joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bf10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405700
xor eax, eax
push ebp
push 0x45bfce
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x45bfa6
push dword fs:[esi]
mov dword fs:[esi], esp
test bl, bl
je 0x45bf66
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004096a8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00405318
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x45bf77
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x45bf99
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x4cb358]
inc ecx
dec edx
jne 0x45bf80
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45bfb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bfd5
lea eax, [ebp - 0xc]
call fcn.00405280
lea eax, [ebp - 4]
call fcn.00405280
ret

Function at 0x45c690
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405700
xor eax, eax
push ebp
push 0x45c774
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0044b8f0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004396dc
lea eax, [ebp - 8]
mov edx, 0x45c788
call fcn.0040554c
mov eax, dword [ebp - 8]
call fcn.00439664
test al, al
je 0x45c759
test bl, bl
je 0x45c71a
lea eax, [ebp - 0x14]
call fcn.0044b8f0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004396dc
lea eax, [ebp - 0x10]
mov edx, 0x45c788
call fcn.0040554c
mov eax, dword [ebp - 0x10]
mov ecx, 1
mov edx, dword [ebp - 4]
call fcn.0044a214
jmp 0x45c759
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00405710
push eax
lea eax, [ebp - 0x1c]
call fcn.0044b8f0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004396dc
lea eax, [ebp - 0x18]
mov edx, 0x45c788
call fcn.0040554c
mov eax, dword [ebp - 0x18]
call fcn.00405710
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c77b
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004052a4
ret

Function at 0x469fd4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
mov eax, esi
call fcn.00469f5c
mov eax, edi
call fcn.00405280
xor edx, edx
push ebp
push 0x46a036
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x7a
mov ebx, 0x4cb9f4
mov edx, dword [ebx]
movzx ecx, si
cmp edx, ecx
jne 0x46a026
mov eax, edi
mov edx, dword [ebx + 4]
call fcn.004052d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46a040
add ebx, 8
dec eax
jne 0x46a009
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46a040
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46ff04
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
cmp dword [0x4d245c], 0
jne 0x46ffc2
call fcn.0046fdd0
test al, al
jne 0x46ffc2
xor edx, edx
push ebp
push 0x46ffb8
push dword fs:[edx]
mov dword fs:[edx], esp
push 1
mov ecx, dword [0x4703e8]
mov dl, 1
mov eax, dword [0x46cc38]
call fcn.0046d204
mov esi, dword [eax + 4]
call sub.kernel32.dll_GetTickCount
mov edi, eax
add edi, 0x1b7740
jmp 0x46ff9d
push 0x14
push esi
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x46ff6f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46ffc2
mov ebx, 0x65
call fcn.00446010
test al, al
je 0x46ff80
dec ebx
jne 0x46ff74
lea eax, [ebp - 4]
push eax
push esi
call sub.kernel32.dll_GetExitCodeThread
cmp dword [ebp - 4], 0x103
je 0x46ff9d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46ffc2
call sub.kernel32.dll_GetTickCount
cmp edi, eax
ja 0x46ff59
push 0
push esi
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46ffc2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x470098
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4700e0
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sym.ctbr.dll_CheckDownload
test al, al
jne 0x4700c3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4700ea
push 0
push ebx
call sub.kernel32.dll_TerminateThread
push 0x3e8
push ebx
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4700ea
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x478cc4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x478d20
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x478cef
call fcn.0040f1e4
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004030fc
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x478d20
call fcn.0040f1e4
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x488e7c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
xor eax, eax
push ebp
push 0x488fe1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi]
mov eax, dword [eax + 0x94]
mov esi, dword [eax + 8]
test esi, esi
je 0x488fcb
mov eax, esi
call fcn.0043ef00
test al, al
jne 0x488ebd
xor ebx, ebx
jmp 0x488fcb
xor eax, eax
call fcn.004bbb44
mov ebx, eax
mov eax, dword [edi]
mov eax, dword [eax + 0x94]
mov esi, dword [eax + 4]
mov edx, dword [esi + 0x60d]
movzx eax, byte [esi + 0x636]
xor ecx, ecx
call fcn.00427510
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0xc]
add edx, 2
add eax, edx
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
jle 0x488fbc
mov eax, dword [edi]
mov eax, dword [eax + 0x94]
mov eax, dword [eax + 8]
call fcn.0043f7e0
cmp ebx, eax
jge 0x488fbc
lea edx, [ebp - 4]
mov eax, dword [edi]
mov eax, dword [eax + 0x94]
mov eax, dword [eax + 8]
call fcn.0043e8b4
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00405cf8
jne 0x488fbc
mov eax, dword [edi]
mov eax, dword [eax + 5]
call fcn.0043f7e0
cmp eax, 0x1c2
jge 0x488fbc
mov eax, dword [edi]
mov eax, dword [eax + 0x94]
mov eax, dword [eax + 8]
call fcn.0043f7e0
mov esi, eax
mov eax, dword [edi]
mov eax, dword [eax + 0x94]
mov eax, dword [eax + 8]
mov edx, ebx
call fcn.0043f7fc
mov eax, dword [edi]
mov eax, dword [eax + 0x94]
mov eax, dword [eax + 8]
call fcn.0043f7e0
add eax, 2
mov edx, dword [edi]
mov edx, dword [edx + 0x94]
mov edx, dword [edx + 4]
mov edx, dword [edx + 0x609]
mov dword [edx + 0x100], eax
push 0
mov eax, dword [edi]
mov eax, dword [eax + 0x125]
mov eax, dword [eax + 0x407]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
sub eax, esi
add ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax - 0xc], ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0xc]
setge bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488fe8
lea eax, [ebp - 4]
call fcn.00405a34
ret
Function at 0x4a1140
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a134b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x125], 0
je 0x4a132d
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x94]
mov eax, dword [eax + 8]
call fcn.0043e8b4
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00405cf8
jne 0x4a1319
mov eax, dword [ebx + 0x94]
mov eax, dword [eax + 8]
call fcn.0043ef00
test al, al
je 0x4a1319
call fcn.00481d8c
test al, al
je 0x4a11ed
mov eax, dword [ebx + 0x94]
mov eax, dword [eax + 8]
call fcn.0043f748
mov edx, eax
add edx, 0x1c
mov eax, dword [ebx + 0x125]
call fcn.0043f760
mov eax, dword [ebx + 0x94]
mov eax, dword [eax + 8]
call fcn.0043f7e0
sub eax, 0x1c
push eax
push 0xa
call sub.user32.dll_GetSystemMetrics
pop edx
sub edx, eax
mov eax, dword [ebx + 0x125]
call fcn.0043f7fc
jmp 0x4a1238
mov eax, dword [ebx + 0x94]
mov eax, dword [eax + 8]
call fcn.0043f748
mov edx, eax
add edx, 0x1c
add edx, 3
mov eax, dword [ebx + 0x125]
call fcn.0043f760
mov eax, dword [ebx + 0x94]
mov eax, dword [eax + 8]
call fcn.0043f7e0
sub eax, 0x1c
push eax
push 0xa
call sub.user32.dll_GetSystemMetrics
pop edx
sub edx, eax
sub edx, 6
mov eax, dword [ebx + 0x125]
call fcn.0043f7fc
mov eax, dword [ebx + 0x94]
mov eax, dword [eax + 8]
call fcn.0043f824
mov esi, eax
mov eax, dword [ebx + 0x125]
call fcn.0043f824
sub esi, eax
sar esi, 1
jns 0x4a125c
adc esi, 0
mov eax, dword [ebx + 0x94]
mov eax, dword [eax + 8]
call fcn.0043f794
add esi, eax
mov edx, esi
mov eax, dword [ebx + 0x125]
call fcn.0043f7ac
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x125]
call fcn.0043eaa0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx + 0x125]
call fcn.00441104
pop edx
call fcn.0043910c
mov esi, eax
mov eax, dword [ebx + 0x125]
call fcn.0043f7e0
cmp esi, eax
jle 0x4a12c0
mov edx, dword [ebx + 0x131]
mov eax, dword [ebx + 0x125]
call fcn.0043eb6c
jmp 0x4a12f8
mov eax, dword [ebx + 0x125]
call fcn.00441104
mov edx, dword [ebx + 0x12d]
call fcn.0043910c
mov esi, eax
mov eax, dword [ebx + 0x125]
call fcn.0043f7e0
cmp esi, eax
jg 0x4a12f8
mov edx, dword [ebx + 0x12d]
mov eax, dword [ebx + 0x125]
call fcn.0043eb6c
push 4
mov eax, dword [ebx + 0x125]
mov eax, dword [eax + 0x407]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x125]
call fcn.00445b6c
jmp 0x4a132d
push 0
mov eax, dword [ebx + 0x125]
mov eax, dword [eax + 0x407]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1352
lea eax, [ebp - 8]
call fcn.00405280
lea eax, [ebp - 4]
call fcn.00405a34
ret
Function at 0x4aca6c
Capabilities:
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, eax
call fcn.004ac688
test al, al
jne 0x4aca8b
mov dword [ebp - 4], 2
jmp 0x4acb0d
xor eax, eax
mov dword [ebx + 0x45], eax
mov dword [ebp - 0xc], 0x10000
mov eax, dword [ebp - 0xc]
call fcn.00402f00
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4acb06
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [ebx + 0x30]
mov eax, dword [eax*4 + 0x4cbe28]
push eax
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov esi, eax
mov dword [ebx + 0x45], esi
test esi, esi
jne 0x4acadc
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 4], eax
jmp 0x4acaf0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004ac994
mov eax, ebx
call fcn.004acc3c
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acb0d
mov eax, dword [ebp - 8]
call fcn.00402f1c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4acc3c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4acc44
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x4acdd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
cmp byte [edi + 0x30], 0
jne 0x4acc71
xor esi, esi
jmp 0x4acd24
movzx ebx, byte [edi + 0x30]
cmp bl, 1
je 0x4acc7f
cmp bl, 2
jne 0x4accb9
lea eax, [ebp - 0xc]
movzx edx, bl
mov edx, dword [edx*4 + 0x4cbe28]
call fcn.00405478
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
call fcn.004094c0
lea edx, [ebp - 0x10]
mov eax, dword [edi + 0x66]
call fcn.004094c0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040585c
dec eax
jne 0x4acd24
xor esi, esi
jmp 0x4acd24
cmp bl, 3
jne 0x4acd24
lea eax, [ebp - 0x14]
mov edx, dword [0x4cbe2c]
call fcn.00405478
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
call fcn.004094c0
lea eax, [ebp - 0x18]
mov edx, dword [0x4cbe30]
call fcn.00405478
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.004094c0
lea edx, [ebp - 0x1c]
mov eax, dword [edi + 0x66]
call fcn.004094c0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040585c
dec eax
je 0x4acd24
lea edx, [ebp - 0x20]
mov eax, dword [edi + 0x66]
call fcn.004094c0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.0040585c
dec eax
je 0x4acd24
xor esi, esi
test esi, esi
je 0x4acdb7
mov eax, edi
call fcn.004acbac
mov esi, eax
test esi, esi
jne 0x4acdb7
mov esi, 1
mov eax, dword [edi + 0x66]
call fcn.00405710
push eax
call sub.kernel32.dll_OutputDebugStringA
movzx eax, byte [edi + 0x30]
cmp al, 1
je 0x4acd58
cmp al, 2
jne 0x4acdaf
lea edx, [ebp - 0x24]
mov eax, dword [edi + 0x66]
call fcn.004094c0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0040585c
dec eax
jne 0x4acd75
xor esi, esi
jmp 0x4acdaf
cmp byte [edi + 0x30], 3
jne 0x4acdaf
lea edx, [ebp - 0x28]
mov eax, dword [edi + 0x66]
call fcn.004094c0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0040585c
dec eax
je 0x4acdaf
lea edx, [ebp - 0x2c]
mov eax, dword [edi + 0x66]
call fcn.004094c0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.0040585c
dec eax
je 0x4acdaf
xor esi, esi
test esi, esi
jne 0x4acd2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acdd9
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.004052a4
ret
Function at 0x4b3e04
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x104], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b3ea6
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [0x4cc584]
cmp byte [eax], 8
jb 0x4b3e8d
push 0xff
lea eax, [ebp - 0x100]
push eax
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004054f0
mov eax, dword [ebp - 0x104]
mov edx, 0x4b3ec0
call fcn.004056a8
setne bl
test bl, bl
je 0x4b3e8d
push esi
call sub.user32.dll_GetParent
mov esi, eax
push esi
call sub.user32.dll_IsWindow
test eax, eax
je 0x4b3e8d
mov eax, esi
call fcn.004b3e04
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3ead
lea eax, [ebp - 0x104]
call fcn.00405280
ret
Function at 0x4b6670
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call fcn.00405700
xor eax, eax
push ebp
push 0x4b6730
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403a38
push ebp
call fcn.004b65a8
pop ecx
xor eax, eax
push ebp
push 0x4b6713
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
mov eax, dword [ebp - 0x40]
call fcn.00405710
push eax
call sub.wininet.dll_InternetCrackUrlA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x41], al
mov eax, ebx
mov edx, dword [ebp - 0x2c]
call fcn.00405478
mov eax, esi
mov edx, dword [ebp - 0x10]
call fcn.00405478
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00405478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b671a
push ebp
call fcn.004b6630
pop ecx
ret

Function at 0x4b6744
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov eax, ebx
call fcn.00405280
mov dword [esp], 0xff
lea eax, [esp + 4]
xor ecx, ecx
mov edx, dword [esp]
call fcn.00403a38
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.004054f0
add esp, 0x104
pop ebx
ret

Function at 0x4b7410
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405700
mov eax, dword [ebp - 8]
call fcn.00405700
xor eax, eax
push ebp
push 0x4b755b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b752e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405710
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00405478
mov eax, dword [ebp - 0x14]
call fcn.00405710
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.00439664
test al, al
je 0x4b7489
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b7538
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41d450]
call fcn.00420cd0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4b7515
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x41d5d0]
call fcn.004210f8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b74f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00420b18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b74ff
mov eax, dword [ebp - 0xc]
call fcn.00404288
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7562
lea eax, [ebp - 0x14]
call fcn.00405280
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052a4
ret
Function at 0x4b7e98
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405700
xor eax, eax
push ebp
push 0x4b7f39
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403a38
lea eax, [ebp - 0x40]
call fcn.00457658
xor eax, eax
push ebp
push 0x4b7f1c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x40], 0x3c
lea eax, [ebp - 0x40]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405710
push eax
call sub.wininet.dll_InternetCrackUrlA
mov eax, ebx
mov edx, dword [ebp - 0x30]
call fcn.00405478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7f23
lea eax, [ebp - 0x40]
call fcn.00457768
ret

Function at 0x4b7f48
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405700
xor eax, eax
push ebp
push 0x4b7fe2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403a38
lea eax, [ebp - 0x44]
call fcn.00457658
xor eax, eax
push ebp
push 0x4b7fc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x44], 0x3c
lea eax, [ebp - 0x44]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405710
push eax
call sub.wininet.dll_InternetCrackUrlA
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7fcc
lea eax, [ebp - 0x44]
call fcn.00457768
ret
Function at 0x4c1d34
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405700
xor eax, eax
push ebp
push 0x4c1f09
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0xffffffff
lea eax, [ebp - 0x5c]
call fcn.004c1c54
xor eax, eax
push ebp
push 0x4c1de0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x5c], 0x3c
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405710
push eax
call sub.wininet.dll_InternetCrackUrlA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x4c]
call fcn.00405478
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x40]
call fcn.00405478
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x38]
call fcn.00405478
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x30]
call fcn.00405478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1de7
lea eax, [ebp - 0x5c]
call fcn.004c1cd4
ret

Function at 0x4c5c48
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 9
push 0
push 0
dec ecx
jne 0x4c5c51
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
call fcn.00405700
xor eax, eax
push ebp
push 0x4c5fc0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0x800c0011
xor ecx, ecx
push ebp
push 0x4c5f8e
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 0x1c]
add eax, 0x30
xor ecx, ecx
mov edx, 0x3c
call fcn.00403a38
mov eax, dword [ebp - 0x1c]
add eax, 0x30
call fcn.00457658
xor eax, eax
push ebp
push 0x4c5d10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x30], 0x3c
mov eax, dword [ebp - 0x1c]
add eax, 0x30
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405710
push eax
call sub.wininet.dll_InternetCrackUrlA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x5c]
call fcn.00405478
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x28], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5d17
mov eax, dword [ebp - 0x1c]
add eax, 0x30
call fcn.00457768
ret
Function at 0x402af0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404328
test esi, esi
jne 0x402b26
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404418
jmp 0x402b44
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a04
mov edi, eax
test esi, esi
je 0x402b44
cmp dword [ebx], 0
je 0x402b44
dec esi
jmp 0x402b2d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403368
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x592020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403400
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033e0
xor eax, eax
push ebp
push 0x4033d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40341c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x592020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x592020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404128
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x59a04c], 0
je 0x404189
cmp word [0x59a220], 0xd7b2
jne 0x404151
cmp dword [0x59a228], 0
jbe 0x404151
mov eax, 0x59a21c
call dword [0x59a238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x59206c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4041b0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x592030], 0
jne 0x4041a5
push 0
push 0x592064
push 0x59206c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4042dc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040277c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x59a04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4042a4
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc