joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6420
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x5a1b00]
push esi
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x64
push 0x89
push eax
call esi
mov ecx, dword [0x5a1b00]
push 0
push 0x3e8
push 0x78
push ecx
call esi
call fcn.00501240
mov ecx, dword [0x59a15c]
call fcn.004dbea0
test eax, eax
je 0x4d64d6
mov ecx, dword [0x59a15c]
mov dl, byte [ecx + 0x8a4]
test dl, dl
lea eax, [ecx + 0x8a4]
je 0x4d64d6
mov edx, dword [ecx + 0x908]
test edx, edx
jne 0x4d64d6
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov edx, dword [0x59a15c]
mov dword [edx + 0x908], eax
mov ecx, dword [0x59a15c]
mov eax, dword [ecx + 0x908]
cmp eax, 0xffffffff
jne 0x4d64c3
add ecx, 0x8a4
mov edx, 0x64
call fcn.0041e210
mov eax, dword [0x59a15c]
mov dword [eax + 0x908], 0
jmp 0x4d64d6
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov ecx, dword [0x59a15c]
mov dword [ecx + 0x908], eax
call fcn.004c2190
call fcn.0041cfc0
call fcn.00464a60
call fcn.005008f0
mov edx, dword [0x5a1b00]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0
push 0x8047
push edx
call esi
mov eax, dword [0x597d28]
test eax, eax
je 0x4d651c
mov eax, dword [0x5a1b00]
push 0
push 0
push 0x8029
push eax
call esi
mov eax, dword [0x596f70]
test eax, eax
je 0x4d6537
mov ecx, dword [0x5a1b00]
push 0
push 0
push 0x802d
push ecx
call esi
mov eax, dword [0x599bd0]
test eax, eax
je 0x4d6552
mov edx, dword [0x5a1b00]
push 0
push 0
push 0x8033
push edx
call esi
mov al, byte [0x598858]
test al, al
pop esi
jne 0x4d6575
mov eax, dword [0x5a1b00]
push 1
push 0xc2
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
ret
jmp fcn.004d4d00
Function at 0x4d9320
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x589b0c]
sub esp, 8
push ebp
xor ebp, ebp
cmp eax, ebp
jne 0x4d934e
cmp dword [0x5999f8], ebp
jne 0x4d933f
cmp dword [0x5998e8], ebp
je 0x4d9344
call fcn.004d92c0
mov eax, 1
pop ebp
add esp, 8
ret
push esi
call fcn.004d9180
mov esi, dword [0x5998e8]
cmp esi, ebp
mov dword [esp + 8], eax
je 0x4d93d1
push ebx
xor ebx, ebx
cmp esi, ebp
push edi
mov edi, eax
je 0x4d9397
lea esp, [esp]
cmp edi, ebp
je 0x4d9397
mov eax, dword [edi]
mov ecx, dword [esi]
push eax
push ecx
call fcn.00572b46
add esp, 8
test eax, eax
jne 0x4d9392
mov esi, dword [esi + 0x40]
cmp esi, ebp
mov edi, dword [edi + 0x40]
jne 0x4d9370
jmp 0x4d9397
mov ebx, 1
lea ecx, [esp + 0x10]
call fcn.004c29d0
pop edi
cmp ebx, ebp
pop ebx
jne 0x4d93b7
mov dword [0x589b10], ebp
pop esi
mov eax, 1
pop ebp
add esp, 8
ret
mov dword [0x589b10], 1
call fcn.004d92c0
pop esi
mov eax, 1
pop ebp
add esp, 8
ret
cmp eax, ebp
mov dword [0x589b10], ebp
mov dword [0x5999f8], ebp
mov dword [0x5999fc], ebp
mov dword [0x5998e8], eax
je 0x4d93ac
push ebp
push ebp
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebp
mov dword [0x5999fc], eax
je 0x4d942f
lea edx, [esp + 0xc]
push edx
push ebp
push ebp
push 0x4d9050
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebp
mov dword [0x5999f8], eax
jne 0x4d93ac
mov eax, dword [0x5999fc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5999fc], ebp
mov ecx, 0x5998e8
call fcn.004c29d0
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
Function at 0x4daa20
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
mov dword [0x589b1c], 0xffffffff
mov dword [0x589b18], 0xffffffff
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x589b18], eax
je 0x4daa6d
mov edx, dword [0x589b14]
mov ecx, eax
call fcn.004fd2b0
test eax, eax
je 0x4daa6d
mov eax, dword [0x589b18]
push 5
push eax
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
je 0x4daa74
xor ecx, ecx
jmp fcn.004da9a0
mov ecx, dword [0x5a1b00]
mov edx, dword [0x589b18]
push 8
push 0x8034
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
ret
Function at 0x4dc3a0
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [0x59a15c]
mov eax, edx
test eax, eax
push edi
mov edi, ecx
je 0x4dc41e
nop
mov ecx, edx
test ecx, ecx
je 0x4dc3e0
cmp eax, ecx
je 0x4dc3c6
mov ecx, dword [ecx + 0x22dc]
test ecx, ecx
jne 0x4dc3b6
jmp 0x4dc3e0
mov ecx, dword [eax + 0x41c]
test ecx, ecx
je 0x4dc3e0
cmp dword [eax + 4], 0xffffffff
je 0x4dc3e0
mov ecx, dword [eax + 0x164c]
test ecx, ecx
je 0x4dc44b
mov ecx, edx
test ecx, ecx
je 0x4dc414
cmp eax, ecx
je 0x4dc3f6
mov ecx, dword [ecx + 0x22dc]
test ecx, ecx
jne 0x4dc3e6
jmp 0x4dc414
mov ecx, dword [eax + 0x420]
test ecx, ecx
jne 0x4dc44b
mov ecx, dword [eax + 0x440]
test ecx, ecx
jne 0x4dc44b
mov ecx, dword [eax + 0x430]
test ecx, ecx
jne 0x4dc44b
mov eax, dword [eax + 0x22dc]
test eax, eax
jne 0x4dc3b0
mov eax, dword [0x5a1514]
test eax, eax
je 0x4dc443
mov ecx, dword [0x5a1b00]
push 0x84
push ecx
mov dword [0x5a1514], 0
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, edi
pop edi
jmp 0x52bca0
mov eax, dword [0x5a1514]
test eax, eax
jne 0x4dc443
mov eax, dword [0x5a1b00]
push 0
push 0xc8
push 0x84
push eax
mov dword [0x5a1514], 1
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, edi
pop edi
jmp 0x52bca0
mov eax, 1
cmp ecx, eax
jne 0x52bce0
test byte [0x5a1510], al
jne 0x52bd43
mov ecx, dword [0x5a1510]
or ecx, eax
push 0
mov dword [0x5a1510], ecx
call fcn.005657c7
cdq
mov ecx, 0x96
idiv ecx
add edx, 0x12c
push edx
push 0x82
jmp 0x52bd1a
mov eax, 2
cmp ecx, eax
jne 0x52bd27
test byte [0x5a1510], al
jne 0x52bd43
mov ecx, dword [0x5a1510]
or ecx, eax
push 0
mov dword [0x5a1510], ecx
call fcn.005657c7
cdq
mov ecx, 0x96
idiv ecx
add edx, 0x12c
push edx
push 0x83
mov edx, dword [0x5a1b00]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [0x5a1400]
test eax, eax
je 0x52bd43
mov eax, dword [0x5a1514]
test eax, eax
jne 0x52bd43
mov ecx, 5
jmp fcn.0052b760
ret
Function at 0x4dfcc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.005366c0
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x4dfec7
cmp dword [esi + 0x700], 1
jne 0x4dfec7
push ebp
push 0x467160
mov edx, 0x28a
mov ecx, edi
call fcn.00464b70
mov ebx, eax
cmp ebx, ebp
jle 0x4dfec2
mov ecx, esi
call fcn.00536900
test eax, eax
je 0x4dfec2
test bl, 0x40
je 0x4dfd26
mov dword [0x59a1cc], ebp
mov dword [0x59a1d0], ebp
mov dword [0x59a1d4], ebp
test bl, 0x20
je 0x4dfd66
push 0x598350
push ebp
lea edx, [esi + 8]
mov ecx, str.nicklist
call fcn.004ac220
mov eax, dword [0x59a1cc]
mov dword [esi + 0x738], eax
mov ecx, dword [0x59a1d0]
mov dword [esi + 0x720], ecx
mov edx, dword [0x59a1d4]
mov dword [esi + 0x76c], edx
jmp 0x4dfe98
test bl, 1
je 0x4dfd73
mov dword [esi + 0x738], ebp
jmp 0x4dfda0
test bl, 2
je 0x4dfd84
mov dword [esi + 0x738], 1
jmp 0x4dfda0
test bl, 4
je 0x4dfd95
mov dword [esi + 0x738], 2
jmp 0x4dfda0
mov eax, dword [0x59a1cc]
mov dword [esi + 0x738], eax
test bl, bl
jns 0x4dfdb0
mov dword [esi + 0x76c], 1
jmp 0x4dfdb6
mov dword [esi + 0x76c], ebp
test bl, 0x10
je 0x4dfdf6
push 0x598350
push ebp
lea edx, [esi + 8]
mov ecx, str.nicklist
call fcn.004ac220
mov ecx, dword [esi + 0x738]
mov dword [0x59a1cc], ecx
mov edx, dword [esi + 0x720]
mov dword [0x59a1d0], edx
mov eax, dword [esi + 0x76c]
mov dword [0x59a1d4], eax
jmp 0x4dfe93
mov eax, dword [esi + 0x738]
cmp eax, ebp
jne 0x4dfe1c
mov ecx, dword [str.right]
mov dx, word [0x57724c]
mov dword [0x5990e0], ecx
mov word [0x5990e4], dx
jmp 0x4dfe43
cmp eax, 1
jne 0x4dfe39
mov eax, dword [0x5771c4]
mov cl, byte [0x5771c8]
mov dword [0x5990e0], eax
mov byte [0x5990e4], cl
jmp 0x4dfe43
mov dword [0x5990e0], 0x66666f
mov eax, 0x5990e0
lea edx, [eax + 1]
jmp 0x4dfe50
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4dfe50
mov ecx, dword [esi + 0x720]
sub eax, edx
mov edx, dword [esi + 0x76c]
push edx
push ecx
lea edx, [eax + 0x5990e0]
push 0x57a96c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x598350
push 0x5990e0
lea edx, [esi + 8]
mov ecx, str.nicklist
call fcn.004ac220
call fcn.004affa0
mov esi, dword [0x5a1af8]
cmp esi, ebp
je 0x4dfec2
mov edi, 1
cmp dword [esi + 0x700], edi
jne 0x4dfeb8
xor edx, edx
mov ecx, esi
call fcn.004df980
mov esi, dword [esi + 0xd84]
cmp esi, ebp
jne 0x4dfea7
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor ecx, ecx
pop ebx
jmp fcn.0041c8e0

Function at 0x4e1da0
Capabilities:
Capture screenshot
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, ecx
call fcn.004dbf30
mov esi, eax
xor ecx, ecx
test esi, esi
jne 0x4e1db8
pop edi
pop esi
jmp fcn.0041c8e0
call fcn.00525720
mov eax, dword [0x5a1b14]
test eax, eax
jne 0x4e1de3
push esi
push 0
push 0
mov edx, 7
mov ecx, str.Notify_List
call fcn.0053c810
test eax, eax
mov dword [0x5a1b14], eax
je 0x4e1dfb
call fcn.004e0e90
test edi, edi
je 0x4e1dfb
mov ecx, dword [0x5a1b14]
pop edi
xor edx, edx
pop esi
jmp fcn.00492410
pop edi
pop esi
ret
Function at 0x4e1e00
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x3f4
push ebp
mov ebp, ecx
call fcn.004dbea0
test eax, eax
je 0x4e1f3c
push ebx
mov ecx, ebp
call fcn.004e0120
xor ebx, ebx
push ebx
lea eax, [esp + 0xc]
push 0x574f08
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x598350
push 0x3e7
lea ecx, [esp + 0x1c]
push ecx
push 0x574b10
lea edx, [esp + 0x18]
mov ecx, str.Notify
call fcn.004ac570
mov al, byte [esp + 0x14]
test al, al
je 0x4e1f2a
push esi
push edi
lea edx, [esp + 0x1c]
push str.WAVE2:
push edx
call fcn.00563db0
mov edi, eax
add esp, 8
test edi, edi
je 0x4e1e8b
mov byte [edi], 0
mov al, byte [edi + 6]
add edi, 6
test al, al
jne 0x4e1e8b
xor edi, edi
lea eax, [esp + 0x1c]
push str.WAVE:
push eax
call fcn.00563db0
mov esi, eax
add esp, 8
test esi, esi
je 0x4e1eb2
mov byte [esi], 0
mov al, byte [esi + 5]
add esi, 5
test al, al
jne 0x4e1eb2
xor esi, esi
lea ecx, [esp + 0x1c]
push str.NOTE:
push ecx
call fcn.00563db0
add esp, 8
test eax, eax
je 0x4e1ed7
mov byte [eax], 0
mov cl, byte [eax + 5]
add eax, 5
test cl, cl
jne 0x4e1ed7
xor eax, eax
push ebp
push edi
push esi
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.004e12d0
inc ebx
push ebx
lea edx, [esp + 0x14]
push 0x574f08
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x598350
push 0x3e7
lea eax, [esp + 0x24]
push eax
push 0x574b10
lea edx, [esp + 0x20]
mov ecx, str.Notify
call fcn.004ac570
mov al, byte [esp + 0x1c]
test al, al
jne 0x4e1e64
pop edi
pop esi
mov ecx, dword [ebp + 0x201c]
call fcn.005178d0
mov dword [ebp + 0x201c], eax
pop ebx
pop ebp
add esp, 0x3f4
ret
Function at 0x4eccc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push 0
push 0
push 0x18b
mov ebp, ecx
push 0x83
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4ecced
pop ebp
xor ecx, ecx
pop ebx
add esp, 4
jmp fcn.0041c8e0
dec ebx
mov dword [esp + 8], 0
js 0x4ece0e
push esi
push edi
mov edi, edi
push 0x58f8d0
push ebx
push 0x189
push 0x83
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp eax, 0xffffffff
je 0x4ece0c
mov eax, dword [0x59c624]
xor edi, edi
test eax, eax
jne 0x4ecd8c
mov esi, dword [0x58e744]
test esi, esi
je 0x4ece0c
lea esp, [esp]
mov eax, dword [0x59c624]
test eax, eax
je 0x4ecd52
cmp dword [esi + 0x138], 2
jne 0x4ecd7b
push 0x5c
push esi
call fcn.00563c90
add esp, 8
test eax, eax
je 0x4ecd7b
mov cl, byte [eax + 1]
inc eax
test cl, cl
je 0x4ecd7b
push 0x58f8d0
push eax
call fcn.00572b46
add esp, 8
test eax, eax
je 0x4ecdad
mov edi, esi
mov esi, dword [esi + 0x170]
test esi, esi
jne 0x4ecd40
jmp 0x4ece0c
mov esi, dword [0x59d1a8]
test esi, esi
je 0x4ece0c
cmp dword [esi + 0x138], 2
je 0x4ecd31
mov edi, esi
mov esi, dword [esi + 0x170]
test esi, esi
jne 0x4ecd96
jmp 0x4ece0c
test edi, edi
je 0x4ecdc9
mov eax, dword [esi + 0x170]
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x170], eax
mov dword [esi + 0x170], ecx
jmp 0x4ece01
mov eax, dword [0x59c624]
test eax, eax
jne 0x4ecde5
mov edx, dword [0x58e744]
mov eax, dword [edx + 0x170]
mov dword [0x58e744], eax
jmp 0x4ecdf7
mov ecx, dword [0x59d1a8]
mov edx, dword [ecx + 0x170]
mov dword [0x59d1a8], edx
mov eax, dword [esp + 0x10]
mov dword [esi + 0x170], eax
dec ebx
mov dword [esp + 0x10], esi
jns 0x4ecd00
pop edi
pop esi
mov eax, dword [0x59c624]
test eax, eax
jne 0x4ece4b
mov edx, dword [esp + 8]
test edx, edx
mov eax, edx
je 0x4ece72
mov ecx, dword [eax + 0x170]
test ecx, ecx
je 0x4ece35
mov eax, ecx
test eax, eax
jne 0x4ece21
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [0x58e744]
pop ebp
mov dword [eax + 0x170], ecx
mov dword [0x58e744], edx
pop ebx
pop ecx
ret
mov eax, dword [0x59d1a8]
test eax, eax
je 0x4ece72
mov ecx, dword [eax + 0x170]
test ecx, ecx
je 0x4ece68
mov eax, ecx
test eax, eax
jne 0x4ece54
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esp + 8]
mov dword [eax + 0x170], edx
pop ebp
pop ebx
pop ecx
ret
Function at 0x4f3fe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x10
push esi
mov esi, edx
mov dword [esp + 0x10], ecx
mov ecx, esi
mov dword [esp + 8], esi
call fcn.004dbea0
test eax, eax
je 0x4f4158
push ebx
mov ebx, dword [0x59c668]
push ebp
push edi
xor edi, edi
cmp ebx, edi
mov dword [esp + 0x18], edi
je 0x4f4155
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push edi
push edi
push 0x18b
push 0x65
push ebx
call ebp
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x4f4033
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x4f4137
jmp 0x4f4045
mov esi, dword [esp + 0x14]
push 0
push edi
push 0x187
push 0x65
push ebx
call ebp
cmp eax, 0xffffffff
je 0x4f4122
test eax, eax
je 0x4f4122
push 0
push edi
push 0x199
push 0x65
push ebx
call ebp
cmp eax, 0xffffffff
je 0x4f4122
mov esi, dword [esi + 0x203c]
test esi, esi
je 0x4f4122
cmp esi, eax
je 0x4f409a
mov esi, dword [esi + 0x264]
test esi, esi
jne 0x4f4087
jmp 0x4f4122
mov ecx, dword [esi + 0x1ec]
mov eax, dword [esp + 0x1c]
add eax, ecx
test eax, eax
mov dword [esi + 0x1ec], eax
jge 0x4f40ba
mov dword [esi + 0x1ec], 0
mov edx, dword [esi + 0x1ec]
mov eax, 0x2328
cmp edx, eax
jle 0x4f40cf
mov dword [esi + 0x1ec], eax
cmp ecx, dword [esi + 0x1ec]
je 0x4f4122
mov ecx, dword [esp + 0x14]
cmp esi, dword [ecx + 0x203c]
jne 0x4f411a
mov eax, dword [esi + 4]
test eax, eax
je 0x4f40f8
mov edx, dword [0x5a1b00]
push eax
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x1ec]
push 0x4f1fc0
push eax
call fcn.0041e080
mov ecx, dword [0x5a1b00]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 4], eax
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jl 0x4f4041
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4f4145
pop edi
pop ebp
pop ebx
xor ecx, ecx
pop esi
add esp, 0x10
jmp fcn.0041c8e0
mov ecx, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
jmp fcn.004f3440
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
Function at 0x4f5ba0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004dbea0
test eax, eax
je 0x4f5d8d
push ebx
mov ebx, dword [0x59c668]
push ebp
xor ebp, ebp
cmp ebx, ebp
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x18], 0xffffffff
je 0x4f5d8a
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push ebp
push ebp
push 0x18b
push 0x65
push ebx
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x4f5bfb
mov dword [esp + 0x14], ebp
mov eax, ebp
test eax, eax
jle 0x4f5c70
nop
push 0
push ebp
push 0x187
push 0x65
push ebx
call edi
cmp eax, 0xffffffff
je 0x4f5c5d
test eax, eax
je 0x4f5c5d
cmp dword [esp + 0x18], 0xffffffff
jne 0x4f5c21
mov dword [esp + 0x18], ebp
push 0
push ebp
push 0x199
push 0x65
push ebx
call edi
cmp eax, 0xffffffff
je 0x4f5c5d
mov ecx, dword [esi + 0x203c]
mov esi, ecx
test esi, esi
mov dword [esp + 0x1c], 0
je 0x4f5c59
cmp esi, eax
je 0x4f5c7e
mov dword [esp + 0x1c], esi
mov esi, dword [esi + 0x264]
test esi, esi
jne 0x4f5c47
mov esi, dword [esp + 0x10]
inc ebp
cmp ebp, dword [esp + 0x14]
jl 0x4f5c00
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4f5d1c
pop edi
pop ebp
pop ebx
xor ecx, ecx
pop esi
add esp, 0x18
jmp fcn.0041c8e0
test esi, esi
je 0x4f5c59
cmp esi, ecx
jne 0x4f5c8e
mov dword [esp + 0x24], 1
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x4f5ca4
lea eax, [esi + 0x74]
push eax
call fcn.00565467
add esp, 4
mov eax, dword [esi + 0x1f8]
test eax, eax
lea ecx, [esi + 0x1f8]
je 0x4f5cb9
call fcn.004c29d0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4f5cd5
mov ecx, dword [esi + 0x264]
push esi
mov dword [eax + 0x264], ecx
call fcn.005635b5
jmp 0x4f5cf5
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x203c]
mov esi, dword [eax + 0x264]
push eax
call fcn.005635b5
mov eax, dword [esp + 0x14]
mov dword [eax + 0x203c], esi
mov ecx, dword [0x59c668]
add esp, 4
push 0
push ebp
push 0x182
push 0x65
push ecx
mov dword [esp + 0x34], 1
call edi
mov esi, dword [esp + 0x10]
jmp 0x4f5c5e
push 0xffffffffffffffff
push 0
push 0x185
push 0x65
push ebx
call edi
mov ebp, dword [esp + 0x18]
test ebp, ebp
jl 0x4f5d56
push 0
push ebp
push 0x19e
push 0x65
push ebx
call edi
cmp eax, 0xffffffff
jne 0x4f5d49
dec ebp
jns 0x4f5d32
jmp 0x4f5d56
push ebp
push 1
push 0x185
push 0x65
push ebx
call edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4f5d75
mov ecx, esi
call fcn.004f26e0
test eax, eax
jle 0x4f5d75
mov edx, esi
mov ecx, 2
call fcn.004f2890
mov ecx, esi
call fcn.004f3440
pop edi
pop ebp
pop ebx
mov ecx, esi
pop esi
add esp, 0x18
jmp fcn.004f3ee0
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x18
ret
Function at 0x4fd2b0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x59c9f4]
sub esp, 0x10
test eax, eax
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_htons]
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_bind]
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x4fd337
mov al, byte [0x59c9f8]
test al, al
je 0x4fd337
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push 0x59c9f8
mov dword [esp + 0x20], eax
mov word [esp + 0x14], 2
call dword [sym.imp.WSOCK32.dll_inet_addr]
push esi
mov dword [esp + 0x18], eax
call ebx
push 0x10
lea ecx, [esp + 0x14]
push ecx
push edi
mov word [esp + 0x1e], ax
call ebp
test eax, eax
jne 0x4fd324
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
cmp dword [0x59c9f4], 2
jne 0x4fd337
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
push esi
mov dword [esp + 0x20], edx
mov word [esp + 0x14], 2
mov dword [esp + 0x18], edx
call ebx
mov word [esp + 0x12], ax
push 0x10
lea eax, [esp + 0x14]
push eax
push edi
call ebp
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x10
ret
Function at 0x501240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push edi
lea eax, [esp + 0x10]
push eax
push str..html
push bind
mov byte [0x59ca78], 0
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 0x104
jne 0x50131f
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push 0x575c80
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x501318
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x12c]
push str._s_shellopen
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x12c]
push edx
push bind
call esi
test eax, eax
jne 0x501318
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push str.command
push edx
mov dword [esp + 0x24], ebx
call edi
test eax, eax
jne 0x501311
mov edx, 0x59ca78
lea ecx, [esp + 0x24]
call fcn.005011d0
mov eax, dword [esp + 0x18]
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov al, byte [0x59ca78]
test al, al
jne 0x5013c5
lea edx, [esp + 0x10]
push edx
push str.htmlfile_shellopen
push bind
call esi
test eax, eax
jne 0x501374
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push str.command
push edx
mov dword [esp + 0x24], ebx
call edi
test eax, eax
jne 0x50136d
mov edx, 0x59ca78
lea ecx, [esp + 0x24]
call fcn.005011d0
mov eax, dword [esp + 0x10]
push eax
call ebp
mov al, byte [0x59ca78]
test al, al
jne 0x5013c5
lea ecx, [esp + 0x10]
push ecx
push str.http_shellopen
push bind
call esi
test eax, eax
jne 0x5013c5
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push str.command
push ecx
mov dword [esp + 0x24], ebx
call edi
test eax, eax
jne 0x5013be
mov edx, 0x59ca78
lea ecx, [esp + 0x24]
call fcn.005011d0
mov edx, dword [esp + 0x10]
push edx
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret
Function at 0x5013d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x59cb80]
sub esp, 0x10c
test al, al
je 0x5013fb
mov edx, 1
mov ecx, 0x59cb80
call fcn.0041ef30
test eax, eax
jne 0x501487
mov byte [0x59cb80], al
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push edi
xor edi, edi
lea esp, [esp]
test edi, edi
jne 0x501420
lea eax, [esp + 0xc]
push eax
push str.mailto_shellopen
jmp 0x50142a
lea ecx, [esp + 0xc]
push ecx
push str..sta_shellopen
push bind
call esi
test eax, eax
jne 0x501470
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push str.command
push ecx
mov dword [esp + 0x20], 0x104
call ebx
test eax, eax
jne 0x501465
mov edx, 0x59cb80
lea ecx, [esp + 0x14]
call fcn.005011d0
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x59cb80]
test al, al
jne 0x501484
test edi, edi
jne 0x501484
mov edi, 1
jmp 0x501410
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
Function at 0x50ced0
Capabilities:
Extract resource via kernel32 functions
Hide graphical window

Disassembly:
mov eax, dword [0x59e020]
push esi
push edi
push 1
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x59e020]
push 3
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [0x59e020]
push edx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x59e020]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [0x59e020]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x65
push ecx
call edi
mov edx, esi
mov ecx, eax
call fcn.00520240
mov edx, dword [0x59e020]
push 0x12c
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
ret
push esi
mov esi, ecx
mov ecx, dword [0x59e020]
test ecx, ecx
je 0x50cf09
mov eax, dword [0x59e024]
test eax, eax
jne 0x50ceed
call fcn.0040bde0
jmp 0x50cf03
cmp eax, 1
jne 0x50cef9
call fcn.004f0360
jmp 0x50cf03
cmp eax, 2
jl 0x50cf09
call fcn.004fd930
mov ecx, dword [0x59e020]
mov eax, esi
sub eax, 0
pop esi
je 0x50cf66
dec eax
je 0x50cf47
test ecx, ecx
je 0x50cf32
call fcn.004fd760
mov ecx, dword [0x59e024]
cmp ecx, 2
jge 0x50cf2d
mov ecx, 2
jmp 0x50b6b0
cmp dword [0x59e024], 2
jge 0x50cf80
mov dword [0x59e024], 2
jmp 0x50cf80
test ecx, ecx
je 0x50cf5a
call fcn.004f01e0
mov ecx, 1
jmp 0x50b6b0
mov dword [0x59e024], 1
jmp 0x50cf80
test ecx, ecx
je 0x50cf76
call fcn.0040bce0
xor ecx, ecx
jmp 0x50b6b0
mov dword [0x59e024], 0
mov eax, dword [0x589bac]
test eax, eax
je 0x50cf90
mov eax, dword [0x5a1b00]
jmp 0x50cf96
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0
push 0x50be90
push eax
mov eax, dword [0x5a1afc]
push 0x2e4
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
test eax, eax
jne 0x50cfba
xor ecx, ecx
jmp fcn.0041c8e0
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret