joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59d900
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
mov edx, dword [eax]
call dword [edx]
xor edx, edx
push ebp
push 0x59d9db
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
cmp byte [ebp + 8], 0
jne 0x59d952
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0xc]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x14]
jae 0x59d952
mov byte [ebp - 5], 1
call fcn.004050a8
jmp 0x59d9e2
push ebx
push esi
push 1
mov ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.0059d810
test al, al
je 0x59d9bb
push 0xc8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x59d9b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
cmp byte [eax], 4
jne 0x59d9a6
mov byte [ebp - 5], 1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
push eax
call sub.kernel32.dll_ReleaseMutex
jmp 0x59d9c2
call fcn.004050a8
jmp 0x59d9e2
call fcn.004050a8
jmp 0x59d9e2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59d9e2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
mov edx, dword [eax]
call dword [edx + 4]
ret
movzx eax, byte [ebp - 5]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x59e2d4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
xor eax, eax
mov dword [ebp - 0x98], eax
xor eax, eax
push ebp
push 0x59e48d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x758ca0], eax
xor eax, eax
mov dword [0x758c9c], eax
xor eax, eax
mov dword [fcn.00758c94], eax
push 0x59e498
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [0x68b89c], eax
cmp dword [0x68b89c], 0
je 0x59e396
push 0x59e4a0
mov eax, dword [0x68b89c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [fcn.00758c94], eax
cmp dword [fcn.00758c94], 0
jne 0x59e474
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x84], 2
jne 0x59e36a
cmp dword [ebp - 0x90], 4
je 0x59e36e
xor eax, eax
jmp 0x59e370
mov al, 1
test al, al
jne 0x59e389
push 0x59e4b4
mov eax, dword [0x68b89c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [fcn.00758c94], eax
cmp dword [fcn.00758c94], 0
jne 0x59e474
mov eax, dword [0x6909dc]
cmp byte [eax], 0
jne 0x59e474
lea ecx, [ebp - 0x98]
mov edx, 0x59e4cc
mov eax, 0x59e4d8
call fcn.0059e20c
mov edx, dword [ebp - 0x98]
mov eax, 0x68b898
call fcn.004056d8
mov edx, dword [0x68b898]
mov eax, 0x65
call fcn.0059e138
mov eax, dword [0x68b898]
call fcn.00405b74
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x68b894], eax
push 0x59e4dc
mov eax, dword [0x68b894]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x758c98], eax
push 0x59e4e4
mov eax, dword [0x68b894]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x758c9c], eax
push 0x59e4f0
mov eax, dword [0x68b894]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x758ca0], eax
cmp dword [0x758c98], 0
je 0x59e466
cmp dword [0x758c9c], 0
je 0x59e466
cmp dword [0x758ca0], 0
je 0x59e466
call dword [0x758c98]
test al, al
jne 0x59e474
call dword [0x758c9c]
test al, al
je 0x59e466
call dword [0x758c98]
test al, al
jne 0x59e474
xor eax, eax
mov dword [0x758ca0], eax
xor eax, eax
mov dword [0x758c9c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59e494
lea eax, [ebp - 0x98]
call fcn.00405684
ret

Function at 0x59e58c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
cmp dword [0x68b898], 0
je 0x59e60d
mov dword [ebp - 4], 0xa
xor edx, edx
push ebp
push 0x59e5e8
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [0x68b898]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
call fcn.00405b74
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x59e5de
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x59e60d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x59e5f2
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x691520]
mov eax, dword [eax]
call fcn.004582b0
dec dword [ebp - 4]
jne 0x59e5a5
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x59e69c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b64
xor eax, eax
push ebp
push 0x59e849
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
jmp 0x59e6d8
lea eax, [ebp - 4]
mov edx, 0x59e860
call fcn.0040597c
inc esi
mov eax, dword [ebp - 4]
call fcn.00405970
cmp eax, 3
jl 0x59e6ca
jmp 0x59e6f5
lea eax, [ebp - 4]
mov edx, 0x59e860
call fcn.0040597c
inc esi
mov eax, dword [ebp - 4]
call fcn.00405970
mov ecx, 3
cdq
idiv ecx
test edx, edx
jne 0x59e6e7
mov eax, edi
call fcn.00405684
mov ebx, 1
jmp 0x59e7e1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
shr eax, 2
and al, 0x3f
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
shl eax, 4
and al, 0x3f
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx]
shr edx, 4
or al, dl
mov byte [ebp - 6], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
add eax, eax
add eax, eax
and al, 0x3f
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx + 1]
shr edx, 6
or al, dl
mov byte [ebp - 7], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx + 1]
and al, 0x3f
mov byte [ebp - 8], al
push dword [edi]
lea eax, [ebp - 0xc]
movzx edx, byte [ebp - 5]
mov ecx, 0x59e86c
movzx edx, byte [ecx + edx]
call fcn.0040586c
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
movzx edx, byte [ebp - 6]
mov ecx, 0x59e86c
movzx edx, byte [ecx + edx]
call fcn.0040586c
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
movzx edx, byte [ebp - 7]
mov ecx, 0x59e86c
movzx edx, byte [ecx + edx]
call fcn.0040586c
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
movzx edx, byte [ebp - 8]
mov ecx, 0x59e86c
movzx edx, byte [ecx + edx]
call fcn.0040586c
push dword [ebp - 0x18]
mov eax, edi
mov edx, 5
call fcn.00405a34
add ebx, 3
mov eax, dword [ebp - 4]
call fcn.00405970
sub eax, 2
cmp ebx, eax
jle 0x59e71a
test esi, esi
jle 0x59e826
mov eax, dword [edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x59e809
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
cmp ebx, 1
jl 0x59e826
mov eax, edi
call fcn.00405bcc
mov byte [eax + ebx - 1], 0x3d
dec esi
test esi, esi
je 0x59e826
dec ebx
test ebx, ebx
jne 0x59e810
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59e850
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004056a8
lea eax, [ebp - 4]
call fcn.00405684
ret
Function at 0x59f84c
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x59f868
add esp, 0xfffffff0
call fcn.00404aac
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x59f99d
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00404718
call sub.winmm.dll_timeGetTime
mov dword [ebx + 8], eax
cmp esi, 0xffffffff
jne 0x59f8c3
push 0
call sub.wsock32.dll_WSASetLastError
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x1c], esi
inc esi
jne 0x59f8c6
xor ecx, ecx
mov edx, 0xfffffb2e
mov eax, ebx
call fcn.0059fc64
jmp 0x59f982
mov dword [ebx + 0x1c], esi
call fcn.004d9cdc
movzx eax, byte [eax + 0xad]
xor al, 1
mov byte [0x68b8a0], al
cmp byte [0x68b8a0], 0
jne 0x59f941
mov dword [ebp - 8], 1
push 4
lea eax, [ebp - 8]
push eax
push 1
push 6
mov eax, dword [ebx + 0x1c]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
je 0x59f941
push 0x59f9d0
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x10]
call fcn.0040c1d4
push dword [ebp - 0x10]
push 0x59f9e0
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x1c]
call fcn.0040c1d4
push dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00405a34
mov ecx, dword [ebp - 0xc]
mov dl, 2
mov al, 2
call fcn.0051d8c0
mov eax, ebx
call fcn.0059f18c
mov word [ebx + 0x28], di
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x38], eax
mov byte [ebx + 0x44], 0
mov byte [ebx + 0x4a8], 0
mov byte [ebx + 0x498], 0
mov byte [ebx + 0x458], 0
mov byte [ebx + 0x459], 0
mov byte [ebx + 0x499], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59f9a4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004056a8
ret
Function at 0x59fa90
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov byte [ebp - 5], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x59fbae
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x14], 0
je 0x59facb
mov eax, esi
mov edx, dword [ebx + 0x14]
call fcn.004056d8
jmp 0x59fb74
mov eax, esi
call fcn.00405684
mov dword [ebp - 0xc], 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x1c]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x59fb5b
push dword [ebp - 0x18]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040588c
mov eax, dword [ebp - 4]
test eax, eax
je 0x59fb0c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
mov eax, esi
mov edx, edi
call fcn.00405dfc
mov eax, esi
call fcn.00405bcc
push eax
lea eax, [ebp - 4]
call fcn.00405bcc
mov ecx, edi
pop edx
call fcn.00403234
lea eax, [ebx + 0x14]
mov edx, dword [esi]
call fcn.004056d8
movzx eax, word [ebp - 0x1a]
push eax
call sub.wsock32.dll_ntohs
movzx eax, ax
lea edx, [ebp - 0x20]
call fcn.0040c1d4
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x18]
call fcn.004056d8
jmp 0x59fb74
mov eax, esi
mov edx, 0x59fbc4
call fcn.004056d8
lea eax, [ebx + 0x18]
mov edx, 0x59fbd4
call fcn.004056d8
cmp byte [ebp - 5], 0
je 0x59fb90
push dword [esi]
push 0x59fbe0
push dword [ebx + 0x18]
mov eax, esi
mov edx, 3
call fcn.00405a34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59fbb5
lea eax, [ebp - 0x20]
call fcn.00405684
lea eax, [ebp - 4]
call fcn.00405684
ret

Function at 0x5a00b8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5a019c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.wsock32.dll_WSASetLastError
mov eax, dword [ebx + 0x38]
add eax, 0x2000
cmp eax, dword [ebx + 0x30]
jle 0x5a00f8
add dword [ebx + 0x30], 0x2000
lea eax, [ebx + 0x2c]
mov edx, dword [ebx + 0x30]
call fcn.00402ffc
push 0
push 0x2000
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebx + 0x38]
add eax, edx
push eax
mov eax, dword [ebx + 0x1c]
push eax
call sub.wsock32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
jne 0x5a0158
call sub.wsock32.dll_WSAGetLastError
mov edi, eax
cmp edi, 0x2733
je 0x5a014d
lea edx, [ebp - 8]
mov eax, edi
call fcn.0040c1d4
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x5a01b4
call fcn.004059c0
mov ecx, dword [ebp - 4]
mov dl, 2
mov al, 2
call fcn.0051d8c0
mov edx, edi
mov eax, ebx
call fcn.005a0090
jmp 0x5a017a
test esi, esi
jne 0x5a0167
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 4]
jmp 0x5a0181
test esi, esi
jle 0x5a0178
add dword [ebx + 0x38], esi
cmp esi, 0x2000
jl 0x5a0181
jmp 0x5a017a
test esi, esi
inc esi
jne 0x5a00d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a01a3
lea eax, [ebp - 8]
mov edx, 2
call fcn.004056a8
ret
Function at 0x5a01d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5a0299
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x400
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x1c]
push eax
call sub.wsock32.dll_recv
mov esi, eax
test esi, esi
jle 0x5a027e
push 0x5a02b0
lea ecx, [ebp - 8]
mov dl, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 8]
push 0x5a02d4
lea ecx, [ebp - 0xc]
mov dl, 1
mov eax, ebx
call fcn.0059fa90
push dword [ebp - 0xc]
push 0x5a02e4
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0040c1d4
push dword [ebp - 0x10]
push 0x5a02f8
lea eax, [ebp - 4]
mov edx, 7
call fcn.00405a34
mov ecx, dword [ebp - 4]
mov dl, 2
mov al, 4
call fcn.0051d8c0
add dword [ebx + 0x450], esi
cmp dword [ebx + 0x450], 0x10000
jle 0x5a027e
mov ecx, 0x5a0304
mov dl, 2
mov al, 3
call fcn.0051d8c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a02a0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004056a8
ret

Function at 0x5a04f4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a0633
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x44], 4
jne 0x5a0618
push 0
call sub.wsock32.dll_WSASetLastError
mov eax, dword [ebx + 0x38]
sub eax, dword [ebx + 0x34]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5a05de
cmp edi, dword [ebx + 0x454]
jle 0x5a056a
push 0
mov eax, dword [ebx + 0x454]
push eax
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebx + 0x34]
add eax, edx
push eax
mov eax, dword [ebx + 0x1c]
push eax
call sub.wsock32.dll_send
mov esi, eax
jmp 0x5a0581
push 0
push edi
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebx + 0x34]
add eax, edx
push eax
mov eax, dword [ebx + 0x1c]
push eax
call sub.wsock32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x5a05ca
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x5a05be
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040c1d4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x5a064c
call fcn.004059c0
mov ecx, dword [ebp - 0x10]
mov dl, 2
mov al, 2
call fcn.0051d8c0
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.005a0090
jmp 0x5a0618
add dword [ebp - 8], esi
sub edi, esi
add dword [ebx + 0x34], esi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jl 0x5a0543
mov eax, dword [ebx + 0x34]
cmp eax, dword [ebx + 0x38]
jl 0x5a0618
cmp byte [ebx + 0x4a8], 0
jne 0x5a05f5
mov byte [ebx + 0x44], 0
jmp 0x5a0618
cmp word [ebx + 0x482], 0
je 0x5a060f
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebx + 0x484]
call dword [ebx + 0x480]
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a063a
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004056a8
ret
Function at 0x5a0ebc
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x5a0ec4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a1134
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.wsock32.dll_WSASetLastError
push 0x33
push 0x401
call fcn.00407cbc
mov eax, dword [eax + 0x1f4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
inc eax
jne 0x5a0f1c
xor ecx, ecx
mov edx, 0xfffffb2e
mov eax, dword [ebp - 4]
call fcn.0059fc64
jmp 0x5a10f4
mov eax, dword [0x4d3e34]
call fcn.004d4328
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x4c0], ebx
test ebx, ebx
je 0x5a10f4
mov word [ebp - 0x14], 2
xor eax, eax
push ebp
push 0x5a105e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004d43cc
mov eax, dword [ebp - 0x18]
mov edx, 0x5a114c
call fcn.00405ac0
jne 0x5a0fed
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c0]
mov ecx, dword [eax + 0x14]
lea eax, [ebp - 0x1c]
mov edx, 0x5a1158
call fcn.004059c0
mov ecx, dword [ebp - 0x1c]
mov dl, 0x19
mov al, 4
call fcn.0051d8c0
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c0]
mov edx, dword [edx + 0x14]
call fcn.004060a4
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x4a91ac]
call fcn.004a98b8
mov ebx, eax
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.004a9bb0
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.00405938
mov eax, dword [ebp - 0x24]
call fcn.00405b74
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
mov eax, ebx
call fcn.004a9c00
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
jmp 0x5a1054
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c0]
call fcn.004d43cc
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x5a1158
call fcn.004059c0
mov ecx, dword [ebp - 0x2c]
mov dl, 0x19
mov al, 4
call fcn.0051d8c0
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c0]
call fcn.004d442c
mov eax, dword [ebp - 0x34]
call fcn.00405b74
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c0]
call fcn.004d448c
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a10cf
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x5a10f4
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a0090
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a113b
lea eax, [ebp - 0x40]
mov edx, 6
call fcn.004056a8
lea eax, [ebp - 0x28]
call fcn.00405ebc
lea eax, [ebp - 0x24]
call fcn.00405684
lea eax, [ebp - 0x20]
call fcn.00405ebc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004056a8
ret
Function at 0x5a4a10
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x5a4a2a
add esp, 0xfffffff0
call fcn.00404aac
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405b64
xor eax, eax
push ebp
push 0x5a4b31
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x5a4a53
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x40
jle 0x5a4aaa
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [0x5a305c]
call fcn.005a35e8
mov eax, dword [ebp - 8]
test eax, eax
je 0x5a4a74
sub eax, 4
mov eax, dword [eax]
mov edx, eax
sar edx, 1
jns 0x5a4a7d
adc edx, 0
lea eax, [ebp - 4]
call fcn.00405dfc
mov edi, dword [ebp - 4]
test edi, edi
je 0x5a4a91
sub edi, 4
mov edi, dword [edi]
mov eax, dword [ebp - 4]
call fcn.00405b74
push eax
mov eax, dword [ebp - 8]
call fcn.00405b74
mov ecx, edi
pop edx
call fcn.00428008
lea eax, [esi + 4]
xor ecx, ecx
mov edx, 0x40
call fcn.00403cb4
lea eax, [esi + 0x44]
xor ecx, ecx
mov edx, 0x40
call fcn.00403cb4
mov edi, dword [ebp - 4]
test edi, edi
je 0x5a4ad4
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 4]
call fcn.00405bcc
lea edx, [esi + 4]
mov ecx, edi
call fcn.00403234
mov edi, dword [ebp - 4]
test edi, edi
je 0x5a4af2
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 4]
call fcn.00405bcc
lea edx, [esi + 0x44]
mov ecx, edi
call fcn.00403234
xor eax, eax
xor byte [esi + eax + 4], 0x36
xor byte [esi + eax + 0x44], 0x5c
inc eax
cmp eax, 0x40
jne 0x5a4b06
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a4b38
lea eax, [ebp - 8]
mov edx, 2
call fcn.004056a8
ret
Function at 0x5d0160
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d01dc
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
push 0x5d01ec
lea edx, [ebp - 8]
mov eax, ebx
call fcn.005d0070
push dword [ebp - 8]
push 0x5d01ec
lea eax, [ebp - 4]
mov edx, 3
call fcn.004061a0
mov eax, dword [ebp - 4]
call fcn.004060b4
push eax
push 0
mov eax, ebx
call fcn.00467e90
push eax
call sub.shell32.dll_ShellExecuteW
mov eax, ebx
call fcn.004607c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d01e3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405ed4
ret

Function at 0x5d33d8
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00406478
lea eax, [ebp - 8]
call fcn.00406478
xor eax, eax
push ebp
push 0x5d34b2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 1
push 0
call sub.winhttp.dll_WinHttpOpen
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
add dword [ebp - 0x20], 2
mov eax, dword [ebp - 4]
call fcn.004060b4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
call fcn.004060b4
push eax
push ebx
call sub.winhttp.dll_WinHttpGetProxyForUrl
test eax, eax
je 0x5d345a
mov eax, esi
mov edx, dword [ebp - 0x28]
call fcn.00406028
jmp 0x5d348a
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x34]
call fcn.0040c1d4
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, 0x5d34c8
call fcn.004059c0
mov ecx, dword [ebp - 0x30]
mov dl, 0x19
mov al, 2
call fcn.0051d8c0
mov eax, esi
call fcn.00405ebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d34b9
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.004056a8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405ed4
ret