joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475f18
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4760c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4760a4
mov dl, 1
mov eax, dword [0x41a280]
call fcn.00404984
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004058b4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x476093
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0046749c
test al, al
je 0x476086
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4760d4
lea eax, [ebp - 0x254]
call fcn.0040bf9c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x476086
xor eax, eax
push ebp
push 0x47607f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x47610c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x476068
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405b34
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x476068
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405b34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476086
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x475f89
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041ee84
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4760ca
lea eax, [ebp - 0x260]
call fcn.004058b4
ret

Function at 0x476a3c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5a75bc]
cmp byte [eax + 0xad], 0
jne 0x476aad
cmp dword [0x5a75d4], 0
jne 0x476a6e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4769f8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x5a75d4], eax
cmp dword [0x5a75d0], 0
jne 0x476a89
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x5a75d0], eax
cmp dword [0x5a75d8], 0
jne 0x476aad
push esp
push 0
push 0
push 0x47699c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5a75d8], eax
pop edx
ret
Function at 0x476cb0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x476cc7
add esp, 0xfffffff0
call fcn.00404cd8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00423860
mov eax, dword [0x5a2c84]
cmp word [eax + 2], 0
jne 0x476cef
mov eax, dword [0x5a2c84]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00478808
mov eax, dword [0x5a2e80]
cmp word [eax + 2], 0
jne 0x476d09
mov eax, dword [0x5a2e80]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00478a14
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x419c14]
call fcn.00404984
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x419c14]
call fcn.00404984
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x419c14]
call fcn.00404984
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x4296c4]
call fcn.00431c14
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x476ec0
mov eax, dword [0x5a2a4c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00431fe8
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4790e4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5a2a4c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ff08
test eax, eax
je 0x476e10
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040b578
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ff3c
test eax, eax
je 0x476e24
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00405b34
mov byte [ebx + 0xd4], 0
push ebx
push 0x478350
call fcn.004249dc
mov dword [ebx + 0xc8], eax
mov eax, dword [0x5a26dc]
cmp byte [eax], 0
jne 0x476e75
mov eax, ebx
call fcn.00477004
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004792c0
mov eax, ebx
call fcn.00479e20
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x476eb5
call fcn.00404d30
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477284
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x5a75bc]
cmp dword [eax + 0x30], 0
je 0x47732e
cmp dword [ebx + 0x94], 0
jne 0x477328
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x477214
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x477328
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4772ee
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x477328
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041c310
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4772fd
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x478048
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x47807d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004059a4
jmp 0x47808a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405908
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4794a4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x479512
mov eax, esi
call fcn.004620d0
test al, al
je 0x479512
mov eax, dword [ebx + 0x84]
call fcn.00461d30
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x479512
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x479506
push 0
mov eax, dword [ebx + 0x84]
call fcn.00461d30
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0045a0e0
jmp 0x479512
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004792e0
pop esi
pop ebx
ret
Function at 0x48de80
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x598f54], 0
mov eax, dword [0x5a31f8]
cmp dword [eax], 2
jne 0x48e059
mov eax, dword [0x5a2a58]
cmp dword [eax], 5
jl 0x48e059
call fcn.00485a9c
test al, al
jne 0x48deb1
call fcn.00485aa8
call fcn.00485a94
mov dword [0x598f5c], eax
push 0x48e05c
mov eax, dword [0x598f5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f20], eax
cmp dword [0x598f20], 0
jne 0x48df0c
mov edx, 0x8000
mov eax, 0x48e070
call fcn.00410e00
mov dword [0x598f58], eax
mov eax, dword [0x598f58]
mov dword [0x598f5c], eax
push 0x48e05c
mov eax, dword [0x598f5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f20], eax
cmp dword [0x598f20], 0
je 0x48e054
push 0x48e07c
mov eax, dword [0x598f5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f24], eax
cmp dword [0x598f24], 0
je 0x48e054
push 0x48e088
mov eax, dword [0x598f5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f28], eax
cmp dword [0x598f28], 0
je 0x48e054
mov byte [0x598f54], 1
push 0x48e098
mov eax, dword [0x598f5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f2c], eax
push 0x48e0a4
mov eax, dword [0x598f5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f30], eax
push 0x48e0b0
mov eax, dword [0x598f5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f34], eax
push 0x48e0c0
mov eax, dword [0x598f5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f38], eax
push 0x48e0d0
mov eax, dword [0x598f5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f3c], eax
mov edx, 0x8000
mov eax, 0x48e0e8
call fcn.00410e00
mov dword [0x598f60], eax
cmp dword [0x598f60], 0
je 0x48e059
push 0x48e0f8
mov eax, dword [0x598f60]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f40], eax
push 0x48e114
mov eax, dword [0x598f60]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f44], eax
push 0x48e134
mov eax, dword [0x598f60]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f48], eax
push 0x48e150
mov eax, dword [0x598f60]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f4c], eax
push 0x48e168
mov eax, dword [0x598f60]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598f50], eax
ret
call fcn.0048de00
ret

Function at 0x4abf1c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, 8
test byte [edx + 1], 0x80
setne bl
movzx edi, word [edx]
add edi, edi
movzx esi, cl
mov ebp, esi
shr ebp, 7
or edi, ebp
cmp edi, 0xffff
jbe 0x4abf48
call fcn.0040487c
mov word [edx], di
test bl, bl
je 0x4abf54
xor word [edx], 0x1021
add esi, esi
and esi, 0xff
cmp esi, 0xff
jbe 0x4abf69
call fcn.0040487c
mov ecx, esi
dec eax
jne 0x4abf25
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e4664
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x408c48]
call fcn.00406408
xor eax, eax
push ebp
push 0x4e4805
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x59c27c], 0
jne 0x4e46bf
mov ecx, dword [0x5a2714]
mov dl, 1
mov eax, dword [0x4092b0]
call fcn.0040f03c
call fcn.00405228
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403b0c
mov eax, ebx
call fcn.00406258
mov dword [ebp - 0x24], eax
mov esi, 0x4e4814
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00407564
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00406268
test eax, eax
jle 0x4e47a8
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4e4794
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405b34
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4e473a
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405b4c
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4e4750
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405b4c
mov eax, dword [ebp - 0x54]
call fcn.00405d88
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405b34
mov eax, dword [ebp - 0x58]
call fcn.00405d88
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x4e4796
xor eax, eax
test al, al
je 0x4e47a1
mov ebx, 0x15
jmp 0x4e47ad
mov ebx, 0x10
jmp 0x4e47ad
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x59c27c]
call fcn.004e44e8
mov eax, dword [ebp - 4]
call fcn.004e44e8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040757c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e480c
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.004058d8
lea eax, [ebp - 0xc]
mov edx, dword [0x408c48]
call fcn.004064d8
ret

Function at 0x4fa4bc
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x5a85d4], 0
jne 0x4fa4df
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4fa430
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x5a85d4], eax
ret
Function at 0x500398
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5003c6
mov eax, ebx
call fcn.00500e4c
cmp dword [ebx + 0x40], 0
je 0x5003bf
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x500437
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x500429
cmp dword [ebx + 8], 0
je 0x5003e8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5003fa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x500429
cmp dword [ebx + 8], 0
je 0x5003db
cmp eax, 3
je 0x50040d
dec eax
jne 0x5003db
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5003db
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5003db
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x500455
cmp dword [ebx + 0x14], 0xcc
je 0x500455
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00500460
pop ebx
ret
Function at 0x512384
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 4], eax
lea esi, [ebp - 0x238]
xor eax, eax
push ebp
push 0x51254c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 9], 0
mov eax, dword [ebp - 4]
add eax, 0xa
call fcn.004058b4
mov eax, dword [ebp - 4]
add eax, 0xe
call fcn.004058b4
mov eax, dword [ebp - 4]
add eax, 0x12
call fcn.004058b4
mov eax, dword [ebp - 4]
add eax, 0x16
call fcn.004058b4
xor edx, edx
push ebp
push 0x512527
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
push 0
push 3
push 0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 4]
call fcn.00512328
mov edx, eax
lea eax, [ebp - 0x240]
call fcn.00405a9c
mov ecx, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
mov edx, 0x512564
call fcn.00405bd4
mov eax, dword [ebp - 0x23c]
call fcn.00405d88
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 5], ebx
cmp ebx, 0xffffffff
jne 0x512458
call fcn.004052d4
jmp 0x51252e
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0xc
call fcn.00403b0c
mov eax, esi
xor ecx, ecx
mov edx, 0x224
call fcn.00403b0c
mov eax, 0x224
mov dword [esi + 4], eax
push 0
lea edx, [ebp - 8]
push edx
push eax
push esi
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2d1400
mov eax, dword [ebp - 4]
mov eax, dword [eax + 5]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jne 0x5124a5
call fcn.004107a4
mov eax, dword [esi + 0xc]
test eax, eax
je 0x5124bc
lea ebx, [esi + eax]
mov eax, dword [ebp - 4]
add eax, 0x16
mov edx, ebx
call fcn.00405abc
mov eax, dword [esi + 0x10]
test eax, eax
je 0x5124d3
lea ebx, [esi + eax]
mov eax, dword [ebp - 4]
add eax, 0xe
mov edx, ebx
call fcn.00405abc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5124ea
lea ebx, [esi + eax]
mov eax, dword [ebp - 4]
add eax, 0xa
mov edx, ebx
call fcn.00405abc
mov eax, dword [esi + 0x18]
test eax, eax
je 0x512501
lea ebx, [esi + eax]
mov eax, dword [ebp - 4]
add eax, 0x12
mov edx, ebx
call fcn.00405abc
mov eax, dword [ebp - 4]
mov byte [eax + 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51252e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 5]
cmp eax, 0xffffffff
je 0x512526
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512553
lea eax, [ebp - 0x240]
mov edx, 2
call fcn.004058d8
ret

Function at 0x513bcc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x513c07
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00405b34
jmp 0x513c0e
mov eax, ebx
call fcn.004058b4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x513c14
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x513c97
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00406010
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405d88
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x513c75
push ebx
mov ecx, dword [ebp - 8]
sub ecx, 1
jae 0x513c66
call fcn.00404884
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405de8
jmp 0x513c81
mov eax, ebx
mov edx, 0x513cac
call fcn.00405908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513c9e
lea eax, [ebp - 4]
call fcn.004058b4
ret

Function at 0x514888
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405d78
mov eax, dword [ebp - 8]
call fcn.00405d78
xor eax, eax
push ebp
push 0x5149a3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
je 0x5148ef
xor ecx, ecx
mov dl, 1
mov eax, dword [0x512588]
call fcn.0046f814
mov edx, dword [0x5a2870]
mov dword [edx], eax
mov eax, dword [0x5a2870]
mov eax, dword [eax]
call fcn.004749c0
mov dl, 1
mov eax, dword [0x5127fc]
call fcn.00404984
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.00405d88
mov ebx, eax
push ebx
call sub.wininet.dll_DeleteUrlCacheEntry
xor eax, eax
push ebp
push 0x514960
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
je 0x51493a
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x51491d
sub eax, 0xfffffffc
push eax
push 1
mov eax, dword [ebp - 8]
call fcn.00405d88
push eax
push ebx
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete al
mov ebx, eax
jmp 0x514956
push 0
push 1
mov eax, dword [ebp - 8]
call fcn.00405d88
push eax
push ebx
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51496c
cmp byte [ebp - 9], 0
je 0x514988
mov eax, dword [0x5a2870]
mov eax, dword [eax]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, dword [ebp - 0x10]
call fcn.004049b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5149aa
lea eax, [ebp - 8]
mov edx, 2
call fcn.004058d8
ret
Function at 0x514a04
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
xor edx, edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405d78
lea eax, [ebp - 0x168]
mov edx, dword [0x409290]
call fcn.00406408
xor eax, eax
push ebp
push 0x514b3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x16c]
mov ecx, 0x514b54
mov edx, dword [ebp - 4]
call fcn.00405bd4
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x168]
mov edx, 0x3f
call fcn.0040b01c
test eax, eax
jne 0x514aa6
test byte [ebp - 0x158], 0x10
jne 0x514a8c
mov eax, dword [ebp - 0x154]
call fcn.00405d88
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x168]
call fcn.0040b06c
test eax, eax
je 0x514a72
lea eax, [ebp - 0x168]
call fcn.0040b090
lea eax, [ebp - 0x170]
mov ecx, 0x514b64
mov edx, dword [ebp - 4]
call fcn.00405bd4
mov eax, dword [ebp - 0x170]
lea ecx, [ebp - 0x168]
mov edx, 0x3f
call fcn.0040b01c
test eax, eax
jne 0x514b07
test byte [ebp - 0x158], 0x10
jne 0x514aed
mov eax, dword [ebp - 0x154]
call fcn.00405d88
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x168]
call fcn.0040b06c
test eax, eax
je 0x514ad3
lea eax, [ebp - 0x168]
call fcn.0040b090
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x514b45
lea eax, [ebp - 0x170]
mov edx, 2
call fcn.004058d8
lea eax, [ebp - 0x168]
mov edx, dword [0x409290]
call fcn.004064d8
lea eax, [ebp - 4]
call fcn.004058b4
ret