joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52f2c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
mov dword [ebp - 8], esi
push 0x40
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x52f443
mov eax, dword [ebp - 8]
cmp word [eax], 0x5a4d
jne 0x52f443
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
add eax, esi
mov dword [ebp - 0xc], eax
push 0xf8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x52f443
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
jne 0x52f443
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
add eax, 0xf8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x50]
test ebx, ebx
je 0x52f443
push 0x40
push 0x3000
mov eax, dword [ebp - 0x14]
add eax, ebx
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x52f443
mov eax, dword [ebp - 0xc]
movzx edi, word [eax + 6]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
mov eax, edi
shl eax, 3
lea eax, [eax + eax*4]
add ecx, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call fcn.00408918
mov ecx, dword [ebp - 0x14]
dec ecx
mov eax, dword [ebp - 0x18]
add eax, ebx
xor edx, edx
call fcn.00408918
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x52f3c2
inc ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x14]
add edx, esi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x18]
call fcn.00408918
mov eax, dword [ebp - 0x10]
add eax, 0x28
mov dword [ebp - 0x10], eax
dec ebx
jne 0x52f39a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xa0]
test eax, eax
je 0x52f3ec
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0xa4]
push edx
mov ecx, eax
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 0x18]
call fcn.0052f140
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x80]
add eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.0052f1d8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [ebp - 0x18]
add ecx, edx
mov dword [ebp - 4], ecx
test eax, eax
je 0x52f440
xor eax, eax
push ebp
push 0x52f436
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 1
push edx
call dword [ebp - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52f440
mov edi, dword [ebp - 0x18]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52f44c
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, eax
xor ebx, ebx
test edi, edi
je 0x52f49b
mov esi, edi
mov dword [esp], esi
mov eax, dword [esp]
cmp word [eax], 0x5a4d
jne 0x52f49b
mov eax, dword [esp]
mov eax, dword [eax + 0x3c]
add eax, dword [esp]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp dword [eax], 0x4550
jne 0x52f49b
push 0x4000
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x50]
push eax
push esi
call sub.kernel32.dll_VirtualFree_1
test eax, eax
je 0x52f49b
mov bl, 1
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x52f904
Capabilities:
Get hostname
Resolve dns

Disassembly:
add esp, 0xffffff90
mov eax, 0x52f94c
mov dword [esp], eax
push 0x65
lea eax, [esp + 0xc]
push eax
call sub.WS2_32.DLL_gethostname_1
lea eax, [esp + 8]
push eax
call sub.WS2_32.DLL_gethostbyname_1
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x52f943
mov eax, dword [esp + 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.WS2_32.DLL_inet_ntoa
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x70
ret

Function at 0x52f970
Capabilities:
Create tcp socket

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, 1
push 6
push 1
push 2
call sub.WS2_32.DLL_socket_1
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x52f98a
xor ebx, ebx
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x52f990
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040555c
xor eax, eax
push ebp
push 0x52fa26
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0x10
call fcn.00403758
mov word [ebp - 0x14], 2
push edi
call sub.WS2_32.DLL_htons_1
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 4]
call fcn.0040556c
push eax
call sub.WS2_32.DLL_inet_addr
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi]
push eax
call sub.WS2_32.DLL_connect_1
mov edi, eax
inc edi
jne 0x52fa10
call sub.WS2_32.DLL_WSAGetLastError_1
cmp eax, 0x2733
je 0x52fa10
mov eax, esi
call fcn.0052f958
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52fa2d
lea eax, [ebp - 4]
call fcn.00405090
ret

Function at 0x52fa38
Capabilities:
Get socket status

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
mov dword [esp], edx
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 8]
call fcn.0052f82c
lea edx, [esp + 8]
mov eax, dword [ebx]
call fcn.0052f81c
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.WS2_32.DLL_select
test eax, eax
setg al
add esp, 0x10c
pop ebx
ret
Function at 0x52fbac
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x52fbb5
mov eax, dword [ebp - 4]
add esp, 0xfffff7f4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2810], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x52fd18
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405090
mov esi, 3
mov dl, 1
mov eax, dword [0x419e74]
call fcn.0040412c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x52fcf8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040556c
mov dword [ebp - 8], eax
push 0
mov eax, ebx
call fcn.0040536c
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [edi]
push eax
call sub.WS2_32.DLL_send_1
lea eax, [ebp - 0x280c]
xor ecx, ecx
mov edx, 0x2800
call fcn.00403758
jmp 0x52fcce
test esi, esi
jg 0x52fcc5
call fcn.00404aac
jmp 0x52fcff
push 0
push 0x2800
lea eax, [ebp - 0x280c]
push eax
mov eax, dword [edi]
push eax
call sub.WS2_32.DLL_recv_1
lea eax, [ebp - 0x2810]
lea edx, [ebp - 0x280c]
mov ecx, 0x2800
call fcn.00405300
mov edx, dword [ebp - 0x2810]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.0052fa7c
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x52fcbd
test bl, bl
je 0x52fcb6
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
call fcn.00404aac
jmp 0x52fcff
push 1
call sub.kernel32.dll_Sleep_1
dec esi
cmp dword [edi], 0xffffffff
je 0x52fcce
test esi, esi
jne 0x52fc57
mov eax, edi
mov edx, 5
call fcn.0052fa38
test al, al
jne 0x52fc49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52fcff
mov eax, dword [ebp - 0xc]
call fcn.0040415c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52fd1f
lea eax, [ebp - 0x2810]
call fcn.00405090
ret
Function at 0x52fe24
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040555c
xor eax, eax
push ebp
push 0x52ff0d
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
call sub.WS2_32.DLL_gethostname_1
lea eax, [ebp - 0x10c]
mov edx, dword [ebp - 4]
call fcn.0040af68
lea eax, [ebp - 0x10c]
push eax
call sub.WS2_32.DLL_gethostbyname_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x52fef7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x52fef7
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x52fef7
push ebx
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 1]
mov dword [ebp - 0x124], eax
mov byte [ebp - 0x120], 0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x118], 0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 3]
mov dword [ebp - 0x114], eax
mov byte [ebp - 0x110], 0
lea edx, [ebp - 0x12c]
mov ecx, 3
mov eax, 0x52ff24
call fcn.0040b98c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52ff14
lea eax, [ebp - 4]
call fcn.00405090
ret

Function at 0x530058
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
mov dword [esp], 2
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
pop edx
ret
Function at 0x534bec
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffff800
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x800
call fcn.00403758
push 0x800
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.0040556c
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov edx, esi
mov eax, esp
call fcn.0040b0d8
add esp, 0x800
pop esi
pop ebx
ret

Function at 0x5351d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x535267
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00405090
mov eax, dword [ebp - 4]
call fcn.0040536c
test al, al
jbe 0x535251
mov byte [ebp - 9], al
mov bl, 1
lea eax, [ebp - 0x10]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.00405278
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00405374
xor eax, eax
mov al, bl
mov edx, dword [edi]
movzx eax, byte [edx + eax - 1]
add esi, eax
imul esi, dword [ebp - 8]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 9]
jne 0x535213
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53526e
lea eax, [ebp - 0x10]
call fcn.00405090
ret

