joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f680
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506ceb
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xac
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
mov eax, dword [ebp - 0xbc]
mov dword [eax + 0x38], 0
push 8
push 1
push 0
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx + 0x3c]
push edx
mov eax, dword [ebp - 0xbc]
add eax, 0x38
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x47f709
push str.Deleted_the_key_container_just_created.__n
call fcn.004dfad5
add esp, 4
jmp 0x47f77c
push 0xffffffffffffffff
push 0x10
push 2
call fcn.0041f480
mov ecx, eax
call fcn.00420010
push 1
lea ecx, [ebp - 0xb0]
call fcn.0041f520
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
push str.Error_during_CryptAcquireContext_
lea ecx, [ebp - 0xb0]
push ecx
call fcn.0041e560
add esp, 8
lea edx, [ebp - 0xb0]
push edx
call fcn.0041f480
mov ecx, eax
call fcn.0041cfb0
jmp 0x47f766
mov dword [ebp - 4], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb0]
call fcn.0041dc00
jmp 0x47f862
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47f880
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506d31
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x1f0
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x200], ecx
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
push 0xffffffffffffffff
push 0x10
push 2
call fcn.0041f480
mov ecx, eax
call fcn.00420010
push 1
lea ecx, [ebp - 0xb0]
call fcn.0041f520
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
push str.CryptAcquireContext_succeeded.New_key_set_created.
lea eax, [ebp - 0xb0]
push eax
call fcn.0041e560
add esp, 8
lea ecx, [ebp - 0xb0]
push ecx
call fcn.0041f480
mov ecx, eax
call fcn.0041cfb0
jmp 0x47f926
mov dword [ebp - 4], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb0]
call fcn.0041dc00
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x200]
mov edx, dword [ecx + 0x38]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x47f96b
mov byte [ebp + 0x10], 1
mov eax, dword [ebp - 0x200]
mov byte [eax + 0x44], 1
jmp 0x47f9fa
push 0xffffffffffffffff
push 0x10
push 2
call fcn.0041f480
mov ecx, eax
call fcn.00420010
push 1
lea ecx, [ebp - 0x150]
call fcn.0041f520
mov byte [ebp - 4], 4
mov byte [ebp - 4], 5
push 0x51fb34
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Param_6__
lea ecx, [ebp - 0x150]
push ecx
call fcn.0041e560
add esp, 8
mov ecx, eax
call fcn.0041ea70
push eax
call fcn.0041e560
add esp, 8
lea edx, [ebp - 0x150]
push edx
call fcn.0041f480
mov ecx, eax
call fcn.0041cfb0
jmp 0x47f9e4
mov dword [ebp - 4], 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x150]
call fcn.0041dc00
push 0
mov eax, dword [ebp - 0x200]
mov ecx, dword [eax + 0x38]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
jne 0x47fab1
push 0xffffffffffffffff
push 0x10
push 2
call fcn.0041f480
mov ecx, eax
call fcn.00420010
push 1
lea ecx, [ebp - 0x1f0]
call fcn.0041f520
mov byte [ebp - 4], 7
mov byte [ebp - 4], 8
push 0x51fb44
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Param_7__
lea edx, [ebp - 0x1f0]
push edx
call fcn.0041e560
add esp, 8
mov ecx, eax
call fcn.0041ea70
push eax
call fcn.0041e560
add esp, 8
lea eax, [ebp - 0x1f0]
push eax
call fcn.0041f480
mov ecx, eax
call fcn.0041cfb0
jmp 0x47fa8d
mov dword [ebp - 4], 7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1f0]
call fcn.0041dc00
mov byte [ebp + 0x10], 0
mov ecx, dword [ebp - 0x200]
mov byte [ecx + 0x44], 0
mov al, byte [ebp + 0x10]
jmp 0x47fc01
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48e820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508898
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x15
call fcn.0041d030
mov ecx, dword [ebp - 0x1c]
add ecx, 0x28
call fcn.00417420
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x2c
call fcn.00417420
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
call fcn.00417420
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
add ecx, 0x34
call fcn.00417420
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
add ecx, 0x40
call fcn.00417420
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1c]
add ecx, 0x44
call fcn.0042f2f0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
add ecx, 0x48
call fcn.0042f2f0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4c
call fcn.00417420
