joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51145c
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x51149c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 7
push 0
lea eax, [ebp - 8]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5114a6
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x512890
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407214
mov eax, dword [ebp - 8]
call fcn.00407214
mov eax, dword [ebp - 0xc]
call fcn.00407214
xor eax, eax
push ebp
push 0x5129b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.004072b8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, dword [ebp - 0xc]
call fcn.004072b8
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004072b8
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x51299c
xor eax, eax
push ebp
push 0x512995
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
push 0
call sub.wininet.dll_InternetSetOptionW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x512975
push 0
push 0
push 0x25
push 0
call sub.wininet.dll_InternetSetOptionW
test eax, eax
jne 0x512979
xor eax, eax
jmp 0x51297b
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51299c
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5129be
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407224
ret
Function at 0x5129c8
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407214
mov eax, dword [ebp - 8]
call fcn.00407214
mov eax, dword [ebp - 0xc]
call fcn.00407214
mov eax, dword [ebp + 0xc]
call fcn.00407214
xor eax, eax
push ebp
push 0x512b32
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.004072b8
mov esi, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], 3
mov eax, 0x512b48
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004072b8
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x512b0f
xor edx, edx
push ebp
push 0x512b08
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.004072b8
push eax
mov eax, dword [ebp - 0xc]
call fcn.004072b8
push eax
movzx eax, word [ebp + 8]
push eax
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectW
test eax, eax
je 0x512af1
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x512ae8
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionW
test eax, eax
jne 0x512aec
xor eax, eax
jmp 0x512aee
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512b0f
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512b39
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407224
lea eax, [ebp + 0xc]
call fcn.0040721c
ret
Function at 0x512b58
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407214
mov eax, dword [ebp - 8]
call fcn.00407214
xor eax, eax
push ebp
push 0x512c72
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x3c], 4
mov eax, dword [ebp - 8]
call fcn.004072b8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x1c], 2
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004072b8
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x512c57
xor eax, eax
push ebp
push 0x512c50
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x512c30
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionW
test eax, eax
jne 0x512c34
xor eax, eax
jmp 0x512c36
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512c57
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512c79
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407224
ret

Function at 0x512c84
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x512d4c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x512d50
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x512d4c
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x512d43
xor eax, eax
push ebp
push 0x512d3c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionW
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionW
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512d43
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5144b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
xor edx, edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5146de
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0x105
mov eax, dword [ebp - 0x24]
call fcn.004042cc
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x514535
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x51451f
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.004073d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51453c
mov eax, dword [ebp - 0x14]
call fcn.004042e8
ret

Function at 0x515200
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x5152fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x200
call fcn.004042cc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x200
call fcn.00404d10
xor eax, eax
push ebp
push 0x515298
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
or ebx, 0x8000
push ebx
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW_1
test eax, eax
jne 0x515277
mov ecx, 0x515318
mov dl, 1
mov eax, dword [0x40edcc]
call fcn.004192f0
call fcn.00405f48
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004073d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51529f
mov eax, dword [ebp - 0xc]
call fcn.004042e8
ret

Function at 0x51534c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x51544a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x200
call fcn.004042cc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x200
call fcn.00404d10
xor eax, eax
push ebp
push 0x5153c5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x200
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004073d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5153cc
mov eax, dword [ebp - 0xc]
call fcn.004042e8
ret
Function at 0x515468
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x515566
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x200
call fcn.004042cc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x200
call fcn.00404d10
xor eax, eax
push ebp
push 0x5154e1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x200
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004073d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5154e8
mov eax, dword [ebp - 0xc]
call fcn.004042e8
ret
Function at 0x51a688
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, dword [esp]
inc eax
cmp eax, 5
jge 0x51a6a5
xor eax, eax
jmp 0x51a72c
movzx ecx, byte [esi]
and cl, 0xff
movzx ecx, cl
mov eax, ecx
mov ebx, 9
cdq
idiv ebx
mov dword [esp + 4], edx
mov eax, ecx
mov ecx, 9
cdq
idiv ecx
mov ecx, eax
mov eax, ecx
mov ebx, 5
cdq
idiv ebx
mov dword [esp + 8], edx
mov eax, ecx
mov ecx, 5
cdq
idiv ecx
mov dword [esp + 0xc], eax
xor ebx, ebx
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
add ecx, ecx
lea edx, [eax + 1]
movzx edx, byte [esi + edx]
and dl, 0xff
movzx edx, dl
shl edx, cl
add ebx, edx
inc eax
cmp eax, 4
jne 0x51a6e8
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edi
call fcn.0051a1a0
test al, al
jne 0x51a723
xor eax, eax
jmp 0x51a72c
mov edx, ebx
mov eax, edi
call fcn.0051a15c
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x5254e8
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x5255a8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
push edi
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryW
mov eax, dword [edi]
call fcn.004042cc
mov ebx, eax
cmp dword [edi], 0
jbe 0x525527
mov eax, dword [edi]
mov dword [ebx], eax
push edi
push ebx
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryW
mov esi, eax
test esi, esi
je 0x525583
lea eax, [ebp - 4]
mov edx, dword [ebx + 4]
call fcn.004073d8
mov eax, dword [ebp - 4]
call fcn.004072b8
push eax
call sub.wininet.dll_DeleteUrlCacheEntryW
mov edx, dword [edi]
mov eax, ebx
call fcn.004042e8
xor eax, eax
mov dword [edi], eax
push edi
push 0
push esi
call sub.wininet.dll_FindNextUrlCacheEntryW
mov eax, dword [edi]
call fcn.004042cc
mov ebx, eax
cmp dword [edi], 0
jbe 0x525577
mov eax, dword [edi]
mov dword [ebx], eax
push edi
push ebx
push esi
call sub.wininet.dll_FindNextUrlCacheEntryW
test eax, eax
jne 0x525536
mov edx, dword [edi]
mov eax, ebx
call fcn.004042e8
push esi
call sub.wininet.dll_FindCloseUrlCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5255af
lea eax, [ebp - 4]
call fcn.0040721c
ret
Function at 0x5255b8
Capabilities:
Create process on windows
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x52575f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0052577c
mov eax, ebx
call fcn.004c7fb8
call fcn.005254e8
mov dl, 1
mov eax, dword [0x514850]
call fcn.00514b3c
mov esi, eax
lea ecx, [ebp - 4]
mov edx, 0x21
mov eax, esi
call fcn.00515180
mov eax, dword [ebp - 4]
test eax, eax
je 0x525623
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x525623
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004068c0
test eax, eax
je 0x52562c
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jle 0x525678
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00514cdc
mov eax, esi
call fcn.00515158
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x525678
inc ebx
xor edi, edi
lea ecx, [ebp - 0x10]
mov edx, edi
mov eax, esi
call fcn.00515164
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.004072b8
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
inc edi
dec ebx
jne 0x52564e
lea ecx, [ebp - 4]
mov edx, 0x2d
mov eax, esi
call fcn.00515180
mov eax, dword [ebp - 4]
test eax, eax
je 0x5256a4
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x5256a4
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004068c0
test eax, eax
je 0x5256ad
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jle 0x5256f9
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00514cdc
mov eax, esi
call fcn.00515158
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5256f9
inc ebx
xor edi, edi
lea ecx, [ebp - 0x14]
mov edx, edi
mov eax, esi
call fcn.00515164
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.004072b8
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
inc edi
dec ebx
jne 0x5256cf
mov eax, esi
call fcn.00405470
call fcn.00517a1c
push 1
push 0
push 0
lea edx, [ebp - 0x18]
mov eax, dword [0x550048]
mov eax, dword [eax]
call fcn.004cd4dc
mov eax, dword [ebp - 0x18]
call fcn.004072b8
push eax
push 0x525770
push 0
call sub.shell32.dll_ShellExecuteW
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x525766
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00407224
lea eax, [ebp - 4]
call fcn.0040721c
ret
Function at 0x526fb0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407214
xor eax, eax
push ebp
push 0x52714b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0052a234
mov edx, dword [ebx + 0x3ec]
lea eax, [ebp - 0x2c]
mov ecx, 0x527168
call fcn.00407700
mov eax, dword [ebp - 0x2c]
call fcn.004072b8
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 4]
test eax, eax
je 0x527028
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x527028
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004068c0
test eax, eax
je 0x527031
sub eax, 4
mov eax, dword [eax]
cmp eax, 7
jge 0x52705f
call fcn.00416dbc
fstp qword [ebp - 0x28]
wait
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x10]
mov edx, 0x5271ac
call fcn.00417a7c
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00407280
jmp 0x52706a
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00407280
push dword [ebx + 0x3ec]
push 0x5271cc
push dword [ebp - 8]
push 0x5271f4
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004077e4
mov dl, 1
mov eax, dword [0x42ea70]
call fcn.0043ae8c
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, dword [0x42ea70]
call fcn.0043ae8c
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x52711c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00414fb8
test al, al
je 0x5270cf
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00526d70
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.005241a4
mov edx, dword [ebx + 0x3ec]
lea eax, [ebp - 0x30]
mov ecx, 0x527168
call fcn.00407700
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527123
mov eax, dword [ebp - 0x18]
call fcn.00405470
mov eax, dword [ebp - 0x1c]
call fcn.00405470
ret
Function at 0x52e314
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407214
xor eax, eax
push ebp
push 0x52e3fd
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0
push 0
push 0
push 1
push 0
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne bl
test bl, bl
je 0x52e37a
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004072b8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov esi, eax
test esi, esi
setne bl
jmp 0x52e3b3
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push esi
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0xc], 0
jbe 0x52e3b7
lea edx, [ebp - 0x410]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x10]
test bl, bl
jne 0x52e381
test esi, esi
je 0x52e3c1
push esi
call sub.wininet.dll_InternetCloseHandle
cmp dword [ebp - 0x10], 0
je 0x52e3d0
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x52e3e4
cmp eax, 0
seta bl
jmp 0x52e3e7
setg bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52e404
lea eax, [ebp - 4]
call fcn.0040721c
ret

Function at 0x531154
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00407214
xor eax, eax
push ebp
push 0x53123d
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0
push 0
push 0
push 1
push 0
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne bl
test bl, bl
je 0x5311ba
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004072b8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov esi, eax
test esi, esi
setne bl
jmp 0x5311f3
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push esi
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0xc], 0
jbe 0x5311f7
lea edx, [ebp - 0x410]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x10]
test bl, bl
jne 0x5311c1
test esi, esi
je 0x531201
push esi
call sub.wininet.dll_InternetCloseHandle
cmp dword [ebp - 0x10], 0
je 0x531210
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x531224
cmp eax, 0
seta bl
jmp 0x531227
setg bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x531244
lea eax, [ebp - 4]
call fcn.0040721c
ret
Function at 0x532b7c
Capabilities:
List tcp connections and listeners

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
xor ebx, ebx
xor edi, edi
xor eax, eax
mov dword [esp], eax
push 0
push 5
push 2
push 0
lea eax, [esp + 0x10]
push eax
push edi
call sub.iphlpapi.dll_GetExtendedTcpTable
cmp eax, 0x7a
jne 0x532c21
mov eax, dword [esp]
call fcn.004042cc
mov edi, eax
push 0
push 5
push 2
push 0
lea eax, [esp + 0x10]
push eax
push edi
call sub.iphlpapi.dll_GetExtendedTcpTable
test eax, eax
jne 0x532c17
mov eax, dword [edi]
dec eax
test eax, eax
jl 0x532c17
inc eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
lea eax, [eax + eax*2]
mov esi, dword [edi + eax*8 + 0x10]
mov eax, dword [0x556cd8]
call fcn.00408b90
dec eax
test eax, eax
jl 0x532c09
inc eax
xor edx, edx
mov ecx, dword [0x556cd8]
cmp esi, dword [ecx + edx*4]
sete bl
test bl, bl
jne 0x532c09
inc edx
dec eax
jne 0x532bf5
test bl, bl
jne 0x532c17
inc dword [esp + 4]
dec dword [esp + 8]
jne 0x532bd8
mov edx, dword [esp]
mov eax, edi
call fcn.004042e8
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x5387ac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov bl, 2
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0x14
call fcn.00404d10
push 0x14
lea eax, [ebp - 0x14]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
je 0x5387e7
cmp word [ebp - 0x14], 0x31
jne 0x5387e5
mov bl, 1
jmp 0x5387e7
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53ad88
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004a5cb4
test al, al
je 0x53ae47
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x53ae25
cmp word [esi + 0x67a], 0
je 0x53add9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x67c]
call dword [esi + 0x678]
movzx eax, byte [esi + 0x670]
or al, byte [ebp - 9]
jne 0x53adfc
cmp dword [ebp - 4], 0
jbe 0x53adf8
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x53adfc
xor ebx, ebx
jmp 0x53adfe
mov bl, 1
test bl, bl
jne 0x53ae47
mov eax, dword [0x550048]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x53ae47
mov eax, dword [0x550048]
mov eax, dword [eax]
call fcn.004cc968
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x53ae47
cmp byte [esi + 0x610], 0
jne 0x53ae47
mov edx, 0xfffffdf3
mov eax, esi
call fcn.004f7c7c
cmp eax, 4
jne 0x53adb6
mov byte [esi + 0x670], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret