joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42efed
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor edi, edi
push str.kernel32.dll
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, edi
je 0x42f088
push str.GetDiskFreeSpaceExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x42f088
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 8]
call eax
test eax, eax
je 0x42f088
mov eax, dword [ebp + 0x10]
sub eax, edi
je 0x42f06f
dec eax
je 0x42f062
dec eax
dec eax
mov eax, dword [ebp + 0xc]
je 0x42f058
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
jmp 0x42f083
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
jmp 0x42f053
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1c]
jmp 0x42f053
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
sbb edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor esi, esi
inc esi
jmp 0x42f0f0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x42f0ee
mov eax, dword [ebp - 0xc]
mul dword [ebp - 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
sub eax, edi
mov dword [esi + 4], edx
je 0x42f0d5
dec eax
je 0x42f0ca
dec eax
dec eax
je 0x42f0ca
push edx
push dword [esi]
push edi
push dword [ebp - 4]
jmp 0x42f0e2
push dword [esi + 4]
push dword [esi]
push edi
push dword [ebp - 8]
jmp 0x42f0e2
push dword [esi + 4]
mov eax, dword [ebp - 4]
push dword [esi]
sub eax, dword [ebp - 8]
push edi
push eax
call fcn.004b28e0
mov dword [esi], eax
mov dword [esi + 4], edx
jmp 0x42f083
xor esi, esi
cmp ebx, edi
je 0x42f0fb
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4316ee
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push str.wininet.dll
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
lea edi, [esi + 0x24]
mov dword [edi], eax
je 0x43184d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenA
push eax
call ebx
test eax, eax
mov dword [esi + 0x28], eax
je 0x431830
push str.InternetReadFile
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x34], eax
je 0x431830
push str.InternetCloseHandle
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x38], eax
je 0x431830
push str.InternetSetOptionA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x30], eax
je 0x431830
push str.InternetConnectA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x2c], eax
je 0x431830
push str.FtpFindFirstFileA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x3c], eax
je 0x431830
push str.FtpOpenFileA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x40], eax
je 0x431830
push str.FtpGetCurrentDirectoryA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x44], eax
je 0x431830
push str.FtpSetCurrentDirectoryA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x48], eax
je 0x431830
push str.FtpCreateDirectoryA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x4c], eax
je 0x431830
push str.FtpRemoveDirectoryA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x50], eax
je 0x431830
push str.FtpDeleteFileA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x54], eax
je 0x431830
push str.FtpRenameFileA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x58], eax
je 0x431830
push str.InternetFindNextFileA
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x5c], eax
je 0x431830
push str.InternetWriteFile
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x60], eax
je 0x431830
push str.FtpGetFileSize
push dword [edi]
call ebx
test eax, eax
mov dword [esi + 0x64], eax
jne 0x431849
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
push 0
push edi
call fcn.004b01f0
add esp, 0xc
xor eax, eax
jmp 0x43184c
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
ret
Function at 0x43a1a8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x50186e
call fcn.004b00d0
sub esp, 0x114
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
xor edx, edx
test eax, eax
jbe 0x43a1e7
movzx ebx, byte [edx + esi]
mov edi, ecx
shr edi, 9
xor edi, ecx
shr edi, 7
xor edi, ebx
shl ecx, 5
xor ecx, edi
inc edx
cmp edx, eax
jb 0x43a1cd
mov eax, ecx
mov edi, 0xbf
xor edx, edx
mov ecx, edi
div ecx
mov esi, edx
add esi, 0xb798
mov dword [ebp - 0x10], esi
call fcn.004d5230
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
mov ebx, 0x558fa0
jmp 0x43a229
add esi, edi
cmp esi, 0xd2ef
mov dword [ebp - 0x10], esi
ja 0x43a244
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.00439fa3
test eax, eax
jne 0x43a21c
cmp esi, 0xd2ef
jb 0x43a28a
mov esi, 0xd2f0
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.00439fa3
test eax, eax
je 0x43a28a
inc esi
cmp esi, 0xdea7
mov dword [ebp - 0x10], esi
jb 0x43a24c
or esi, 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040141b
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00401711
mov edi, dword [ebp + 0xc]
and dword [ebp - 0x14], 0
test edi, edi
je 0x43a301
cmp byte [edi], 0
je 0x43a301
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x43a301
push edi
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00406af8
add esp, 0xc
mov byte [ebp - 4], 1
call fcn.004f2040
mov eax, dword [eax + 8]
push 0x10
push 0x10
push 0x10
push 1
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov ecx, dword [ebp - 0x1c]
and byte [ebp - 4], 0
add ecx, 0xfffffff0
mov dword [ebp - 0x14], eax
call fcn.0040141b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.00439fce
mov ecx, eax
call fcn.00439f88
jmp 0x43a26e
Function at 0x44260f
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bx, word [ebp + 8]
push esi
xor esi, esi
cmp bx, si
jne 0x442634
push str.None
push dword [ebp + 0xc]
call fcn.004b0430
pop ecx
pop ecx
jmp 0x4426b4
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
test byte [eax + 0x551834], bh
je 0x442673
test esi, esi
je 0x44264f
mov byte [esi + edi], 0x2b
inc esi
mov ebx, dword [ebp - 4]
lea ebx, [ebx + 0x551838]
push dword [ebx]
lea eax, [esi + edi]
push eax
call fcn.004b0430
push dword [ebx]
call fcn.004b0250
mov bx, word [ebp + 8]
add esp, 0xc
add esi, eax
add dword [ebp - 4], 8
cmp dword [ebp - 4], 0x18
jb 0x44263b
test bl, bl
je 0x4426b3
test esi, esi
je 0x44268a
mov byte [esi + edi], 0x2b
inc esi
movzx eax, bl
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx ebx, bh
and ebx, 8
shl ebx, 5
push 0x80
or eax, ebx
add esi, edi
shl eax, 0x10
push esi
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x444eb3
Capabilities:
Set socket configuration

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [ecx + 4]
call sub.WSOCK32.dll_setsockopt
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 0x10
Function at 0x44a7b4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0xc]
push ebx
push esi
mov esi, dword [eax + 8]
mov edx, esi
xor ebx, ebx
or edx, ecx
push edi
jne 0x44a7da
call fcn.004189b4
mov ebx, eax
jmp 0x44a905
lea edx, [eax + 0x10]
mov edi, dword [edx]
cmp edi, 4
jne 0x44a836
cmp esi, 1
jne 0x44a7ed
test ecx, ecx
je 0x44a802
test ecx, ecx
jl 0x44a92b
jg 0x44a7fc
cmp esi, 2
jb 0x44a836
cmp dword [eax + 0x20], 4
je 0x44a836
push edx
push dword [ebp + 8]
call fcn.0044c683
pop ecx
pop ecx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x44a82a
push 0x50e6a4
push esi
call fcn.004b2301
pop ecx
pop ecx
mov ebx, eax
push esi
call fcn.00418c05
pop ecx
jmp 0x44a905
test ecx, ecx
jl 0x44a92b
jg 0x44a849
cmp esi, 2
jb 0x44a92b
cmp edi, 4
jne 0x44a92b
lea esi, [eax + 0x20]
cmp dword [esi], edi
jne 0x44a92b
push edx
push dword [ebp + 8]
call fcn.0044c683
push esi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.0044c683
mov edi, eax
push edi
call fcn.004b0250
inc eax
inc eax
push eax
push 1
push dword [ebp + 8]
call fcn.00418b73
and dword [ebp - 8], 0
and dword [ebp + 0x10], 0
mov ebx, eax
push edi
mov dword [ebp - 4], ebx
call fcn.004b0250
add esp, 0x24
test eax, eax
jbe 0x44a8d5
mov esi, edi
sub ebx, edi
mov al, byte [esi]
cmp al, 0x62
je 0x44a8b4
cmp al, 0x74
je 0x44a8b4
mov byte [ebx + esi], al
jmp 0x44a8bf
mov byte [ebx + esi], 0x62
mov dword [ebp - 8], 1
inc dword [ebp + 0x10]
push edi
inc esi
call fcn.004b0250
cmp dword [ebp + 0x10], eax
pop ecx
jb 0x44a8a5
cmp dword [ebp - 8], 0
jne 0x44a8df
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov byte [eax + ecx], 0x62
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.004b2301
push dword [ebp - 0xc]
mov ebx, eax
call fcn.00418c05
push edi
call fcn.00418c05
push dword [ebp - 4]
call fcn.00418c05
add esp, 0x14
test ebx, ebx
je 0x44a92b
push 4
push 1
push dword [ebp + 8]
call fcn.00418b73
push eax
push dword [ebp + 0xc]
mov dword [eax], ebx
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0049cb3d
add esp, 0x1c
jmp 0x44a934
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44ca0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [ebp - 8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push dword [ebp - 4]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x100
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xf
push dword [ebp - 4]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call ebx
rdtsc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
push 0x1f4
call ebx
rdtsc
sub eax, dword [ebp - 0xc]
sbb edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
push dword [ebp - 0x14]
push dword [ebp - 4]
call edi
push dword [ebp - 0x18]
push dword [ebp - 8]
call esi
fild dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
test eax, eax
jge 0x44caa1
fadd qword [0x506a50]
fmul qword [0x50e9e8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x450e1a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x450e28
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x450efc
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x50f068]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x50f068]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x50f068]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x50f068]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x50f068]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x50f068]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x50f068]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x50f068]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x450e45
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x450f1c
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x50f068]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x450f02
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x45146f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x24]
push esi
mov ecx, dword [edi + 0x64]
mov eax, dword [edi + 0x34]
mov edx, dword [edi + 0x6c]
sub eax, ecx
sub eax, edx
mov dword [ebp - 4], eax
jne 0x451496
test ecx, ecx
jne 0x4514a0
test edx, edx
jne 0x4514a0
mov eax, ebx
jmp 0x45150c
cmp eax, 0xffffffff
jne 0x4514a0
push 0xfffffffffffffffe
pop eax
jmp 0x45150c
mov edx, dword [edi + 0x24]
lea edx, [ebx + edx - 0x106]
cmp ecx, edx
jb 0x45150c
mov eax, dword [edi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004af940
mov ecx, dword [edi + 0x44]
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
add esp, 0xc
sub dword [edi + 0x54], ebx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov esi, edx
sub esi, ebx
cmp edx, ebx
sbb edx, edx
not edx
and edx, esi
dec ecx
mov word [eax], dx
jne 0x4514d1
mov eax, dword [edi + 0x38]
mov edx, ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov esi, ecx
sub esi, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, esi
dec edx
mov word [eax], cx
jne 0x4514f0
mov eax, dword [ebp - 4]
add eax, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x451565
push eax
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
push eax
call fcn.0045125d
add dword [edi + 0x6c], eax
mov esi, dword [edi + 0x6c]
cmp esi, 3
pop ecx
pop ecx
jb 0x451551
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x30]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x50]
mov dword [edi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x4c]
mov dword [edi + 0x40], eax
cmp esi, 0x106
jae 0x451565
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x451478
pop esi
pop ebx
leave
ret

Function at 0x452da6
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 5
pop edi
jae 0x452de4
cmp dword [ebp - 0x18], 4
jne 0x452de0
cmp dword [ebp - 0x14], 0x5a
jae 0x452de4
push 0x4c
jmp 0x452de6
push 0x58
pop eax
add ebp, 0x78
leave
ret
Function at 0x45fa3f
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x45fa6c
push esi
call fcn.00464146
cmp byte [esi + 0x40], 0
pop ecx
je 0x45fa65
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x45fadb
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x45fad0
mov eax, dword [esi + 8]
test eax, eax
je 0x45fa8d
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x190]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x45facc
cmp eax, 2
je 0x45fad0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45fa82
cmp eax, 3
je 0x45fab1
cmp eax, 1
jne 0x45fa82
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x45fa82
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45fa82
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x45faf9
cmp eax, 0xcc
je 0x45faf9
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.0045f912
pop esi
ret

Function at 0x46aa2a
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor ecx, ecx
cmp dword [esp + 8], eax
jbe 0x46aa56
push esi
mov esi, dword [esp + 8]
movzx esi, byte [ecx + esi]
mov edx, eax
shr edx, 9
xor edx, eax
shr edx, 7
xor edx, esi
shl eax, 5
xor eax, edx
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x46aa35
pop esi
ret
Function at 0x46bf02
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x2e
push dword [ebp + 8]
call fcn.004b2cd0
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 8], 0x40
je 0x46bf60
lea ecx, [ebp - 4]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x46bf60
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push 0
push 0
push str.Content_Type
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push dword [ebp - 4]
jne 0x46bf5a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.application_octet_stream
push dword [ebp + 0xc]
call fcn.004b0430
pop ecx
pop ecx
leave
ret

Function at 0x46cbfa
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push 3
pop ebx
cmp edi, ebx
jb 0x46cc89
xor edx, edx
mov esi, ebx
mov eax, edi
div esi
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], eax
shl eax, 2
mov dword [ebp - 4], eax
movzx eax, byte [ecx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
movzx edx, byte [ecx + 1]
xor eax, eax
mov al, byte [ecx]
shr edx, 4
inc esi
sub edi, ebx
and eax, ebx
shl eax, 4
or eax, edx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
movzx edx, byte [ecx + 2]
xor eax, eax
mov al, byte [ecx + 1]
shr edx, 6
inc esi
and eax, 0xf
shl eax, 2
or eax, edx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
xor eax, eax
mov al, byte [ecx + 2]
inc esi
add ecx, ebx
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
inc esi
dec dword [ebp + 0xc]
jne 0x46cc26
jmp 0x46cc8c
mov esi, dword [ebp + 8]
test edi, edi
jbe 0x46cce4
movzx eax, byte [ecx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
mov dl, byte [ecx]
and dl, bl
inc esi
shl dl, 4
cmp edi, 1
jbe 0x46ccb3
mov al, byte [ecx + 1]
shr al, 4
or dl, al
movzx eax, dl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
inc esi
cmp edi, 2
jae 0x46ccc9
push 0x3d
pop ecx
jmp 0x46ccd9
xor eax, eax
mov al, byte [ecx + 1]
and eax, 0xf
movsx ecx, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
inc esi
mov byte [esi], 0x3d
inc esi
add dword [ebp - 4], 4
and byte [esi], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46dad5
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push 6
push 1
push 2
mov dword [ebp - 4], 0xea60
call sub.WSOCK32.dll_socket
mov edi, eax
or ebx, 0xffffffff
cmp edi, ebx
je 0x46db82
push esi
push 4
lea eax, [ebp - 4]
push eax
push 0x1005
mov esi, 0xffff
push esi
push edi
call sub.WSOCK32.dll_setsockopt
push 4
lea eax, [ebp - 4]
push eax
push 0x1006
push esi
push edi
call sub.WSOCK32.dll_setsockopt
push dword [ebp + 0xc]
call sub.WSOCK32.dll_htons
push dword [ebp + 8]
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
call sub.WSOCK32.dll_gethostbyname
test eax, eax
pop esi
je 0x46db5d
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.004af940
add esp, 0xc
jmp 0x46db6c
push dword [ebp + 8]
call sub.WSOCK32.dll_inet_addr
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x46db7c
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call sub.WSOCK32.dll_connect
cmp eax, ebx
jne 0x46db86
push edi
call sub.WSOCK32.dll_closesocket
mov eax, ebx
jmp 0x46db88
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x46db8c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
xor esi, esi
cmp dword [ebp + 0x10], edi
jle 0x46dbbf
mov eax, dword [ebp + 0x10]
push edi
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x46dbc6
cmp eax, edi
je 0x46dbc6
add esi, eax
cmp esi, dword [ebp + 0x10]
jl 0x46db9a
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret
cmp dword [ebp + 0x14], edi
je 0x46dc0f
push edi
push 0x100
lea eax, [ebp + 0x10]
push eax
mov dword [ebp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
call sub.WSOCK32.dll_WSAGetLastError
push eax
push edi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp dword [ebp + 0x10], edi
je 0x46dc0f
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push edi
call dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x46dbc2
Function at 0x46dc13
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
xor esi, esi
push edi
jmp 0x46dc7d
cmp eax, ebx
je 0x46dc8a
add esi, eax
cmp esi, dword [ebp + 0x10]
lea ecx, [esi + edi]
mov byte [ecx], bl
jge 0x46dcda
cmp esi, 2
jl 0x46dc75
cmp byte [esi + edi - 2], 0xd
jne 0x46dc75
cmp byte [edi + esi - 1], 0xa
jne 0x46dc75
lea eax, [esi - 3]
cmp eax, ebx
jl 0x46dc69
cmp byte [edi + eax], 0xa
jne 0x46dc62
cmp byte [edi + eax - 1], 0xd
je 0x46dc65
dec eax
jns 0x46dc55
cmp eax, ebx
jge 0x46dc6d
xor eax, eax
jmp 0x46dc6e
inc eax
cmp byte [eax + edi + 3], 0x20
je 0x46dcda
mov eax, dword [ebp + 0x10]
push ebx
sub eax, esi
push eax
push ecx
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x46dc27
cmp dword [ebp + 0x14], ebx
je 0x46dcd3
push ebx
push 0x100
lea eax, [ebp + 0x10]
push eax
mov dword [ebp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
call sub.WSOCK32.dll_WSAGetLastError
push eax
push ebx
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp dword [ebp + 0x10], ebx
je 0x46dcd3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push ebx
call dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp dword [ebp + 0x14], ebx
je 0x46dceb
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
push 1
call dword [ebp + 0x14]
lea eax, [esi + edi]
cmp byte [eax - 2], 0xd
jne 0x46dcd3
cmp byte [eax - 1], 0xa
jne 0x46dcd3
xor eax, eax
inc eax
jmp 0x46dcd5