esi
mov ecx, eax
call fcn.00500640
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0xc]
call fcn.004076d0
push 2
push 0x22
lea ecx, [esp + 0x14]
call fcn.00500860
mov dword [esp + 0x28], 4
push esi
mov ecx, eax
call fcn.00500640
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0xc]
call fcn.004076d0
mov ecx, dword [0x661414]
xor edx, edx
mov dx, word [ecx + 0x16]
push edx
call dword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
push eax
push 0x21
lea ecx, [esp + 0x14]
call fcn.00500860
mov dword [esp + 0x28], 5
push esi
mov ecx, eax
call fcn.00500640
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0xc]
call fcn.004076d0
push 1
push esi
mov ecx, edi
call fcn.004f4480
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x4fdc00
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d8668
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, dword [esp + 0x20]
mov edx, dword [esi + 0x10]
inc edx
mov eax, edx
cmp eax, 1
push edi
mov edi, ecx
mov dword [esi + 0x10], edx
jbe 0x4fdc4d
dec dword [esi + 0xc]
jne 0x4fdcb1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
pop edi
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
cmp eax, 2
jae 0x4fdc5a
inc dword [edi + 0x82c]
jmp 0x4fdc60
inc dword [edi + 0x830]
push 1
lea ecx, [edi + 0x878]
push ecx
lea ecx, [esp + 0x10]
call fcn.005789d4
mov dword [esp + 0x1c], 0
mov eax, dword [edi + 0x8a0]
lea ecx, [edi + 0x898]
push esi
push eax
call fcn.005aa24c
cmp dword [esi + 0x10], 2
jae 0x4fdca0
mov edx, dword [edi + 0x874]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 8]
call fcn.0057897a
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4

Function at 0x4fe6f9
Capabilities:
Terminate thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d8668
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x868]
xor ebp, ebp
cmp eax, ebp
je 0x4fe811
cmp dword [esi + 0x794], 7
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
mov edi, 6
jne 0x4fe797
cmp dword [esi + 0x8ac], ebp
je 0x4fe797
push 0x5ff880
call fcn.004a7dc0
mov ebp, eax
mov eax, dword [0x661418]
add esp, 4
push 0x24
add eax, 0x7e4
push eax
mov ecx, ebp
call fcn.00406f10
push ebp
mov ecx, esi
call fcn.004fdc00
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4fe760
mov edx, dword [esi + 0x868]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4fe795
cmp dword [esp + 0x10], 0x103
jne 0x4fe795
mov eax, dword [esi + 0x874]
push eax
call ebx
push 0x1f4
call ebp
dec edi
test edi, edi
jg 0x4fe760
xor ebp, ebp
mov eax, dword [esi + 0x874]
push eax
mov dword [esi + 0x86c], ebp
call ebx
cmp edi, ebp
pop edi
pop ebx
je 0x4fe7b4
cmp dword [esi + 0x8ac], ebp
jne 0x4fe7e0
mov eax, dword [esi + 0x868]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push str.WARNING:_Terminating_Vagaaa_Neighbour_Server_thread.
push 3
push 0x661308
call fcn.0046abf0
mov eax, dword [esi + 0x8ac]
add esp, 0xc
cmp eax, ebp
je 0x4fe80b
push 1
push 0x661678
lea ecx, [esp + 0x14]
call fcn.005789d4
mov dword [esp + 0x20], ebp
mov dword [0x66166c], ebp
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.0057897a
mov dword [esi + 0x868], ebp
mov ecx, dword [esp + 0x18]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4ff280
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5d8770
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
mov esi, ecx
mov edi, 1
mov dword [esi + 0x794], 7
mov dword [esi + 0x8ac], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x30], eax
inc dword [0x661668]
mov eax, dword [esi + 0x20]
push eax
push str.Login_Vagaa_Search_:__s
push 0x661308
call fcn.004e9a20
mov eax, dword [0x6613e8]
add esp, 0xc
push edi
add eax, 0xc
push eax
lea ecx, [esp + 0x14]
call fcn.005789d4
mov dword [esp + 0x20], 0
mov ecx, dword [0x6613e8]
mov eax, dword [ecx + 0x34]
or ebp, 0xffffffff
test eax, eax
jne 0x4ff358
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4ff310
lea ecx, [esp + 0xc]
call fcn.0057897a
push 0x64
call edi
mov dword [esp + 0x20], ebp
lea ecx, [esp + 0xc]
call fcn.0057897a
mov edx, dword [0x6613e8]
push 1
add edx, 0xc
push edx
lea ecx, [esp + 0x14]
call fcn.005789d4
mov dword [esp + 0x20], 0
mov eax, dword [0x6613e8]
mov ecx, dword [eax + 0x34]
test ecx, ecx
je 0x4ff310
mov edi, 1
mov dword [esp + 0x20], ebp
lea ecx, [esp + 0xc]
call fcn.0057897a
mov ecx, esi
call fcn.004fe830
mov ecx, dword [0x66160c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
push 0x661678
lea ecx, [esp + 0x14]
call fcn.005789d4
mov dword [esp + 0x20], edi
mov dword [0x66166c], edi
mov dword [esp + 0x20], ebp
lea ecx, [esp + 0xc]
call fcn.0057897a
mov ecx, dword [0x661410]
call fcn.004d2090
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x4fff40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, ecx
mov dword [edi + 0x794], 7
call esi
mov dword [esp + 0xc], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x86c]
xor ebx, ebx
cmp eax, ebx
je 0x500060
push ebp
mov eax, dword [edi + 0x874]
push 0x64
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, edi
call fcn.004fdcd0
mov esi, eax
cmp esi, ebx
je 0x4fffc7
mov eax, dword [esi + 0x30]
push 0x5ff880
push eax
call fcn.0057a418
add esp, 8
test eax, eax
jne 0x4fffaa
mov ebp, 1
push esi
mov ecx, edi
call fcn.004ff990
mov ecx, edi
call fcn.004fdcd0
mov esi, eax
cmp esi, ebx
jne 0x4fff90
cmp ebp, ebx
jne 0x50005f
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
sub eax, dword [esp + 0x10]
cmp eax, 0x124f80
jb 0x500053
cmp dword [edi + 0x8ac], ebx
je 0x500053
mov ecx, 0x671698
call fcn.00407480
mov esi, eax
push str.KeepAlive
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
call fcn.0057a0fd
add esp, 4
push eax
push str.KeepAlive
lea ecx, [esi + 0x30]
call fcn.004053c0
mov byte [esi + 0x36], bl
mov ecx, dword [0x661418]
add ecx, 0x7e4
push 0x24
push ecx
mov ecx, esi
call fcn.00406f10
mov edx, dword [edi + 0x20]
push edx
push str.Send_KeepAlive_To_Search_Server__s
push 0x661308
call fcn.004e9a20
add esp, 0xc
push esi
mov ecx, edi
call fcn.004fdc00
call ebp
mov ecx, edi
mov dword [esp + 0x10], eax
call fcn.004fe830
cmp dword [edi + 0x86c], ebx
jne 0x4fff72
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x500750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d883b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x5ffcfc
mov dword [esp + 0x14], 1
mov eax, dword [0x671690]
dec eax
xor cl, cl
mov dword [0x671690], eax
mov byte [esp + 0x14], cl
lea eax, [esi + 0x30]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
mov eax, dword [eax]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5007b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov dword [esp + 0x14], 0xffffffff
mov ecx, esi
call fcn.00498d40
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x505ff0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push esi
mov esi, ecx
mov eax, dword [esi + 0x8a0]
test eax, eax
je 0x50603e
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x506025
mov eax, dword [esi + 0x8b4]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
pop esi
add esp, 0x28
ret 0xc
mov ecx, dword [esi + 0x8b0]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
pop esi
add esp, 0x28
ret 0xc
lea edx, [esp + 4]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0x1c]
lea edx, [esp + 4]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [esi + 0x89c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x898]
sub eax, edx
mov edx, dword [esp + 0x10]
sub eax, ecx
mov ecx, dword [esp + 0x14]
sub eax, edx
sub ecx, dword [esi + 0x894]
mov edx, dword [esp + 0xc]
push eax
sub ecx, edx
sub ecx, 6
push ecx
add eax, 0xfffffffa
push eax
push 0
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x5060e5
call fcn.005c0c6b
push 0x7f85
push 0
call dword [0x652d20]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
pop esi
add esp, 0x28
ret 0xc
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0051b4d0
pop esi
add esp, 0x28
ret 0xc

Function at 0x50e040
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x12c
mov eax, dword [0x64aa84]
mov dword [esp + 0x128], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x114
call dword [0x652c10]
test eax, eax
je 0x50e0ca
cmp dword [esp + 0x24], 2
jne 0x50e0c0
lea ecx, [esp]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x50e0ca
lea edx, [esp + 8]
push edx
push 0x602d90
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp]
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
push ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 9
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [esp + 0x128]
call fcn.0057981f
add esp, 0x12c
ret