Function at 0x53aac4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x53ab3f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.0041908c
test al, al
je 0x53ab29
mov eax, 0xff
call fcn.00402b08
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0040b0d8
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.0040f880
mov eax, ebx
call fcn.00402b38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53ab46
lea eax, [ebp - 8]
call fcn.00405090
ret
Function at 0x540ff8
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x559af0], 0
mov eax, dword [0x55a32c]
cmp dword [eax], 2
jne 0x5411d1
mov eax, dword [0x559df0]
cmp dword [eax], 5
jl 0x5411d1
call fcn.0053e128
test al, al
jne 0x541029
call fcn.0053e134
call fcn.0053e120
mov dword [0x559af8], eax
push 0x5411d4
mov eax, dword [0x559af8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559abc], eax
cmp dword [0x559abc], 0
jne 0x541084
mov edx, 0x8000
mov eax, 0x5411e8
call fcn.00410914
mov dword [0x559af4], eax
mov eax, dword [0x559af4]
mov dword [0x559af8], eax
push 0x5411d4
mov eax, dword [0x559af8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559abc], eax
cmp dword [0x559abc], 0
je 0x5411cc
push 0x5411f4
mov eax, dword [0x559af8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559ac0], eax
cmp dword [0x559ac0], 0
je 0x5411cc
push 0x541200
mov eax, dword [0x559af8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559ac4], eax
cmp dword [0x559ac4], 0
je 0x5411cc
mov byte [0x559af0], 1
push 0x541210
mov eax, dword [0x559af8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559ac8], eax
push 0x54121c
mov eax, dword [0x559af8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559acc], eax
push 0x541228
mov eax, dword [0x559af8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559ad0], eax
push 0x541238
mov eax, dword [0x559af8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559ad4], eax
push 0x541248
mov eax, dword [0x559af8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559ad8], eax
mov edx, 0x8000
mov eax, 0x541260
call fcn.00410914
mov dword [0x559afc], eax
cmp dword [0x559afc], 0
je 0x5411d1
push 0x541270
mov eax, dword [0x559afc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559adc], eax
push 0x54128c
mov eax, dword [0x559afc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559ae0], eax
push 0x5412ac
mov eax, dword [0x559afc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559ae4], eax
push 0x5412c8
mov eax, dword [0x559afc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559ae8], eax
push 0x5412e0
mov eax, dword [0x559afc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x559aec], eax
ret
call fcn.00540f78
ret
Function at 0x543994
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x543abc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0054387c
mov eax, dword [esi]
call fcn.004065ec
add eax, 0x28
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x53b7d0]
call fcn.004067c8
add esp, 4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00402e14
mov ebx, 0x1c
mov eax, dword [ebp - 8]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00402e14
add ebx, 0x1c
mov eax, dword [esi]
call fcn.004065ec
mov dword [ebp - 0xc], eax
mov eax, dword [0x55a230]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 8]
mov ecx, ebx
call fcn.0053c95c
add ebx, 4
mov eax, dword [ebp - 8]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00403758
add ebx, 3
mov eax, dword [ebp - 8]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.004065ec
push eax
lea ecx, [ebp - 8]
mov eax, dword [esi]
xor edx, edx
call fcn.0053c89c
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.0053c884
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.0053c954
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x543ac3
lea eax, [ebp - 8]
mov edx, dword [0x53b7d0]
call fcn.004068f4
ret
Function at 0x5494b0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x5494b8
push ebx
xor eax, eax
push ebp
push 0x54964f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
call sub.ole32.dll_CoInitialize
lea edx, [ebp - 0x4c]
mov eax, 0x549668
call fcn.00539e1c
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x18]
call fcn.00416acc
push 0
push 0
push 0
push 0x54968c
push 0x549690
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00412590
add esp, 0x1c
lea edx, [ebp - 0x5c]
lea eax, [ebp - 0x28]
call fcn.00416bb4
push 0x5496b0
push 0x5496cc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00412590
add esp, 0x10
lea edx, [ebp - 0x6c]
lea eax, [ebp - 0x38]
call fcn.00416bb4
push 0x5496dc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00412590
add esp, 0xc
lea edx, [ebp - 0x80]
lea eax, [ebp - 0x70]
call fcn.00416690
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 4]
mov ecx, 0x5496e8
call fcn.00407098
jmp 0x5495c4
push 0x5496f8
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.00412590
add esp, 0xc
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x88]
call fcn.004159a4
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.00409d08
mov edx, dword [ebp - 0x84]
mov eax, 0x549708
call fcn.004056b0
test eax, eax
setg bl
test bl, bl
jne 0x5495db
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x48]
push eax
push 1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x549571
call sub.ole32.dll_CoUninitialize
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549656
lea eax, [ebp - 0x98]
call fcn.00412588
lea eax, [ebp - 0x88]
mov edx, 2
call fcn.004050b4
lea eax, [ebp - 0x80]
call fcn.00412588
lea eax, [ebp - 0x70]
call fcn.00407054
lea eax, [ebp - 0x6c]
mov edx, dword [0x4010f0]
mov ecx, 2
call fcn.00405dcc
lea eax, [ebp - 0x4c]
call fcn.00407054
lea eax, [ebp - 0x48]
mov edx, dword [0x401100]
mov ecx, 4
call fcn.00405dcc
lea eax, [ebp - 4]
call fcn.00407054
ret
Function at 0x40a519
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], esp
push 0
mov eax, 0
call fcn.0040af50
cmp dword [ebp - 4], esp
je 0x40a546
push 6
call fcn.0040af4a
add esp, 4
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 4], ebx
push 0
push 0
push 0
push VariantClear
push 0
push str.WinHttp.WinhttpRequest.5.1
push 0x10030
push 0
mov ebx, dword [ebp - 4]
push dword [ebx]
push 3
mov ebx, 0x40e330
call fcn.0040af56
add esp, 0x28
and eax, 1
xor eax, 1
test eax, eax
je 0x40a5c5
push VariantClear
push 0
push 0x50237e
push 0x80000301
push 0
push 0
push VariantClear
push 0
push str.Http
push 3
mov ebx, 0x40cdb0
call fcn.0040af56
add esp, 0x28
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 4], ebx
push 0x80000301
push 0
push 0x4e20
push 0x80000301
push 0
push 0x4e20
push 0x80000301
push 0
push 0x4e20
push 0x80000301
push 0
push 0x4e20
push VariantClear
push 0
push str.SetTimeouts
push 0x10030
push 0
mov ebx, dword [ebp - 4]
push dword [ebx]
push 6
mov ebx, 0x40d2f0
call fcn.0040af56
add esp, 0x4c
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 4], ebx
push VariantClear
push 0
push str.Mozilla_5.0__compatible__MSIE_9.0__Windows_NT_6.1__WOW64__Trident_5.0_
push VariantClear
push 0
push str.User_Agent
push VariantClear
push 0
push str.SetRequestHeader
push 0x10030
push 0
mov ebx, dword [ebp - 4]
push dword [ebx]
push 4
mov ebx, 0x40d2f0
call fcn.0040af56
add esp, 0x34
mov esp, ebp
pop ebp
ret 4
Function at 0x418660
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ba50b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004aec4e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4186e2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004ac66d
mov eax, dword [eax]
push 0x5f3204
push eax
call fcn.0049e394
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004aeed9
test bl, bl
je 0x4186e2
push 0x5f3204
lea ecx, [esp + 0xc]
call fcn.004af269
push 0x5f6d84
lea ecx, [esp + 0xc]
call fcn.004af269
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41871e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004aeed9
jmp 0x4187e9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4187a2
lea edx, [esp + 0x7c]
push 0x5f6d80
push edx
call fcn.0049e394
add esp, 8
test eax, eax
je 0x4187a2
lea eax, [esp + 0x7c]
push 0x5f6d7c
push eax
call fcn.0049e394
add esp, 8
test eax, eax
je 0x4187a2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418732
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004aeed9
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x418fe0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x419042
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x419050
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ba58b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x601860]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x419188
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4190b6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004aeed9
xor eax, eax
jmp 0x4191ff
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004af016
push esi
lea ecx, [esp + 0xc]
call fcn.004af2a5
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4191dd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00418fe0
test eax, eax
jne 0x4191dd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00418fe0
test eax, eax
jne 0x4191dd
lea eax, [esp + 0x14]
push 0x5f6d98
push eax
call fcn.0049f560
mov esi, eax
add esp, 8
test esi, esi
jne 0x4191bc
lea ecx, [esp + 0x14]
push 0x5f6d94
push ecx
call fcn.0049f4e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4191bc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x4191bf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004aefc6
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4190ce
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004aeed9
xor eax, eax
jmp 0x4191ff
mov byte [esi], 0
push 0x5f6d90
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004aeed9
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4