joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6568
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403928
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], ebx
mov eax, esi
call fcn.0040584c
mov dword [ebp - 0x2c], eax
mov eax, edi
call fcn.0040584c
mov dword [ebp - 0x28], eax
cmp byte [ebp + 8], 0
je 0x4c65ba
mov dword [ebp - 0x20], 1
jmp 0x4c65bf
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x4c65d0
mov al, 1
jmp 0x4c65d2
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4c6bec
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c6c88
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4c6c3d
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.004055fc
jmp 0x4c6c44
mov eax, ebx
call fcn.0040538c
mov al, byte [0x4c6c94]
push eax
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebx]
mov ecx, 0x4c6ca0
mov edx, 0x4c6cac
call fcn.0040fdd0
mov edx, dword [ebp - 0x108]
mov eax, ebx
call fcn.004053e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6c8f
lea eax, [ebp - 0x108]
call fcn.0040538c
ret

Function at 0x4c7390
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c7445
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004059d8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040584c
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4c73e6
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004058ac
jmp 0x4c73f2
mov eax, ebx
mov edx, 0x4c745c
call fcn.004053e0
mov al, byte [0x4c7464]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
mov ecx, 0x4c7470
mov edx, 0x4c747c
call fcn.0040fdd0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004c5d4c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004053e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c744c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004053b0
lea eax, [ebp - 4]
call fcn.0040538c
ret
Function at 0x4c760c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
mov edi, eax
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, edi
call fcn.0040538c
push 0x40
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c767a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
xor ebx, ebx
jmp 0x4c766b
push dword [esi]
call sub.wsock32.dll_inet_ntoa
mov edx, edi
call fcn.0040b388
inc ebx
mov eax, dword [ebp - 8]
mov esi, dword [eax + ebx*4]
test esi, esi
jne 0x4c765c
call sub.wsock32.dll_WSACleanup
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c7854
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004053e0
mov esi, ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040564c
test ax, ax
jbe 0x4c78c6
mov word [ebp - 0xa], ax
mov bx, 1
mov eax, dword [ebp - 8]
call fcn.004058a4
movzx edi, bx
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec word [ebp - 0xa]
jne 0x4c7889
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4cab64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405c90
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4cab80
test al, 0x10
jne 0x4cab85
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret
Function at 0x4caec0
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405fb4
xor eax, eax
push ebp
push 0x4cb006
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00405dbc
jne 0x4caf17
mov ecx, 0x4cb020
mov dl, 1
mov eax, dword [0x409314]
call fcn.0040e864
mov edx, eax
mov dword [edx + 0xc], 3
mov eax, edx
call fcn.00404c78
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004caaf8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00405b34
mov eax, dword [ebp - 4]
call fcn.004cab64
test al, al
jne 0x4cafd6
mov eax, dword [ebp - 4]
call fcn.00405ca0
cmp eax, 3
jl 0x4cafd6
mov eax, dword [ebp - 4]
call fcn.004cab64
test al, al
jne 0x4cafd6
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00405614
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040ae48
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405c80
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405dbc
je 0x4cafd6
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004caa7c
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.004caec0
test al, al
je 0x4cafb5
push 0
mov eax, dword [ebp - 4]
call fcn.00405c90
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4cafb9
xor ebx, ebx
jmp 0x4cafbb
mov bl, 1
test bl, bl
je 0x4cafd6
test si, si
jbe 0x4cafd6
movzx eax, si
push eax
mov eax, dword [ebp - 4]
call fcn.00405c90
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb00d
lea eax, [ebp - 0x18]
call fcn.00405ad4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004053b0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405aec
ret

Function at 0x4ccf98
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x4ccfaa
add esp, 0xfffffff0
call fcn.0040474c
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp + 0x1c]
call fcn.00405fb4
xor eax, eax
push ebp
push 0x4cd055
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.004043e4
mov dword [edi + 0x38], esi
lea eax, [edi + 0xc]
mov edx, dword [ebp + 0x1c]
call fcn.00405b10
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
mov al, byte [ebp + 8]
mov byte [edi + 0x1c], al
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push 0
lea eax, [edi + 0x40]
mov ecx, 1
mov edx, dword [0x4c9c54]
call fcn.00406be8
add esp, 4
mov eax, edi
call fcn.004ccdec
test al, al
jne 0x4cd03f
call fcn.0040e838
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd05c
lea eax, [ebp + 0x1c]
call fcn.00405ad4
ret
Function at 0x4cd5d4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x14
add esp, 0xfffff004
push eax
dec eax
jne 0x4cd5dd
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14018], ecx
mov dword [ebp - 0x1401c], ecx
mov dword [ebp - 0x14008], edx
mov ebx, eax
lea eax, [ebp - 0x14008]
call fcn.00405fb4
xor eax, eax
push ebp
push 0x4cd7f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x14009], 0
lea edx, [ebp - 0x1401c]
mov eax, dword [ebp - 0x14008]
call fcn.004cad00
mov eax, dword [ebp - 0x1401c]
lea edx, [ebp - 0x14018]
call fcn.004cb03c
mov eax, dword [ebp - 0x14018]
mov edx, 0x4cd810
call fcn.00405dbc
jne 0x4cd7cc
mov dword [ebx + 0xa8], 0
mov dword [ebx + 0xac], 0
mov byte [ebx + 0xa0], 0
push 0
push 3
push 0
push 0
mov eax, dword [ebp - 0x14008]
call fcn.00405c90
mov ecx, 1
mov edx, 0x80000000
call fcn.004cb108
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cd7c5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.004cb19c
mov dword [ebp - 0x14010], eax
push 0
push 0x10000
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cb19c
push 0
lea eax, [ebp - 0x14014]
push eax
push 0x14000
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
mov edi, dword [ebp - 0x14014]
sub edi, 6
test edi, edi
jb 0x4cd73b
inc edi
xor esi, esi
push ebp
mov eax, esi
call fcn.004cd59c
pop ecx
mov byte [ebx + 0xa0], al
cmp byte [ebx + 0xa0], 0
je 0x4cd737
lea eax, [esi + 0x10000]
xor edx, edx
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], edx
mov byte [ebp - 0x14009], 1
jmp 0x4cd73b
inc esi
dec edi
jne 0x4cd702
cmp byte [ebx + 0xa0], 0
jne 0x4cd7af
push ebp
call fcn.004cd4ac
pop ecx
mov esi, eax
cmp esi, dword [ebp - 0x14010]
je 0x4cd7af
mov eax, esi
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cb19c
push 0
lea eax, [ebp - 0x14014]
push eax
push 6
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
push ebp
xor eax, eax
call fcn.004cd59c
pop ecx
mov byte [ebx + 0xa0], al
cmp byte [ebx + 0xa0], 0
je 0x4cd7af
mov eax, esi
xor edx, edx
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], edx
mov byte [ebp - 0x14009], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd7cc
mov eax, dword [ebp - 4]
call fcn.0040aaa4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd7fc
lea eax, [ebp - 0x1401c]
mov edx, 2
call fcn.00405aec
lea eax, [ebp - 0x14008]
call fcn.00405ad4
ret
Function at 0x4d1cf8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x564b24]
mov eax, dword [eax]
call fcn.0046c304
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, esi
jb 0x4d1d03
pop esi
pop ebx
ret

Function at 0x4d2238
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.0040ab14
test al, al
je 0x4d22bf
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00403928
or esi, 0x100
test esi, esi
jns 0x4d2273
call fcn.00404350
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.0040584c
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4d22bf
mov dl, 1
mov eax, dword [0x428a34]
call fcn.00430a6c
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00430e3c
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x4d22bf
mov eax, esp
call fcn.0041066c
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret

Function at 0x4d9f5c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4da016
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405ad4
mov eax, dword [0x564e3c]
cmp dword [eax], 2
jne 0x4d9fcb
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405f6c
mov eax, dword [ebx]
call fcn.00405ca0
push eax
mov eax, dword [ebx]
call fcn.00405c90
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405ca0
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405f6c
jmp 0x4d9ffd
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040b388
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405c80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da01d
lea eax, [ebp - 0x3f0]
call fcn.0040538c
ret
Function at 0x4f7404
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.004f73f0
test eax, eax
jne 0x4f7425
mov eax, esi
call fcn.0040538c
jmp 0x4f74b6
mov eax, ebx
call fcn.004f754c
test al, al
je 0x4f746b
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.0040547c
test edi, edi
je 0x4f7462
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4f74b6
mov eax, esi
call fcn.0040538c
jmp 0x4f74b6
mov ebp, dword [ebx + 0x70]
test ebp, ebp
je 0x4f74af
mov eax, dword [ebp + 0x208]
call fcn.00420314
test eax, eax
jle 0x4f749d
mov eax, dword [ebx + 0x70]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.0043c7d0
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.004053e0
jmp 0x4f74b6
mov eax, esi
mov edx, dword [ebx + 0x70]
mov edx, dword [edx + 0x210]
call fcn.004053e0
jmp 0x4f74b6
mov eax, esi
call fcn.0040538c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x50f938
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x50f950
mov eax, ebx
call fcn.0050f208
cmp dword [ebx + 0x68], 0
jne 0x50f95d
mov eax, ebx
call fcn.0050f1a0
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.0050f020
lea eax, [esp + 0x10]
xor edx, edx
call fcn.004d1940
cmp eax, dword [esp]
je 0x50f9cb
lea eax, [esp + 0x10]
xor edx, edx
call fcn.004d1954
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x50f9a7
adc edx, 0
push edx
lea eax, [esp + 0x14]
xor edx, edx
call fcn.004d1940
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x50f9c0
adc edx, 0
push edx
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_InflateRect
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x50f9e6
push 3
mov eax, dword [esi + 0x10]
call fcn.00452afc
push eax
call sub.user32.dll_GetWindow
mov esi, eax
jmp 0x50f9f3
push 3
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x68]
call fcn.0044ba4c
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.0044ba70
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.0044ba98
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.0044babc
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00407dc0
mov eax, ebp
mov edx, dword [0x564650]
mov byte [edx + 2], al
mov eax, dword [0x564650]
mov byte [eax], 0
mov eax, dword [0x564650]
mov byte [eax + 1], 0
mov eax, dword [0x564650]
mov byte [eax + 3], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00452afc
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00452afc
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00452afc
push eax
call sub.user32.dll_SetWindowLongA
push 2
mov eax, dword [0x564650]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042f448
call fcn.0042aa54
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00452afc
push eax
mov eax, dword [0x564610]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.00452afc
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x51754c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffc4
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x5176ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f448
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x70]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
call fcn.0045ea84
call fcn.00512c6c
mov edx, dword [ebp + 8]
mov dword [edx - 0x4c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x4c], 0
je 0x5175d0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov eax, dword [eax + 0x68]
call fcn.00429c0c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f448
mov eax, dword [eax + 0xc]
pop edx
call fcn.00429c14
mov eax, dword [ebp + 8]
mov dword [eax - 0x50], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429af4
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.0040b218
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x50]
push eax
push 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f448
call fcn.0042aa54
push eax
call sub.gdi32.dll_GetObjectA
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429b68
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429ba4
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429ba4
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429ba4
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429c0c
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectA
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f448
mov eax, dword [eax + 0xc]
pop edx
call fcn.00429aa0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f448
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x54], 0x13
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x94]
mov edx, dword [ecx + edx*8 + 0xc]
call fcn.004298e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x517706
lea eax, [ebp - 4]
call fcn.0040538c
ret
Function at 0x533ffc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x568824
test esi, esi
jne 0x534016
xor eax, eax
jmp 0x534118
cmp dword [ebp], 0
jne 0x534021
call fcn.00533f8c
xor ebx, 0xffffffff
cmp edi, 8
jb 0x5340f1
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x53402d
test edi, edi
jbe 0x534113
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x5340f5
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x550920
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa4
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0x10]
push 0
push 0
push 0
push 0
push 0x550a44
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x550a33
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, esi
call fcn.0040584c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x550a15
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, edi
lea eax, [ebp - 0x55c]
call fcn.00403464
mov edx, 1
lea eax, [ebp - 0x55c]
call fcn.00403c58
push ebx
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
push 0
lea edx, [ebp - 0x410]
mov ecx, dword [ebx]
lea eax, [ebp - 0x55c]
call fcn.004035c0
mov eax, dword [0x564b24]
mov eax, dword [eax]
call fcn.0046c304
cmp dword [ebx], 0
je 0x5509e1
cmp dword [ebx], 0x2dc6c0
jbe 0x55099d
lea eax, [ebp - 0x55c]
call fcn.004035e0
cmp dword [ebx], 0x2dc6c0
jbe 0x5509fa
mov byte [ebp - 1], 0
jmp 0x5509fe
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x550a1c
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret