joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62aeb2
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, 0xaa9e5c
call fcn.00a6fc7c
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x118], ebx
jne 0x62b0b6
cmp dword [edi + 0x394], ebx
jne 0x62b0b6
cmp dword [edi + 0x114], ebx
jne 0x62b0b6
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 0x138]
cmp ecx, ebx
je 0x62b0b6
cmp eax, dword [ecx - 4]
jae 0x62b0b6
mov ecx, dword [edx + ecx]
cmp ecx, dword [ebp + 8]
je 0x62af13
inc eax
add edx, 0x20
jmp 0x62aeee
cmp eax, ebx
jl 0x62b0b6
mov ecx, dword [edi + 0x138]
cmp ecx, ebx
je 0x62b0b6
cmp eax, dword [ecx - 4]
jae 0x62b0b6
mov ecx, dword [ebp + 0x10]
cmp ecx, ebx
jl 0x62b0b6
mov edx, dword [edi + 0x138]
shl eax, 5
lea esi, [eax + edx]
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x62b0b6
cmp ecx, dword [eax - 4]
jae 0x62b0b6
cmp eax, ebx
jne 0x62af65
xor eax, eax
jmp 0x62af68
mov eax, dword [eax - 4]
lea ecx, [ebp + 0xb]
push ecx
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
call fcn.004859ef
mov eax, dword [esi + 0x18]
cmp eax, ebx
mov dword [ebp - 4], ebx
jne 0x62af86
xor eax, eax
jmp 0x62af89
mov eax, dword [eax - 4]
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
call fcn.006303b6
and dword [ebp - 0x14], 0
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x18]
test eax, eax
je 0x62afd3
cmp ebx, dword [eax - 4]
jae 0x62afd3
add eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
lea ecx, [eax + ebx*4]
call fcn.00418f94
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi + 0x18]
mov eax, dword [eax + ecx + 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + ebx*4], eax
inc ebx
add dword [ebp - 0x14], 0x14
jmp 0x62afa1
mov ecx, dword [0xbd9028]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.00a0c10d
push 8
lea ecx, [ebp - 0x30]
call fcn.006f5e40
xor eax, eax
mov al, byte [esi]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.0040661f
push dword [ebp + 0x10]
lea ecx, [ebp - 0x30]
call fcn.0040661f
push dword [ebp + 0xc]
lea ecx, [ebp - 0x30]
call fcn.0040667c
mov eax, dword [0xbd9024]
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x20], 0x10
mov eax, dword [eax + 8]
push ecx
push eax
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x62b043
mov ebx, dword [ebp - 0x3c]
push ebx
lea ecx, [ebp - 0x30]
call fcn.0040667c
mov ecx, dword [0xbd9024]
lea eax, [ebp - 0x30]
push eax
call fcn.00495c5c
mov dword [edi + 0x118], 1
mov eax, dword [0xbdd494]
add esi, 4
push esi
lea ecx, [eax + 0xc]
call fcn.00418f94
mov eax, dword [0xbdd89c]
mov ecx, dword [0xbdd494]
mov eax, dword [eax + 0x28]
mov dword [ecx + 0x10], eax
mov ecx, dword [0xbdd494]
call fcn.0049d72d
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00429f38
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.005c8c39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0045b343
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x6429b5
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0xaabe79
call fcn.00a6fc7c
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x44]
mov dword [ebp - 4], 0xe
call fcn.004063b5
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 0xd
call fcn.004063b5
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0xc
call fcn.004063b5
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xb
call fcn.004063b5
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 0xa
call fcn.004063b5
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 9
call fcn.004063b5
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 8
call fcn.004063b5
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 7
call fcn.004063b5
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 6
call fcn.004063b5
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 5
call fcn.004063b5
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 4
call fcn.004063b5
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 3
call fcn.004063b5
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 2
call fcn.004063b5
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call fcn.004063b5
and byte [ebp - 4], 0
lea ecx, [esi + 8]
call fcn.004063b5
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 4]
call fcn.004063b5
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x660fb0
Capabilities:
Connect to http server
Create http request

Disassembly:
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push 0xba277c
mov esi, ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, edi
mov dword [esi + 0xc], eax
je 0x660ff0
push edi
push edi
push 0x8000001
push edi
push edi
push 0x15
push 0xba2770
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
cmp eax, edi
mov dword [esi + 0x10], eax
jne 0x660ffb
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, esi
call fcn.00661001
xor eax, eax
jmp 0x660ffe
push 1
pop eax
pop edi
pop esi
ret
Function at 0x66107d
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov eax, 0xaae7f8
call fcn.00a6fc7c
sub esp, 0x15c
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
push 0xba14cc
push dword [esi + 0x18]
lea eax, [ebp - 0x1c]
push 0xba2730
push eax
mov dword [ebp - 4], ebx
call fcn.0044549c
add esp, 0x10
lea eax, [ebp - 0x168]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x28], eax
je 0x6611bd
push edi
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x13c]
push eax
push dword [esi + 0x18]
lea eax, [ebp - 0x10]
push 0xba2730
push eax
mov byte [ebp - 4], 1
call fcn.0044549c
add esp, 0x10
mov dword [ebp - 0x14], ebx
mov eax, dword [esi + 0x14]
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x661144
mov ecx, dword [eax - 4]
cmp ecx, ebx
je 0x661144
lea edi, [eax + ecx*4 - 4]
cmp edi, ebx
je 0x661144
cmp edi, dword [esi + 0x14]
mov eax, edi
ja 0x66111f
xor edi, edi
jmp 0x661122
sub edi, 4
push eax
lea ecx, [ebp - 0x14]
call fcn.00418f94
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004735b3
test eax, eax
je 0x661110
mov dword [ebp - 0x20], 1
jmp 0x661110
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push 0xba149c
push eax
mov byte [ebp - 4], 3
call fcn.0044549c
add esp, 0xc
cmp dword [ebp - 0x20], ebx
jne 0x66116d
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea eax, [ebp - 0x168]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.kernel32.dll_FindNextFileA]
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
mov edi, eax
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 2
call fcn.004063b5
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004063b5
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004063b5
cmp edi, ebx
jne 0x6610d5
push dword [ebp - 0x28]
call dword [sym.imp.kernel32.dll_FindClose]
mov ebx, dword [ebp - 0x18]
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004063b5
mov ecx, dword [ebp - 0xc]
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x665a9a
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0xaaeab3
call fcn.00a6fc7c
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0046cce5
xor edi, edi
push 0xffffffffffffffff
lea ecx, [esi + 0x28]
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
push 0xbdd488
mov dword [ebp - 4], edi
mov dword [ecx], edi
call fcn.0041cb7f
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
push 0x1f
pop ebx
mov eax, 0xaff2e0
mov dword [esi + 0x3c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], eax
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x78], 0xb04b40
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0x8c], 0xb04b3c
mov dword [esi + 0xa4], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xa0], 0xb04b38
lea eax, [esi + 0x78]
push 0x64
pop edx
mov dword [esi + 0xb0], edx
lea eax, [esi + 0x8c]
lea eax, [esi + 0xa0]
push 0x18
pop ecx
mov dword [eax + 0x14], ecx
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xb8], 0xb04b34
mov dword [esi + 0xc8], edx
mov dword [esi + 0xcc], ecx
lea eax, [esi + 0xb8]
lea eax, [esi + 0xd0]
mov dword [eax + 4], edi
mov dword [eax + 0xc], edi
mov dword [eax + 8], ebx
mov dword [eax], 0xb04b30
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
pop edi
mov dword [esi], fcn.00666069
mov dword [esi + 4], 0xb04ad0
mov dword [esi + 8], 0xb04acc
mov dword [esi + 0xc], 0xb04ac8
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x67619f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
push edi
jne 0x6761c1
push 0xf4240
mov ecx, 0xbe1de0
call fcn.00402d66
mov dword [esi + 4], eax
mov ecx, esi
call fcn.00676276
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x67622f
push ebx
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
jle 0x676236
push ebx
lea eax, [ebp + 8]
push eax
push 0xf4240
push dword [esi + 4]
mov dword [ebp + 8], ebx
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x676226
push dword [ebp + 8]
mov ecx, esi
push dword [esi + 4]
call fcn.0067629b
sub edi, dword [ebp + 8]
jmp 0x6761f3
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 0xbdd7e4
jmp 0x676246
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, esi
call fcn.00676360
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x676276
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x18], 0
and dword [ecx + 0x1c], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret
Function at 0x69283f
Capabilities:
Check os version

Disassembly:
mov eax, 0xab2e06
call fcn.00a6fc7c
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0x9c
mov ecx, 0xbe1de0
call fcn.00402d66
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x692873
call fcn.00692a82
jmp 0x692875
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
lea ecx, [esi + 0x4bc]
call fcn.006a0330
mov eax, dword [esi + 0x11c]
mov edi, dword [esi + 0x214]
lea ecx, [eax - 0xc]
neg eax
sbb eax, eax
and eax, ecx
cmp dword [esi + 0x294], ebx
je 0x6928ac
mov ecx, dword [esi + 0x17c]
cmp ecx, ebx
jne 0x6928b2
mov ecx, dword [esi + 0x178]
cmp eax, ebx
je 0x6928dc
cmp dword [eax + 0x240], ebx
je 0x6928dc
cmp dword [ecx + 0x204], ebx
je 0x6928dc
push dword [ecx + 0xb4]
add ecx, 0xac
push ecx
call fcn.00416de8
pop ecx
pop ecx
mov edi, eax
cmp dword [esi + 0x294], ebx
je 0x6928ee
mov eax, dword [esi + 0x17c]
cmp eax, ebx
jne 0x6928f4
mov eax, dword [esi + 0x178]
push dword [eax + 0x48]
add eax, 0x40
push eax
call fcn.00416de8
test eax, eax
pop ecx
pop ecx
mov ebx, 0x8c
jne 0x69290f
fldz
jmp 0x692932
mov eax, dword [esi + 0x218]
add eax, edi
cmp eax, 0xa
jg 0x69291f
push 0xa
pop eax
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x692929
mov dword [ebp - 0x10], ebx
fild dword [ebp - 0x10]
fmul qword [0xafef10]
push ecx
push ecx
mov ecx, dword [esi + 0x4c0]
fstp qword [esp]
add ecx, 0x24
call fcn.006a05ff
cmp dword [esi + 0x294], 0
je 0x692958
mov eax, dword [esi + 0x17c]
test eax, eax
jne 0x69295e
mov eax, dword [esi + 0x178]
push dword [eax + 0x48]
add eax, 0x40
push eax
call fcn.00416de8
cmp eax, 3
pop ecx
pop ecx
jne 0x692a33
push ecx
fld1
push ecx
fstp qword [esp]
mov ecx, dword [esi + 0x4c0]
add ecx, 0x78
call fcn.006a05ff
mov eax, dword [esi + 0x218]
add eax, dword [esi + 0x214]
push 0xa
pop edi
cmp eax, edi
jg 0x69299f
mov eax, edi
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x6929a9
mov dword [ebp - 0x10], ebx
fild dword [ebp - 0x10]
push ecx
push ecx
mov ecx, dword [esi + 0x4c0]
fmul qword [0xafef10]
add ecx, 0x84
fstp qword [esp]
call fcn.006a05ff
push ecx
fld1
push ecx
fstp qword [esp]
mov ecx, dword [esi + 0x4c0]
add ecx, 0x54
call fcn.006a05ff
mov eax, dword [esi + 0x218]
add eax, dword [esi + 0x214]
cmp eax, edi
jg 0x6929ef
mov eax, edi
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x6929f9
mov dword [ebp - 0x10], ebx
fild dword [ebp - 0x10]
mov edi, dword [esi + 0x4c0]
push ecx
push ecx
fmul qword [0xafef10]
add edi, 0x6c
mov ecx, edi
fstp qword [esp]
call fcn.006a05ff
mov ebx, dword [esi + 0x4c0]
mov ecx, edi
add ebx, 0x60
call fcn.006a0545
push ecx
push ecx
mov ecx, ebx
fstp qword [esp]
call fcn.006a05ff
mov eax, dword [esi + 0x178]
fld qword [eax + 0x150]
push ecx
lea edi, [esi + 0x178]
push ecx
mov ecx, dword [esi + 0x4c0]
fstp qword [esp]
add ecx, 0x18
call fcn.006a05ff
mov eax, dword [edi]
fld qword [eax + 0x150]
push ecx
push ecx
mov ecx, dword [esi + 0x4c0]
fstp qword [esp]
add ecx, 0x30
call fcn.006a05ff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x692a82
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xab2ea2
call fcn.00a6fc7c
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0xc
push 0
push esi
mov dword [ebp - 0x10], esi
mov dword [esi], 0xafe3f0
call fcn.00a70120
add esp, 0xc
and dword [ebp - 4], 0
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.006a02b8
lea ebx, [esi + 0x18]
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.006a02b8
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.006a02b8
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.006a02b8
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 4
call fcn.006a02b8
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 5
call fcn.006a02b8
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 6
call fcn.006a02b8
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 7
call fcn.006a02b8
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 8
call fcn.006a02b8
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 9
call fcn.006a02b8
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 0xa
call fcn.006a02b8
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 0xb
call fcn.006a02b8
fld qword [0xb00110]
push ecx
push ecx
mov ecx, edi
fstp qword [esp]
mov byte [ebp - 4], 0xc
mov dword [esi], 0xb04f50
call fcn.006a05ff
fld1
push ecx
push ecx
mov ecx, ebx
fstp qword [esp]
call fcn.006a05ff
fld1
push ecx
push ecx
fstp qword [esp]
lea ecx, [esi + 0x24]
call fcn.006a05ff
fld1
push ecx
push ecx
lea ecx, [esi + 0x30]
fstp qword [esp]
call fcn.006a05ff
fld qword [0xb00ae8]
push ecx
push ecx
lea ecx, [esi + 0x3c]
fstp qword [esp]
call fcn.006a05ff
fld1
push ecx
push ecx
lea ecx, [esi + 0x48]
fstp qword [esp]
call fcn.006a05ff
fld1
push ecx
push ecx
lea ecx, [esi + 0x54]
fstp qword [esp]
call fcn.006a05ff
fld1
push ecx
push ecx
lea ecx, [esi + 0x60]
fstp qword [esp]
call fcn.006a05ff
fld1
push ecx
push ecx
lea ecx, [esi + 0x6c]
fstp qword [esp]
call fcn.006a05ff
fldz
push ecx
push ecx
lea ecx, [esi + 0x78]
fstp qword [esp]
call fcn.006a05ff
fldz
push ecx
push ecx
lea ecx, [esi + 0x84]
fstp qword [esp]
call fcn.006a05ff
fldz
push ecx
push ecx
lea ecx, [esi + 0x90]
fstp qword [esp]
call fcn.006a05ff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x6a5b02
Capabilities:
Get number of processors

Disassembly:
mov eax, 0xab3de6
call fcn.00a6fc7c
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0xb04fe0
lea ecx, [esi + 0x70]
mov dword [ebp - 4], 6
call fcn.004453d8
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 5
call fcn.004453d8
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 4
call fcn.004453d8
lea ecx, [esi + 0x44]
mov edi, 0xb04fe4
mov byte [ebp - 4], 3
mov dword [ecx], edi
call fcn.006a72b0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
mov dword [ecx], edi
call fcn.006a72b0
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 1
mov dword [ecx], edi
call fcn.006a72b0
and byte [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [ecx], 0xb00e48
call fcn.0051b7c7
mov ecx, dword [ebp - 0xc]
and dword [0xbdd49c], 0
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x6bb9db
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0xab52b0
call fcn.00a6fc7c
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov eax, ecx
neg eax
lea edx, [ecx - 4]
sbb eax, eax
and eax, edx
push edi
mov dword [ebp - 0x10], esi
mov dword [0xbdef18], eax
push 0xffffffffffffffff
xor ebx, ebx
mov edi, 0xbdd7e4
push edi
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
call fcn.00414aea
push 0xffffffffffffffff
lea ecx, [esi + 8]
push edi
mov byte [ebp - 4], 1
mov dword [ecx], ebx
call fcn.00414aea
mov dword [esi + 0xc], ebx
push 0x7f89
push ebx
mov byte [ebp - 4], 3
mov dword [esi + 0x30], ebx
mov dword [esi], 0xb0509c
call dword [fcn.00be1710]
push 0x7f00
push ebx
mov dword [esi + 0x34], eax
call dword [fcn.00be1710]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x6dd681
Capabilities:
Create http request

Disassembly:
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push 1
push 0xba2b2c
mov esi, ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, edi
mov dword [esi + 0xc], eax
jne 0x6dd6a8
mov ecx, esi
call fcn.006dd6e4
jmp 0x6dd6d9
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.006dd7d8
mov edi, dword [esi + 8]
mov ebx, dword [sym.imp.kernel32.dll_WaitForSingleObject]
push 0x7d0
push edi
call ebx
cmp eax, 0x102
jne 0x6dd6dd
mov ecx, esi
call fcn.006dd6e4
push 0xffffffffffffffff
push edi
call ebx
xor eax, eax
jmp 0x6dd6e0
push 1
pop eax
pop edi
pop esi
pop ebx
ret

Function at 0x6dd70d
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 0x10], eax
je 0x6dd754
push 8
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00a70120
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 7
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x10]
call dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [ebp - 0xc]
push eax
call fcn.00a7042a
pop ecx
mov ecx, dword [ebp + 8]
push 1
mov dword [ecx], eax
pop eax
pop esi
leave
ret 4
Function at 0x6dd7d8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0x18
xor edi, edi
lea eax, [ebp - 0x1c]
push edi
push eax
mov esi, ecx
call fcn.00a70120
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
push edi
neg eax
push edi
sbb eax, eax
push 1
and eax, 4
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], eax
call dword [0xbe157c]
push edi
push edi
push 1
push edi
mov dword [ebp - 0x10], eax
call dword [0xbe157c]
cmp dword [ebp - 0x10], edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
je 0x6dd8e3
cmp eax, edi
je 0x6dd8e3
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
or eax, 4
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x6dd916
push dword [ebp + 0x14]
mov dword [ebp - 4], edi
push dword [ebp + 0x18]
call fcn.00a7243e
add esp, 0x18
cmp eax, edi
mov dword [esi + 8], eax
jne 0x6dd87b
call dword [fcn.00be1644]
push dword [ebp - 0x10]
mov esi, eax
call dword [fcn.00be1530]
jmp 0x6dd8fe
cmp dword [ebp + 0xc], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 4], ecx
je 0x6dd890
push dword [ebp + 0xc]
push eax
call dword [0xbe1558]
push dword [esi + 8]
call dword [0xbe155c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [fcn.00be158c]
push dword [ebp - 0x10]
call dword [fcn.00be1530]
cmp dword [ebp - 8], edi
je 0x6dd8c6
push dword [esi + 8]
call dword [fcn.00be1530]
push dword [ebp - 8]
mov dword [esi + 8], edi
mov dword [esi + 4], edi
jmp 0x6dd908
test byte [ebp - 0x14], 4
je 0x6dd8d5
push dword [esi + 8]
call dword [0xbe1560]
push dword [ebp - 0xc]
call dword [fcn.00be1580]
push 1
pop eax
jmp 0x6dd910
call dword [fcn.00be1644]
cmp dword [ebp - 0x10], edi
mov esi, eax
je 0x6dd8f9
push dword [ebp - 0x10]
call dword [fcn.00be1530]
cmp dword [ebp - 0xc], edi
je 0x6dd907
push dword [ebp - 0xc]
call dword [fcn.00be1530]
push esi
call dword [0xbe1648]
xor eax, eax
pop edi
pop esi
leave
ret 0x14
Function at 0x702399
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea eax, [ebp + 0xc]
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x702403
mov esi, dword [ebp + 0x1c]
mov eax, dword [esi]
mov edi, dword [ebp + 0x14]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x18]
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7023fa
cmp dword [ebp + 0x14], edi
jne 0x7023fa
mov eax, dword [ebp + 8]
cmp dword [esi], eax
jb 0x7023fa
push dword [ebp + 0xc]
mov dword [esi], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x702405
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x702409
Capabilities:
Check os version
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push ebx
push esi
mov esi, 0x104
push esi
xor ebx, ebx
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.00a70120
push 0x208
lea eax, [ebp - 0x310]
push ebx
push eax
call fcn.00a70120
add esp, 0x18
call dword [sym.imp.kernel32.dll_GetVersion]
cmp al, 5
push 1
jb 0x70245c
push 0x23
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x7024ae
push 0x26
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x7024ae
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0xba529c
push 0xba5270
push 0x80000002
mov dword [ebp - 4], esi
call fcn.00702399
add esp, 0x18
test eax, eax
jne 0x7024ae
lea eax, [ebp - 0x108]
push 0xba525c
push eax
call fcn.00a714b0
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call fcn.00a70570
test eax, eax
pop ecx
jbe 0x7024f6
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push 0xba524c
push eax
call fcn.00a70015
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.00a71620
add esp, 0x18
push 1
mov byte [esi + 0x103], bl
pop eax
jmp 0x7024f8
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x79c52f
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push edi
mov edi, dword [esp + 0xc]
push 0xba75fc
push edi
call esi
push 0xba75e4
push edi
mov dword [0xbe1fb0], eax
call esi
push 0xba75d0
push edi
mov dword [0xbe1fb4], eax
call esi
push 0xba75bc
push edi
mov dword [0xbe1fb8], eax
call esi
push 0xba75ac
push edi
mov dword [0xbe1fbc], eax
call esi
pop edi
mov dword [0xbe1fc0], eax
mov eax, 0xbe1fb0
pop esi
cmp dword [eax], 0
je 0x79c596
add eax, 4
cmp eax, 0xbe1fc4
jb 0x79c583
push 1
pop eax
ret
xor eax, eax
ret