mov byte [ebp - 4], 7
mov byte [ebp - 4], 8
push 0x468ad0
call fcn.004dbbc8
add esp, 4
mov ecx, 0x577228
call fcn.00415d40
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x5c], eax
mov ecx, 0x57722c
call fcn.00415d40
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x60], eax
mov eax, dword [str.SharedMemoryGuard]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x48
call fcn.004426d0
push 0x577200
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4c
call fcn.0041e3d0
mov ecx, dword [ebp - 0x1c]
mov byte [ecx], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + 1], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x50], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x54], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x58], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x38], 0
mov dword [edx + 0x3c], 0
jmp 0x48ea6c
mov dword [ebp - 4], 7
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4920b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508ea0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xac
mov eax, dword [0x5732cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
push 0x94
push 0
lea eax, [ebp - 0xb0]
push eax
call fcn.004dba80
add esp, 0xc
mov dword [ebp - 0xb0], 0x94
lea ecx, [ebp - 0xb0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4921e9
cmp dword [ebp - 0xa0], 1
jne 0x492152
cmp dword [ebp - 0xac], 4
jne 0x492152
cmp dword [ebp - 0xa8], 0xa
jne 0x492152
xor al, al
jmp 0x492338
cmp dword [ebp - 0xa0], 2
jne 0x492176
cmp dword [ebp - 0xac], 5
jne 0x492176
cmp dword [ebp - 0xa8], 0
jne 0x492176
xor al, al
jmp 0x492338
cmp dword [ebp - 0xa0], 2
jne 0x49219a
cmp dword [ebp - 0xac], 5
jne 0x49219a
cmp dword [ebp - 0xa8], 1
jne 0x49219a
xor al, al
jmp 0x492338
cmp dword [ebp - 0xa0], 2
jne 0x4921be
cmp dword [ebp - 0xac], 5
jne 0x4921be
cmp dword [ebp - 0xa8], 2
jne 0x4921be
xor al, al
jmp 0x492338
cmp dword [ebp - 0xa0], 2
jne 0x4921e9
cmp dword [ebp - 0xac], 6
jne 0x4921e9
cmp dword [ebp - 0xa8], 0
je 0x4921e2
cmp dword [ebp - 0xa8], 1
jne 0x4921e9
mov al, 1
jmp 0x492338
xor al, al
jmp 0x492338
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004db901
mov esp, ebp
pop ebp
ret

Function at 0x493f60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x34], 1
mov ecx, dword [ebp - 4]
add ecx, 0x28
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x493ba0
push 0
push 0
call fcn.004df83a
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], eax
mov esp, ebp
pop ebp
ret
Function at 0x495d40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50951a
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x5732cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x138], 0
push 0x100
call fcn.004da8e1
add esp, 4
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dl, byte [0x526146]
mov byte [ecx], dl
mov al, byte [0x526147]
mov byte [ebp - 0x114], al
push 0
push 0x1c
lea ecx, [ebp - 0x114]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.GoogleChromeUser_DataDefaultPreferences
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x130]
call fcn.00401880
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x130]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004018c0
mov edx, dword [ebp - 0x138]
or edx, 1
mov dword [ebp - 0x138], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x130]
call fcn.004018f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004db901
mov esp, ebp
pop ebp
ret
Function at 0x495e30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509571
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5732cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], 0
push 0x52629c
mov eax, dword [ebp + 0xc]
push eax
call fcn.004dfeb4
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x495e9e
push 0x52614e
mov ecx, dword [ebp + 8]
call fcn.00401880
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x44]
or ecx, 1
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp + 8]
jmp 0x495f66
push 2
push 0
mov edx, dword [ebp - 0x30]
push edx
call fcn.004e0c5e
add esp, 0xc
mov eax, dword [ebp - 0x30]
push eax
call fcn.004e0b6f
add esp, 4
mov dword [ebp - 0x34], eax
push 0
push 0
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.004e0c5e
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00401860
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x34]
add edx, 1
push edx
call fcn.004da8e1
add esp, 4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x34]
mov byte [ecx], 0
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x34]
push eax
push 1
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004e09be
add esp, 0x10
cmp eax, dword [ebp - 0x34]
jne 0x495f24
mov edx, dword [ebp - 0x38]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0041ba10
mov eax, dword [ebp - 0x30]
push eax
call fcn.004df344
add esp, 4
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x40]
push edx
call fcn.004db910
add esp, 4
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004018c0
mov ecx, dword [ebp - 0x44]
or ecx, 1
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004018f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004db901
mov esp, ebp
pop ebp
ret
Function at 0x49c310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
push 8
mov dword [esi], ebx
call fcn.004dc69d
add esp, 4
cmp eax, ebx
je 0x49c3fa
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea edi, [esi + 0x18]
push 8
mov dword [ebp - 4], ebx
mov dword [edi], ebx
call fcn.004dc69d
add esp, 4
cmp eax, ebx
je 0x49c3d6
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov edx, dword [ebp + 8]
mov dword [ecx], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov eax, 0xf
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
mov ax, word [edx]
mov word [esi + 0x7c], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], ebx
call fcn.004dc5af
push 0x56b570
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], vtable.std::bad_alloc.0
call fcn.004db4d1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], ebx
call fcn.004dc5af
push 0x56b570
lea ecx, [ebp - 0x30]
push ecx
mov dword [ebp - 0x30], vtable.std::bad_alloc.0
call fcn.004db4d1
int3
Function at 0x4a4670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ae0d
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x30
mov eax, dword [0x5732cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov dword [eax], vtable.CReportUserAction.0
mov ecx, dword [ebp - 0x40]
add ecx, 8
call fcn.0042f2f0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
add ecx, 0xc
call fcn.0041d030
mov ecx, dword [ebp - 0x40]
add ecx, 0x1c
call fcn.0042f2f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x40]
add ecx, 0x20
call fcn.0042f2f0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
add ecx, 0x24
call fcn.0042f2f0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x40]
add ecx, 0x28
call fcn.0042f2f0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x40]
add ecx, 0x2c
call fcn.00417420
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x40]
add ecx, 0x30
call fcn.00417420
mov byte [ebp - 4], 6
mov byte [ebp - 4], 7
push 0x468ad0
call fcn.004dbbc8
add esp, 4
mov ecx, dword [str.UserReportXMLGuard]
push ecx
mov ecx, dword [ebp - 0x40]
add ecx, 8
call fcn.004426d0
mov edx, dword [ebp - 0x40]
mov dword [edx + 4], 0
push 0
lea ecx, [ebp - 0x30]
call fcn.0045c070
mov byte [ebp - 4], 8
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x40]
add ecx, 0x1c
call fcn.00441fe0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x30]
call fcn.00441f80
push 0
lea ecx, [ebp - 0x34]
call fcn.0045c070
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x40]
add ecx, 0x20
call fcn.00429ba0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x34]
call fcn.00429b40
push 0
lea ecx, [ebp - 0x38]
call fcn.0045c070
mov byte [ebp - 4], 0xa
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x40]
add ecx, 0x24
call fcn.00429ba0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x38]
call fcn.00429b40
push 0
lea ecx, [ebp - 0x3c]
call fcn.0045c070
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x40]
add ecx, 0x28
call fcn.00429ba0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3c]
call fcn.00429b40
push 0x52c83a
mov ecx, dword [ebp - 0x40]
add ecx, 0x2c
call fcn.004199b0
push 0x52c83b
mov ecx, dword [ebp - 0x40]
add ecx, 0x30
call fcn.004199b0
lea ecx, [ebp - 0x24]
push ecx
call fcn.00470b20
add esp, 4
mov ecx, dword [ebp - 0x40]
add ecx, 0xc
call fcn.00428d30
mov edx, dword [ebp - 0x24]
mov dword [eax], edx
mov ecx, dword [ebp - 0x20]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0xc], ecx
jmp 0x4a491b
mov dword [ebp - 4], 6
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004db901
mov esp, ebp
pop ebp
ret
Function at 0x4abcb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50bb20
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x41c
mov eax, dword [0x5732cc]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
mov dword [0x577830], 2
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x420], 0
push 0x3ff
push 0
lea eax, [ebp - 0x41f]
push eax
call fcn.004dba80
add esp, 0xc
mov dword [ebp - 0x18], 0x3ff
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x14]
push eax
push str.ProxyServer
push 0x534530
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4abdc9
cmp dword [ebp - 0x14], 1
jne 0x4abdc9
cmp dword [ebp - 0x18], 0
jbe 0x4abdc9
movsx ecx, byte [ebp - 0x420]
test ecx, ecx
je 0x4abdc9
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x18], 4
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x14]
push ecx
push str.ProxyEnable
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4abdc9
cmp dword [ebp - 0x14], 4
jne 0x4abdc9
cmp dword [ebp - 0x18], 0
jbe 0x4abdc9
cmp dword [ebp - 0x424], 0
je 0x4abdc9
mov dword [0x577830], 1
jmp 0x4abeaf
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004db901
mov esp, ebp
pop ebp
ret
Function at 0x4adb30
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x4adb43
xor eax, eax
jmp 0x4adcc3
jmp 0x4adb57
mov eax, dword [ebp + 0x10]
sub eax, 3
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0xc]
add ecx, 3
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0x10], 2
jbe 0x4adbe1
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
shl eax, 0x10
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 1]
shl edx, 8
or eax, edx
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 2]
or eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 4
jmp 0x4adb94
mov eax, dword [ebp - 0xc]
shr eax, 6
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
jbe 0x4adbb8
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
and edx, 0x3f
mov eax, dword [ebp - 4]
mov cl, byte [edx + 0x534ee0]
mov byte [ebp + eax - 8], cl
jmp 0x4adb8b
push 4
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ac0e0
add esp, 0xc
test eax, eax
je 0x4adbdc
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c72d0]
jmp 0x4adcc3
jmp 0x4adb45
cmp dword [ebp + 0x10], 0
je 0x4adcc1
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
jmp 0x4adc04
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jae 0x4adc28
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
jmp 0x4adbfb
jmp 0x4adc33
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 3
jae 0x4adc44
mov eax, dword [ebp - 0xc]
shl eax, 8
mov dword [ebp - 0xc], eax
jmp 0x4adc2a
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4adc58
mov edx, dword [ebp - 0xc]
shr edx, 6
mov dword [ebp - 0xc], edx
cmp dword [ebp - 4], 0
jbe 0x4adc7c
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0x3f
mov edx, dword [ebp - 4]
mov al, byte [ecx + 0x534ee0]
mov byte [ebp + edx - 8], al
jmp 0x4adc4f
mov dword [ebp - 4], 3
jmp 0x4adc8e
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x10]
jbe 0x4adca0
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 8], 0x3d
jmp 0x4adc85
push 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004ac0e0
add esp, 0xc
test eax, eax
je 0x4adcc1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4c72d0]
jmp 0x4adcc3
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4b0690
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x5732cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x4c72d4], 1
cmp dword [0x577864], 0
je 0x4b06bd
xor eax, eax
jmp 0x4b06ed
mov dword [0x577864], 1
lea ecx, [ebp - 0x198]
push ecx
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x4b06eb
mov dword [0x577864], 0
or eax, 0xffffffff
jmp 0x4b06ed
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004db901
mov esp, ebp
pop ebp
ret
Function at 0x4b07b0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x4b07da
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
xor eax, eax
jmp 0x4b0824
mov ecx, dword [ebp + 0xc]
push ecx
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4b07fa
call sub.WS2_32.dll_WSAGetLastError
mov edx, dword [ebp + 8]
mov dword [edx + 0x4c72d8], eax
cmp dword [ebp - 0x18], 0
jne 0x4b0805
or eax, 0xffffffff
jmp 0x4b0824
mov eax, dword [ebp - 0x18]
movsx ecx, word [eax + 0xa]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.004dbbf0
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret