joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e75c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
lea eax, [esp + 0x1c]
mov edi, ecx
push eax
xor ebx, ebx
push edi
mov dword [esp + 0x28], edx
mov byte [edx], bl
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jne 0x4e75f0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x400
ret
push ebp
push esi
call fcn.00591118
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x4e76c2
mov ecx, dword [esp + 0x20]
push ebp
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4e76b9
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
push str.VarFileInfoTranslation
push ebp
mov dword [esp + 0x20], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4e76b9
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4e76b9
mov ecx, dword [esp + 0x10]
shr ecx, 2
xor esi, esi
test ecx, ecx
jle 0x4e76b9
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x4e7660
mov eax, dword [esp + 0x1c]
jmp 0x4e7660
movzx edx, word [eax + esi*4 + 2]
movzx eax, word [eax + esi*4]
push edx
push eax
lea ecx, [esp + 0x30]
push str.StringFileInfo_04x_04xFileVersion
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4e76ad
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4e76ad
cmp byte [eax], bl
je 0x4e76ad
cmp dword [esp + 0x14], ebx
jne 0x4e76cf
mov edx, dword [esp + 0x10]
inc esi
shr edx, 2
cmp esi, edx
jl 0x4e7657
push ebp
call fcn.0059112a
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x400
ret
mov edx, dword [esp + 0x24]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4e76d5
push ebp
call fcn.0059112a
add esp, 4
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x400
ret
Function at 0x4e7870
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
mov eax, dword [0x5eeee0]
test eax, eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadAcceleratorsA]
je 0x4e788f
push 0x46
push eax
call esi
mov dword [0x5eeeb8], eax
mov eax, dword [0x5eeee0]
mov ecx, dword [0x5eeeb8]
test ecx, ecx
jne 0x4e78b5
mov eax, dword [0x5f92e8]
push 0x46
push eax
call esi
test eax, eax
mov dword [0x5eeeb8], eax
jne 0x4e78b0
xor eax, eax
pop esi
ret
mov eax, dword [0x5eeee0]
test eax, eax
je 0x4e78c3
push 0x47
push eax
call esi
mov dword [0x5eeebc], eax
mov eax, dword [0x5eeebc]
test eax, eax
jne 0x4e78e0
mov ecx, dword [0x5f92e8]
push 0x47
push ecx
call esi
test eax, eax
mov dword [0x5eeebc], eax
je 0x4e78ac
mov edx, dword [0x5f92ec]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push edi
push 0
push edx
call esi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
mov eax, dword [0x5f92e8]
push eax
push 0x49aa40
push 2
call edi
test eax, eax
mov dword [0x5ed574], eax
jne 0x4e7916
pop edi
xor eax, eax
pop esi
ret
mov ecx, dword [0x5f92ec]
push 0
push ecx
call esi
mov edx, dword [0x5f92e8]
push eax
push edx
push 0x49bd60
push 3
call edi
test eax, eax
mov dword [0x5ed580], eax
je 0x4e7911
mov esi, dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push str.MSWHEEL_ROLLMSG
call esi
test eax, eax
mov dword [0x5eeef4], eax
je 0x4e7911
push str.TaskbarCreated
call esi
xor ecx, ecx
test eax, eax
setne cl
pop edi
mov dword [0x5eeef8], eax
pop esi
mov eax, ecx
ret
Function at 0x4e9930
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x5f92ec]
push esi
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x64
push 0x89
push eax
call esi
mov ecx, dword [0x5f92ec]
push 0
push 0x3e8
push 0x78
push ecx
call esi
mov ecx, dword [0x5f002c]
call fcn.004f0af0
test eax, eax
je 0x4e99e1
mov ecx, dword [0x5f002c]
mov dl, byte [ecx + 0x8a4]
test dl, dl
lea eax, [ecx + 0x8a4]
je 0x4e99e1
mov edx, dword [ecx + 0x908]
test edx, edx
jne 0x4e99e1
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov edx, dword [0x5f002c]
mov dword [edx + 0x908], eax
mov ecx, dword [0x5f002c]
mov eax, dword [ecx + 0x908]
cmp eax, 0xffffffff
jne 0x4e99ce
add ecx, 0x8a4
mov edx, 0x64
call fcn.00420e60
mov eax, dword [0x5f002c]
mov dword [eax + 0x908], 0
jmp 0x4e99e1
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov ecx, dword [0x5f002c]
mov dword [ecx + 0x908], eax
call fcn.004d34d0
call fcn.0041f710
call fcn.0046c1f0
call fcn.00519460
mov edx, dword [0x5f92ec]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0
push 0x8047
push edx
call esi
mov eax, dword [0x5edb20]
test eax, eax
je 0x4e9a27
mov eax, dword [0x5f92ec]
push 0
push 0
push 0x8029
push eax
call esi
mov eax, dword [0x5ccd38]
test eax, eax
je 0x4e9a42
mov ecx, dword [0x5f92ec]
push 0
push 0
push 0x802d
push ecx
call esi
mov eax, dword [0x5efaa0]
test eax, eax
je 0x4e9a5d
mov edx, dword [0x5f92ec]
push 0
push 0
push 0x8033
push edx
call esi
mov al, byte [0x5ee658]
test al, al
pop esi
jne 0x4e9a80
mov eax, dword [0x5f92ec]
push 1
push 0xc2
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
ret
jmp fcn.004e7970
Function at 0x4ef600
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
mov dword [0x5bfc78], 0xffffffff
mov dword [0x5bfc74], 0xffffffff
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x5bfc74], eax
je 0x4ef64d
mov edx, dword [0x5bfc70]
mov ecx, eax
call fcn.00515960
test eax, eax
je 0x4ef64d
mov eax, dword [0x5bfc74]
push 5
push eax
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
je 0x4ef654
xor ecx, ecx
jmp fcn.004ef580
mov ecx, dword [0x5f92ec]
mov edx, dword [0x5bfc74]
push 8
push 0x8034
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
ret
Function at 0x4f0ff0
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [0x5f002c]
mov eax, edx
test eax, eax
push edi
mov edi, ecx
je 0x4f106e
nop
mov ecx, edx
test ecx, ecx
je 0x4f1030
cmp eax, ecx
je 0x4f1016
mov ecx, dword [ecx + 0x2500]
test ecx, ecx
jne 0x4f1006
jmp 0x4f1030
mov ecx, dword [eax + 0x41c]
test ecx, ecx
je 0x4f1030
cmp dword [eax + 4], 0xffffffff
je 0x4f1030
mov ecx, dword [eax + 0x1718]
test ecx, ecx
je 0x4f109b
mov ecx, edx
test ecx, ecx
je 0x4f1064
cmp eax, ecx
je 0x4f1046
mov ecx, dword [ecx + 0x2500]
test ecx, ecx
jne 0x4f1036
jmp 0x4f1064
mov ecx, dword [eax + 0x420]
test ecx, ecx
jne 0x4f109b
mov ecx, dword [eax + 0x440]
test ecx, ecx
jne 0x4f109b
mov ecx, dword [eax + 0x430]
test ecx, ecx
jne 0x4f109b
mov eax, dword [eax + 0x2500]
test eax, eax
jne 0x4f1000
mov eax, dword [0x5f8b6c]
test eax, eax
je 0x4f1093
mov ecx, dword [0x5f92ec]
push 0x84
push ecx
mov dword [0x5f8b6c], 0
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, edi
pop edi
jmp 0x54dc80
mov eax, dword [0x5f8b6c]
test eax, eax
jne 0x4f1093
mov eax, dword [0x5f92ec]
push 0
push 0xc8
push 0x84
push eax
mov dword [0x5f8b6c], 1
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, edi
pop edi
jmp 0x54dc80
mov eax, 1
cmp ecx, eax
jne 0x54dcc0
test byte [0x5f8b68], al
jne 0x54dd23
mov ecx, dword [0x5f8b68]
or ecx, eax
push 0
mov dword [0x5f8b68], ecx
call fcn.0059480a
cdq
mov ecx, 0x96
idiv ecx
add edx, 0x12c
push edx
push 0x82
jmp 0x54dcfa
mov eax, 2
cmp ecx, eax
jne 0x54dd07
test byte [0x5f8b68], al
jne 0x54dd23
mov ecx, dword [0x5f8b68]
or ecx, eax
push 0
mov dword [0x5f8b68], ecx
call fcn.0059480a
cdq
mov ecx, 0x96
idiv ecx
add edx, 0x12c
push edx
push 0x83
mov edx, dword [0x5f92ec]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [0x5f8a58]
test eax, eax
je 0x54dd23
mov eax, dword [0x5f8b6c]
test eax, eax
jne 0x54dd23
mov ecx, 5
jmp fcn.0054d610
ret
Function at 0x4f4df0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.00561000
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x4f5030
cmp dword [esi + 0x71c], 1
jne 0x4f5030
push ebp
push 0x46e950
mov edx, 0x28a
mov ecx, edi
call fcn.0046c300
mov ebx, eax
cmp ebx, ebp
jle 0x4f502b
mov ecx, esi
call fcn.005612a0
test eax, eax
je 0x4f502b
test bl, 0x40
je 0x4f4e5c
mov dword [0x5f009c], ebp
mov dword [0x5f00a0], ebp
mov dword [0x5f00a4], ebp
mov dword [0x5f00a8], ebp
test bl, 0x20
je 0x4f4ea7
push 0x5ee150
push ebp
lea edx, [esi + 8]
mov ecx, str.nicklist
call fcn.004bc990
mov eax, dword [0x5f009c]
mov dword [esi + 0x754], eax
mov ecx, dword [0x5f00a0]
mov dword [esi + 0x73c], ecx
mov edx, dword [0x5f00a4]
mov dword [esi + 0x788], edx
mov eax, dword [0x5f00a8]
mov dword [esi + 0x790], eax
jmp 0x4f4fff
test bl, 1
je 0x4f4eb4
mov dword [esi + 0x754], ebp
jmp 0x4f4ee2
test bl, 2
je 0x4f4ec5
mov dword [esi + 0x754], 1
jmp 0x4f4ee2
test bl, 4
je 0x4f4ed6
mov dword [esi + 0x754], 2
jmp 0x4f4ee2
mov ecx, dword [0x5f009c]
mov dword [esi + 0x754], ecx
test bl, bl
jns 0x4f4ef2
mov dword [esi + 0x788], 1
jmp 0x4f4ef8
mov dword [esi + 0x788], ebp
test bh, 1
je 0x4f4f09
mov dword [esi + 0x790], 1
jmp 0x4f4f0f
mov dword [esi + 0x790], ebp
test bl, 0x10
je 0x4f4f5b
push 0x5ee150
push ebp
lea edx, [esi + 8]
mov ecx, str.nicklist
call fcn.004bc990
mov edx, dword [esi + 0x754]
mov dword [0x5f009c], edx
mov eax, dword [esi + 0x73c]
mov dword [0x5f00a0], eax
mov ecx, dword [esi + 0x788]
mov dword [0x5f00a4], ecx
mov edx, dword [esi + 0x790]
mov dword [0x5f00a8], edx
jmp 0x4f4ffa
mov eax, dword [esi + 0x754]
cmp eax, ebp
jne 0x4f4f7f
mov eax, dword [str.right]
mov cx, word [0x5a7918]
mov dword [0x5eef00], eax
mov word [0x5eef04], cx
jmp 0x4f4fa6
cmp eax, 1
jne 0x4f4f9c
mov edx, dword [str.left]
mov al, byte [0x5a7884]
mov dword [0x5eef00], edx
mov byte [0x5eef04], al
jmp 0x4f4fa6
mov dword [0x5eef00], 0x66666f
mov eax, 0x5eef00
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4f4fb0
mov ecx, dword [esi + 0x790]
push ecx
mov ecx, dword [esi + 0x73c]
sub eax, edx
mov edx, dword [esi + 0x788]
push edx
push ecx
lea edx, [eax + 0x5eef00]
push str.__d__d__d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x5ee150
push 0x5eef00
lea edx, [esi + 8]
mov ecx, str.nicklist
call fcn.004bc990
call fcn.004c0690
mov esi, dword [0x5f92e4]
cmp esi, ebp
je 0x4f502b
mov edi, 1
mov edi, edi
cmp dword [esi + 0x71c], edi
jne 0x4f5021
xor edx, edx
mov ecx, esi
call fcn.004f4a80
mov esi, dword [esi + 0xe08]
cmp esi, ebp
jne 0x4f5010
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor ecx, ecx
pop ebx
jmp fcn.0041f0a0
Function at 0x4f7100
Capabilities:
Capture screenshot
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, ecx
call fcn.004f0b80
mov esi, eax
xor ecx, ecx
test esi, esi
jne 0x4f7118
pop edi
pop esi
jmp fcn.0041f0a0
call fcn.00545400
mov eax, dword [0x5f9300]
test eax, eax
jne 0x4f7148
push 0x5f9300
push esi
push 0
push 0
mov edx, 7
mov ecx, str.Notify_List
call fcn.005677e0
test eax, eax
mov dword [0x5f9300], eax
je 0x4f7160
call fcn.004f61e0
test edi, edi
je 0x4f7160
mov ecx, dword [0x5f9300]
pop edi
xor edx, edx
pop esi
jmp fcn.0049a4f0
pop edi
pop esi
ret
Function at 0x5032a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push 0
push 0
push 0x18b
mov ebp, ecx
push 0x83
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5032cd
pop ebp
xor ecx, ecx
pop ebx
add esp, 4
jmp fcn.0041f0a0
dec ebx
mov dword [esp + 8], 0
js 0x5033ee
push esi
push edi
mov edi, edi
push 0x5c5218
push ebx
push 0x189
push 0x83
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp eax, 0xffffffff
je 0x5033ec
mov eax, dword [0x5f30e4]
xor edi, edi
test eax, eax
jne 0x50336c
mov esi, dword [0x5c4084]
test esi, esi
je 0x5033ec
lea esp, [esp]
mov eax, dword [0x5f30e4]
test eax, eax
je 0x503332
cmp dword [esi + 0x138], 2
jne 0x50335b
push 0x5c
push esi
call fcn.00591bd0
add esp, 8
test eax, eax
je 0x50335b
mov cl, byte [eax + 1]
inc eax
test cl, cl
je 0x50335b
push 0x5c5218
push eax
call fcn.005a299c
add esp, 8
test eax, eax
je 0x50338d
mov edi, esi
mov esi, dword [esi + 0x170]
test esi, esi
jne 0x503320
jmp 0x5033ec
mov esi, dword [0x5f3d20]
test esi, esi
je 0x5033ec
cmp dword [esi + 0x138], 2
je 0x503311
mov edi, esi
mov esi, dword [esi + 0x170]
test esi, esi
jne 0x503376
jmp 0x5033ec
test edi, edi
je 0x5033a9
mov eax, dword [esi + 0x170]
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x170], eax
mov dword [esi + 0x170], ecx
jmp 0x5033e1
mov eax, dword [0x5f30e4]
test eax, eax
jne 0x5033c5
mov edx, dword [0x5c4084]
mov eax, dword [edx + 0x170]
mov dword [0x5c4084], eax
jmp 0x5033d7
mov ecx, dword [0x5f3d20]
mov edx, dword [ecx + 0x170]
mov dword [0x5f3d20], edx
mov eax, dword [esp + 0x10]
mov dword [esi + 0x170], eax
dec ebx
mov dword [esp + 0x10], esi
jns 0x5032e0
pop edi
pop esi
mov eax, dword [0x5f30e4]
test eax, eax
jne 0x50342b
mov edx, dword [esp + 8]
test edx, edx
mov eax, edx
je 0x503452
mov ecx, dword [eax + 0x170]
test ecx, ecx
je 0x503415
mov eax, ecx
test eax, eax
jne 0x503401
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [0x5c4084]
pop ebp
mov dword [eax + 0x170], ecx
mov dword [0x5c4084], edx
pop ebx
pop ecx
ret
mov eax, dword [0x5f3d20]
test eax, eax
je 0x503452
mov ecx, dword [eax + 0x170]
test ecx, ecx
je 0x503448
mov eax, ecx
test eax, eax
jne 0x503434
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esp + 8]
mov dword [eax + 0x170], edx
pop ebp
pop ebx
pop ecx
ret
Function at 0x50b420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x10
push esi
mov esi, edx
mov dword [esp + 0x10], ecx
mov ecx, esi
mov dword [esp + 8], esi
call fcn.004f0af0
test eax, eax
je 0x50b598
push ebx
mov ebx, dword [0x5f31c8]
push ebp
push edi
xor edi, edi
cmp ebx, edi
mov dword [esp + 0x18], edi
je 0x50b595
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push edi
push edi
push 0x18b
push 0x65
push ebx
call ebp
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x50b473
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x50b577
jmp 0x50b485
mov esi, dword [esp + 0x14]
push 0
push edi
push 0x187
push 0x65
push ebx
call ebp
cmp eax, 0xffffffff
je 0x50b562
test eax, eax
je 0x50b562
push 0
push edi
push 0x199
push 0x65
push ebx
call ebp
cmp eax, 0xffffffff
je 0x50b562
mov esi, dword [esi + 0x2258]
test esi, esi
je 0x50b562
cmp esi, eax
je 0x50b4da
mov esi, dword [esi + 0x264]
test esi, esi
jne 0x50b4c7
jmp 0x50b562
mov ecx, dword [esi + 0x1ec]
mov eax, dword [esp + 0x1c]
add eax, ecx
test eax, eax
mov dword [esi + 0x1ec], eax
jge 0x50b4fa
mov dword [esi + 0x1ec], 0
mov edx, dword [esi + 0x1ec]
mov eax, 0x2328
cmp edx, eax
jle 0x50b50f
mov dword [esi + 0x1ec], eax
cmp ecx, dword [esi + 0x1ec]
je 0x50b562
mov ecx, dword [esp + 0x14]
cmp esi, dword [ecx + 0x2258]
jne 0x50b55a
mov eax, dword [esi + 4]
test eax, eax
je 0x50b538
mov edx, dword [0x5f92ec]
push eax
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x1ec]
push 0x509400
push eax
call fcn.00420cd0
mov ecx, dword [0x5f92ec]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 4], eax
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jl 0x50b481
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x50b585
pop edi
pop ebp
pop ebx
xor ecx, ecx
pop esi
add esp, 0x10
jmp fcn.0041f0a0
mov ecx, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
jmp fcn.0050a880
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
Function at 0x50cfe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004f0af0
test eax, eax
je 0x50d1cd
push ebx
mov ebx, dword [0x5f31c8]
push ebp
xor ebp, ebp
cmp ebx, ebp
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x18], 0xffffffff
je 0x50d1ca
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push ebp
push ebp
push 0x18b
push 0x65
push ebx
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x50d03b
mov dword [esp + 0x14], ebp
mov eax, ebp
test eax, eax
jle 0x50d0b0
nop
push 0
push ebp
push 0x187
push 0x65
push ebx
call edi
cmp eax, 0xffffffff
je 0x50d09d
test eax, eax
je 0x50d09d
cmp dword [esp + 0x18], 0xffffffff
jne 0x50d061
mov dword [esp + 0x18], ebp
push 0
push ebp
push 0x199
push 0x65
push ebx
call edi
cmp eax, 0xffffffff
je 0x50d09d
mov ecx, dword [esi + 0x2258]
mov esi, ecx
test esi, esi
mov dword [esp + 0x1c], 0
je 0x50d099
cmp esi, eax
je 0x50d0be
mov dword [esp + 0x1c], esi
mov esi, dword [esi + 0x264]
test esi, esi
jne 0x50d087
mov esi, dword [esp + 0x10]
inc ebp
cmp ebp, dword [esp + 0x14]
jl 0x50d040
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x50d15c
pop edi
pop ebp
pop ebx
xor ecx, ecx
pop esi
add esp, 0x18
jmp fcn.0041f0a0
test esi, esi
je 0x50d099
cmp esi, ecx
jne 0x50d0ce
mov dword [esp + 0x24], 1
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x50d0e4
lea eax, [esi + 0x74]
push eax
call fcn.00593f0c
add esp, 4
mov eax, dword [esi + 0x1f8]
test eax, eax
lea ecx, [esi + 0x1f8]
je 0x50d0f9
call fcn.004d3d60
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x50d115
mov ecx, dword [esi + 0x264]
push esi
mov dword [eax + 0x264], ecx
call fcn.0059112a
jmp 0x50d135
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x2258]
mov esi, dword [eax + 0x264]
push eax
call fcn.0059112a
mov eax, dword [esp + 0x14]
mov dword [eax + 0x2258], esi
mov ecx, dword [0x5f31c8]
add esp, 4
push 0
push ebp
push 0x182
push 0x65
push ecx
mov dword [esp + 0x34], 1
call edi
mov esi, dword [esp + 0x10]
jmp 0x50d09e
push 0xffffffffffffffff
push 0
push 0x185
push 0x65
push ebx
call edi
mov ebp, dword [esp + 0x18]
test ebp, ebp
jl 0x50d196
push 0
push ebp
push 0x19e
push 0x65
push ebx
call edi
cmp eax, 0xffffffff
jne 0x50d189
dec ebp
jns 0x50d172
jmp 0x50d196
push ebp
push 1
push 0x185
push 0x65
push ebx
call edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x50d1b5
mov ecx, esi
call fcn.00509b10
test eax, eax
jle 0x50d1b5
mov edx, esi
mov ecx, 2
call fcn.00509cc0
mov ecx, esi
call fcn.0050a880
pop edi
pop ebp
pop ebx
mov ecx, esi
pop esi
add esp, 0x18
jmp fcn.0050b320
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x18
ret
Function at 0x515960
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x5f3558]
sub esp, 0x10
test eax, eax
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_htons]
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_bind]
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x5159e7
mov al, byte [0x5f3560]
test al, al
je 0x5159e7
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push 0x5f3560
mov dword [esp + 0x20], eax
mov word [esp + 0x14], 2
call dword [sym.imp.WSOCK32.dll_inet_addr]
push esi
mov dword [esp + 0x18], eax
call ebx
push 0x10
lea ecx, [esp + 0x14]
push ecx
push edi
mov word [esp + 0x1e], ax
call ebp
test eax, eax
jne 0x5159d4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
cmp dword [0x5f3558], 2
jne 0x5159e7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
push esi
mov dword [esp + 0x20], edx
mov word [esp + 0x14], 2
mov dword [esp + 0x18], edx
call ebx
mov word [esp + 0x12], ax
push 0x10
lea eax, [esp + 0x14]
push eax
push edi
call ebp
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x10
ret
Function at 0x519df0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0xc]
push eax
push str.http_shellopen
push bind
mov byte [0x5f35f0], 0
mov byte [0x5f36f8], 0
call edi
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ebp, 0x104
jne 0x519e93
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push str.command
push eax
mov dword [esp + 0x20], ebp
call esi
test eax, eax
jne 0x519e59
mov edx, 0x5f35f0
lea ecx, [esp + 0x14]
call fcn.00519d80
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push str.ddeexecApplication
push eax
mov dword [esp + 0x20], ebp
call esi
test eax, eax
jne 0x519e88
lea ecx, [esp + 0x14]
push ecx
mov edx, ebp
mov ecx, 0x5f36f8
call fcn.00420d70
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x5f35f0]
test al, al
jne 0x519f17
lea eax, [esp + 0xc]
push eax
push str.htmlfile_shellopen
push bind
call edi
test eax, eax
jne 0x519f17
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push str.command
push eax
mov dword [esp + 0x20], ebp
call esi
test eax, eax
jne 0x519edd
mov edx, 0x5f35f0
lea ecx, [esp + 0x14]
call fcn.00519d80
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push str.ddeexecApplication
push eax
mov dword [esp + 0x20], ebp
call esi
test eax, eax
jne 0x519f0c
lea ecx, [esp + 0x14]
push ecx
mov edx, ebp
mov ecx, 0x5f36f8
call fcn.00420d70
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret
Function at 0x525f10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x5f4f30]
push esi
push edi
push eax
mov edi, ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x5245e5
mov ecx, dword [0x5f4f30]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x5245f4
mov edx, dword [0x5f4f30]
push 9
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5f4f30]
push 3
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [0x5f4f30]
push ecx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [0x5f4f30]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x5f4f30]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x65
push eax
call esi
mov edx, edi
mov ecx, eax
call fcn.0053f350
mov ecx, dword [0x5f4f30]
push 0x12c
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
ret
push esi
mov esi, ecx
mov ecx, dword [0x5f4f30]
test ecx, ecx
je 0x525f49
mov eax, dword [0x5f4f34]
test eax, eax
jne 0x525f2d
call fcn.0040d230
jmp 0x525f43
cmp eax, 1
jne 0x525f39
call fcn.00507680
jmp 0x525f43
cmp eax, 2
jl 0x525f49
call fcn.00516300
mov ecx, dword [0x5f4f30]
mov eax, esi
sub eax, 0
pop esi
je 0x525fa6
dec eax
je 0x525f87
test ecx, ecx
je 0x525f72
call fcn.00516130
mov ecx, dword [0x5f4f34]
cmp ecx, 2
jge 0x525f6d
mov ecx, 2
jmp 0x5245c0
cmp dword [0x5f4f34], 2
jge 0x525fc0
mov dword [0x5f4f34], 2
jmp 0x525fc0
test ecx, ecx
je 0x525f9a
call fcn.00507500
mov ecx, 1
jmp 0x5245c0
mov dword [0x5f4f34], 1
jmp 0x525fc0
test ecx, ecx
je 0x525fb6
call fcn.0040d130
xor ecx, ecx
jmp 0x5245c0
mov dword [0x5f4f34], 0
mov eax, dword [0x5bfd84]
test eax, eax
je 0x525fd0
mov eax, dword [0x5f92ec]
jmp 0x525fd6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0
push 0x524e60
push eax
mov eax, dword [0x5f92e8]
push 0x2e4
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
test eax, eax
jne 0x525ffa
xor ecx, ecx
jmp fcn.0041f0a0
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret