joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d5868
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4d5899
dec al
je 0x4d58d4
dec al
je 0x4d5919
dec al
je 0x4d5982
jmp 0x4d5a0c
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4d5a0c
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d58a9
jmp 0x4d5a0c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d5a0c
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d58e4
jmp 0x4d5a0c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d5a0c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4d5948
xor ebp, ebp
jmp 0x4d5958
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4d5961
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d5929
jmp 0x4d5a0c
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d5a0c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4d59db
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004d28dc
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d5996
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dd360
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4dd38e
mov eax, ebx
call fcn.004dde14
cmp dword [ebx + 0x40], 0
je 0x4dd387
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4dd3ff
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4dd3f1
cmp dword [ebx + 8], 0
je 0x4dd3b0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4dd3c2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4dd3f1
cmp dword [ebx + 8], 0
je 0x4dd3a3
cmp eax, 3
je 0x4dd3d5
dec eax
jne 0x4dd3a3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4dd3a3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4dd3a3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4dd41d
cmp dword [ebx + 0x14], 0xcc
je 0x4dd41d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004dd428
pop ebx
ret
Function at 0x4f1d48
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40d0e8]
call fcn.00407ebc
xor eax, eax
push ebp
push 0x4f1e92
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x54f6f0], 0
jne 0x4f1d9c
mov ecx, dword [0x54fc10]
mov dl, 1
mov eax, dword [0x40edcc]
call fcn.00419424
call fcn.00405f48
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.00404d10
mov eax, ebx
call fcn.00406fe0
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x4f1ea0
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040a1c4
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x4f1de3
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x4f1e38
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4f1e31
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00407494
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.0040742c
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.00414120
test eax, eax
jne 0x4f1e31
mov ebx, 0x15
jmp 0x4f1e3d
mov ebx, 0x10
jmp 0x4f1e3d
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x54f6f0]
call fcn.004f1bb4
mov eax, dword [ebp - 4]
call fcn.004f1bb4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040a1dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1e99
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00407224
lea eax, [ebp - 0xc]
mov edx, dword [0x40d0e8]
call fcn.00407f94
ret
Function at 0x4f6164
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x4f617c
add esp, 0xfffffff0
call fcn.004059a4
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4f6296
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.004042b4
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x4f6280
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004f1bb4
xor eax, eax
push ebp
push 0x4f626d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004f1bb4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00407494
jmp 0x4f623e
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00407a3c
mov eax, dword [ebx + 4]
call fcn.0040759c
dec eax
jle 0x4f6252
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x4f622c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6274
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f629d
lea eax, [ebp - 4]
call fcn.00406df4
ret

Function at 0x4f72f4
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.004f68b0
test byte [ebx + 0x2a5], 4
jne 0x4f7389
mov edx, esp
mov eax, ebx
call fcn.0049c214
push esp
mov eax, ebx
call fcn.004a56a4
push eax
push 0
mov eax, ebx
test eax, eax
je 0x4f7329
sub eax, 0xfffffd14
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x280]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x294], 0
jne 0x4f735a
mov ecx, dword [0x54fea8]
mov dl, 1
mov eax, dword [0x4f15c0]
call fcn.00419424
call fcn.00405f48
mov eax, ebx
call fcn.004f7ff4
cmp byte [ebx + 0x59], 0
jne 0x4f7390
mov eax, ebx
call fcn.004a5908
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4f7390
push 0
mov eax, ebx
call fcn.004a5908
push eax
call sub.user32.dll_ShowWindow
jmp 0x4f7390
mov eax, ebx
call fcn.004a16a8
add esp, 0x10
pop ebx
ret
Function at 0x506458
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5064e2
xor edx, edx
push ebp
push 0x5064c3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5064e2
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x5078ac
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xfffffecc
cmp byte [0x54f974], 0
jne 0x507989
mov byte [0x54f974], 1
xor eax, eax
mov dword [0x54f95c], eax
mov dword [esp + 0xc], 0x114
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 3
ja 0x5078f4
cmp dword [esp + 0x10], 3
jne 0x50795f
cmp dword [esp + 0x14], 0x33
jbe 0x50795f
mov dword [esp + 4], 0x12
push esp
push 0x20019
push 0
push 0x507990
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x507989
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x5079f0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x507989
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp word [esp + 0x120], 0x31
jne 0x507989
cmp word [esp + 0x122], 0
jne 0x507989
jmp 0x507974
push 0
push 0x5079f0
push 0x5079fc
call sub.kernel32.dll_GetProfileIntW
test eax, eax
je 0x507989
mov eax, dword [0x54f958]
call fcn.004072b8
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x54f95c], eax
add esp, 0x134
ret
Function at 0x50bb54
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a238
mov eax, dword [ebp + 8]
call fcn.00407214
xor eax, eax
push ebp
push 0x50bca9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.0050a1f0
test al, al
je 0x50bc83
xor eax, eax
push ebp
push 0x50bc75
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040a1c4
push eax
push 0x50bcc0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax]
cmp dword [ebp - 8], 0
je 0x50bc6b
xor eax, eax
push ebp
push 0x50bc64
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x45732c]
call fcn.00460cf4
mov ebx, eax
mov edx, dword [ebp + 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.00435378
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, ebx
call fcn.00461614
call fcn.0045b9dc
push eax
push esi
push 0
push 0
push 1
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov edx, dword [ebp + 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50bc6b
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 8]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50bc83
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50bcb0
lea eax, [ebp - 8]
call fcn.0040a1c4
lea eax, [ebp - 4]
call fcn.0040a1c4
lea eax, [ebp + 8]
call fcn.0040721c
ret
Function at 0x50cb30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407214
xor eax, eax
push ebp
push 0x50cd30
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
mov dl, 1
mov eax, dword [0x44d7f4]
call fcn.0044f950
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x50cd01
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x18]
call fcn.0044fa38
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x50cd50
call fcn.00407700
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
call fcn.0044fb80
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004505b0
mov eax, dword [ebp - 0x18]
call fcn.0044fa08
push 0x50cd50
push dword [ebp - 4]
push 0x50cd80
push dword [ebp - 8]
push 0x50cd90
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.004077e4
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
call fcn.0044fb80
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004505b0
mov eax, dword [ebp - 0x18]
call fcn.0044fa08
cmp dword [ebp - 8], 0
je 0x50cceb
mov edx, dword [ebp - 8]
mov eax, 0x50cdc4
call fcn.00407c84
test eax, eax
jle 0x50cca1
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x50cdc4
call fcn.00407c84
mov ecx, eax
sub ecx, 2
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040796c
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x50cc5b
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x50cc5b
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x10]
call fcn.004068c0
mov ebx, eax
test ebx, ebx
je 0x50cc66
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 8]
test eax, eax
je 0x50cc83
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x50cc83
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004068c0
mov esi, eax
test esi, esi
je 0x50cc8e
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push eax
lea edx, [ebx + 1]
mov ecx, esi
mov eax, dword [ebp - 8]
call fcn.0040796c
jmp 0x50ccb6
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00407280
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00407280
mov byte [ebp - 0x11], 1
push 5
push 0x50cdc8
mov eax, dword [ebp - 0xc]
call fcn.004072b8
push eax
mov eax, dword [ebp - 0x10]
call fcn.004072b8
push eax
push 0x50cdcc
mov eax, dword [0x550048]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50cd08
mov eax, dword [ebp - 0x18]
call fcn.00405470
ret
Function at 0x50cdd8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov ebx, ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a238
xor eax, eax
push ebp
push 0x50cf2e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x230]
call fcn.0040a1c4
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x48]
call fcn.0040a2d4
mov eax, dword [ebp - 0x230]
call fcn.0050a1f0
test al, al
je 0x50cefa
test bl, bl
je 0x50ce72
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push 2
push 7
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xd8]
call fcn.0040a2d4
jmp 0x50ce8f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 7
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xd8]
call fcn.0040a2d4
xor esi, esi
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
push 0x200
lea eax, [ebp - 0x22c]
push eax
push ebx
call sub.user32.dll_GetClassNameW
mov eax, 0x50cf48
call fcn.004072b8
push eax
lea eax, [ebp - 0x22c]
push eax
call sub.kernel32.dll_lstrcmpW
test eax, eax
jne 0x50cece
mov esi, ebx
mov eax, dword [0x550048]
mov eax, dword [eax]
call fcn.004cc968
call sub.kernel32.dll_GetTickCount_1
test esi, esi
jne 0x50ceec
sub eax, edi
cmp eax, 0x1b58
jbe 0x50ce98
test esi, esi
je 0x50cefa
mov eax, dword [ebp - 0x2c]
push eax
push esi
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50cf35
lea eax, [ebp - 0x230]
call fcn.0040a1c4
lea eax, [ebp - 0x28]
mov edx, dword [0x401298]
mov ecx, 2
call fcn.00407fe4
lea eax, [ebp - 4]
call fcn.0040a1c4
ret

Function at 0x50dfa0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407214
xor eax, eax
push ebp
push 0x50dff0
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004072b8
push eax
push 0x50dffc
push ebx
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50dff7
lea eax, [ebp - 4]
call fcn.0040721c
ret
Function at 0x50e948
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407214
mov eax, dword [ebp - 8]
call fcn.00407214
xor eax, eax
push ebp
push 0x50e9d6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x50e9af
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004072b8
push eax
mov eax, dword [ebp - 4]
call fcn.004072b8
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50e9bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50e9dd
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407224
ret

Function at 0x50efc4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404d10
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x104
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], 1
mov eax, 0x104
call fcn.0041593c
mov ebx, eax
xor eax, eax
push ebp
push 0x50f04b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0x208
call fcn.00404d10
push 0xffffffffffffffff
push esi
push ebx
mov eax, dword [ebp - 0x38]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x50f035
mov dword [ebp - 4], ebx
jmp 0x50f03d
mov eax, 0x50f05c
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f052
ret
Function at 0x50f060
Capabilities:
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407214
xor eax, eax
push ebp
push 0x50f17f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryW
mov eax, dword [ebp - 0xc]
call fcn.004042cc
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryW
mov esi, eax
test esi, esi
je 0x50f0de
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 4]
call fcn.004073d8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00407904
jne 0x50f0de
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 8]
call fcn.004073d8
mov eax, ebx
call fcn.004042e8
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x50f15c
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.wininet.dll_FindNextUrlCacheEntryW
call sub.kernel32.dll_GetLastError_1
mov edi, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
jne 0x50f154
mov eax, dword [ebp - 0xc]
call fcn.004042cc
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
call sub.wininet.dll_FindNextUrlCacheEntryW
test eax, eax
je 0x50f14d
lea eax, [ebp - 0x14]
mov edx, dword [ebx + 4]
call fcn.004073d8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00407904
jne 0x50f14d
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 8]
call fcn.004073d8
jmp 0x50f15c
mov eax, ebx
call fcn.004042e8
cmp edi, 0x103
jne 0x50f0ed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f186
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407224
lea eax, [ebp - 4]
call fcn.0040721c
ret
Function at 0x50f538
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe48
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1b8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x50f6b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x1a4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x50f58f
mov eax, dword [ebp - 0x10]
mov edx, 0x50f6d0
call fcn.0040722c
jmp 0x50f691
xor eax, eax
push ebp
push 0x50f68a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x50f5c5
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 0x104
call fcn.00406d2c
push 0x104
mov eax, dword [ebp - 4]
call fcn.00406bfc
push eax
call sub.wsock32.dll_gethostname
mov eax, dword [ebp - 4]
call fcn.00406bfc
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
je 0x50f636
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00407448
mov eax, dword [esi]
call fcn.004072b8
call fcn.004154a4
mov edx, eax
mov eax, esi
call fcn.004075a8
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1b0], eax
push dword [ebp - 0x1b0]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1b8]
mov ecx, 0
call fcn.004069a8
mov edx, dword [ebp - 0x1b8]
mov eax, dword [ebp - 8]
call fcn.00407448
mov byte [ebp - 0x11], 1
jmp 0x50f677
call sub.wsock32.dll_WSAGetLastError
sub eax, 0x2734
je 0x50f66a
sub eax, 0xe
je 0x50f65b
sub eax, 0x2b
jne 0x50f677
mov eax, dword [ebp - 0x10]
mov edx, 0x50f714
call fcn.0040722c
jmp 0x50f677
mov eax, dword [ebp - 0x10]
mov edx, 0x50f744
call fcn.0040722c
jmp 0x50f677
mov eax, dword [ebp - 0x10]
mov edx, 0x50f768
call fcn.0040722c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f691
call sub.wsock32.dll_WSACleanup
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f6b9
lea eax, [ebp - 0x1b8]
call fcn.00406710
lea eax, [ebp - 4]
call fcn.00406710
ret

Function at 0x50f788
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x50f80d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407280
lea eax, [ebp - 8]
xor edx, edx
call fcn.00407280
push 0x50f828
push dword [ebp - 4]
push 0x50f858
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004077e4
push 1
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004072b8
push eax
push 0x50f868
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f814
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407224
ret