joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1a14
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040570c
xor eax, eax
push ebp
push 0x4d1beb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [0x54f5bc]
mov edx, dword [edx]
call fcn.00405324
mov eax, dword [ebp - 8]
call fcn.0040a5f4
test al, al
jne 0x4d1a8a
lea edx, [ebp - 8]
mov eax, dword [0x54f700]
mov eax, dword [eax]
call fcn.0040aa24
cmp dword [ebp - 4], 0
jne 0x4d1a9d
lea eax, [ebp - 4]
mov edx, 0x4d1c00
call fcn.00405324
lea edx, [ebp - 0xc]
mov eax, dword [0x54f428]
call fcn.004709a8
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ecx, 0x4d1c0c
call fcn.00406e98
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov ecx, 0x4d1c1c
call fcn.00406e98
lea edx, [ebp - 0x128]
mov eax, dword [0x54f700]
mov eax, dword [eax]
call fcn.0040aa24
lea eax, [ebp - 0x128]
push eax
lea edx, [ebp - 0x12c]
mov eax, dword [0x54f700]
mov eax, dword [eax]
call fcn.0040ab64
mov edx, dword [ebp - 0x12c]
pop eax
call fcn.00405558
mov eax, dword [ebp - 0x128]
call fcn.0040571c
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
mov eax, dword [ebp - 8]
call fcn.0040571c
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x1c]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x121]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x121]
mov ecx, 0x105
call fcn.004054fc
push dword [ebp - 0x134]
push 0x4d1c34
push dword [ebp - 4]
push 0x4d1c40
lea eax, [ebp - 0x130]
mov edx, 4
call fcn.00405620
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x18]
call fcn.00405c14
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405c24
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1bf2
lea eax, [ebp - 0x134]
mov edx, 4
call fcn.004052b0
lea eax, [ebp - 0x18]
call fcn.00405a94
lea eax, [ebp - 0x14]
call fcn.00406e54
lea eax, [ebp - 0x10]
call fcn.00406e54
lea eax, [ebp - 0xc]
call fcn.00406e54
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052b0
ret
Function at 0x4d264c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4d26cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x41
Function at 0x4d3000
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040570c
xor eax, eax
push ebp
push 0x4d3102
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403b20
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.00403b20
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040571c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4d30ec
mov eax, dword [ebp - 0x5c]
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x54]
mov dword [eax], edx
mov dword [edi], 0x10007
push edi
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetThreadContext
lea eax, [ebp - 8]
push eax
push 4
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadProcessMemory
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
jmp 0x4d30cf
cmp dword [ebp - 0x68], 0x10000
je 0x4d30e2
add edi, dword [ebp - 0x6c]
push 0x1c
lea eax, [ebp - 0x78]
push eax
push edi
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x4d30c3
mov eax, dword [ebp + 0xc]
sub edi, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3109
lea eax, [ebp - 4]
call fcn.0040528c
ret
Function at 0x4f6244
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov byte [eax + 0xd], 1
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
pop ebp
ret

Function at 0x4f6258
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x4f6270
mov byte [ebx + 0xd], 0
pop ebx
pop ebp
ret

Function at 0x4f6378
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
push 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.004f62e4
mov esi, eax
mov eax, ebx
call fcn.00404368
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x4f8650
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040570c
lea esi, [ebp - 0x44]
xor eax, eax
push ebp
push 0x4f87dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4f87f8
call fcn.00405868
test eax, eax
jne 0x4f869b
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4f8804
call fcn.004055a4
mov eax, esi
mov edx, 0x3c
call fcn.004f807c
mov dword [esi + 8], 0x21
mov dword [esi + 0x14], 0x101
mov dword [esi + 0x20], 0x81
mov dword [esi + 0x28], 0x81
mov dword [esi + 0x30], 0x801
mov dword [esi + 0x38], 0x801
mov eax, 0x21
call fcn.00402f90
mov dword [esi + 4], eax
mov eax, 0x101
call fcn.00402f90
mov dword [esi + 0x10], eax
mov eax, 0x81
call fcn.00402f90
mov dword [esi + 0x1c], eax
mov eax, 0x81
call fcn.00402f90
mov dword [esi + 0x24], eax
mov eax, 0x801
call fcn.00402f90
mov dword [esi + 0x2c], eax
mov eax, 0x801
call fcn.00402f90
mov dword [esi + 0x34], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4f872b
sub ebx, 4
mov ebx, dword [ebx]
push esi
push 0x80000000
push ebx
mov eax, dword [ebp - 4]
call fcn.0040571c
push eax
call sub.wininet.dll_InternetCrackUrlA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x4f8797
mov eax, edi
mov edx, dword [esi + 4]
call fcn.00405484
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x10]
call fcn.00405484
mov eax, dword [ebp + 0x18]
mov edx, dword [esi + 0x2c]
call fcn.00405484
mov eax, dword [ebp + 0x14]
mov edx, dword [esi + 0x1c]
call fcn.00405484
mov eax, dword [ebp + 0x10]
mov edx, dword [esi + 0x24]
call fcn.00405484
mov eax, dword [ebp + 0xc]
mov edx, dword [esi + 0x34]
call fcn.00405484
mov eax, dword [ebp + 8]
movzx edx, word [esi + 0x18]
mov word [eax], dx
mov eax, dword [esi + 0x34]
call fcn.00402fac
mov eax, dword [esi + 0x2c]
call fcn.00402fac
mov eax, dword [esi + 0x24]
call fcn.00402fac
mov eax, dword [esi + 0x1c]
call fcn.00402fac
mov eax, dword [esi + 0x10]
call fcn.00402fac
mov eax, dword [esi + 4]
call fcn.00402fac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f87e4
lea eax, [ebp - 4]
call fcn.0040528c
ret
Function at 0x4f880c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
push esi
push edi
mov esi, ecx
mov eax, esi
test eax, eax
je 0x4f8825
mov eax, dword [esi - 4]
push eax
push esi
mov esi, edx
mov ecx, esi
test ecx, ecx
je 0x4f8832
mov ecx, dword [esi - 4]
add al, cl
inc eax
lea edi, [ebp - 0x100]
mov edx, eax
stosb byte es:[edi], al
mov al, cl
stosb byte es:[edi], al
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
std
dec edi
mov esi, edi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x4f8850
cld
pop edi
pop esi
movzx ecx, byte [ebp - 0x100]
inc ecx
lea edx, [ebp - 0x100]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f8874
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
push esi
push edi
mov dword [ebp - 0x184], ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0x80]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
movzx ecx, byte [ebp - 0x80]
lea edx, [ebp - 0x7f]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
push esi
push edi
xor eax, eax
lea esi, [ebp - 0x80]
lodsb al, byte [esi]
push esi
push eax
mov ecx, eax
mov edx, eax
mov edi, esi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x4f88ba
pop eax
pop esi
lea edi, [ebp - 0x100]
mov cl, byte [esi]
inc ecx
sub eax, ecx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x180]
stosb byte es:[edi], al
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, esi
lea edx, [ebp - 0x100]
call fcn.004054f0
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.004054f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f9088
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov byte [ebp - 1], dl
mov esi, eax
xor ebx, ebx
test byte [ebp - 1], 1
je 0x4f909e
add ebx, 0x20
test byte [ebp - 1], 2
je 0x4f90a7
add ebx, 2
test byte [ebp - 1], 4
je 0x4f90ae
inc ebx
test byte [ebp - 1], 8
je 0x4f90b7
add ebx, 4
test byte [ebp - 1], 0x10
je 0x4f90c3
add ebx, 0x100
test byte [ebp - 1], 0x20
je 0x4f90cf
add ebx, 0x1000
push ebx
mov eax, esi
call fcn.0040571c
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb eax, eax
inc eax
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4f9e7c
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4f9f99
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
xor eax, eax
call fcn.004f9d28
pop ecx
test al, al
je 0x4f9f74
mov eax, dword [ebp + 8]
push eax
call fcn.004f9b64
pop ecx
test al, al
jne 0x4f9f74
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x148]
push eax
call sub.wininet.dll_HttpSendRequestA
test eax, eax
je 0x4f9f74
mov eax, dword [ebp + 8]
push eax
mov eax, 0x13
call fcn.004f9ba4
pop ecx
test al, al
je 0x4f9f74
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
add edx, 0xffffeffc
mov ecx, 0x1000
call fcn.004054fc
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.0040a048
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x190], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov esi, dword [eax + 0x190]
cmp esi, 0xc8
je 0x4f9f3f
mov eax, dword [ebp + 8]
cmp esi, 0xce
jne 0x4f9f74
mov eax, dword [ebp + 8]
push eax
mov eax, 5
call fcn.004f9ba4
pop ecx
test al, al
je 0x4f9f74
lea eax, [ebp - 8]
mov edx, dword [ebp + 8]
add edx, 0xffffeffc
mov ecx, 0x1000
call fcn.004054fc
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040a048
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
call fcn.004f9b64
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9fa0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052b0
ret

Function at 0x4fe638
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4fe666
mov eax, ebx
call fcn.004ff0ec
cmp dword [ebx + 0x40], 0
je 0x4fe65f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4fe6d7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4fe6c9
cmp dword [ebx + 8], 0
je 0x4fe688
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4fe69a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4fe6c9
cmp dword [ebx + 8], 0
je 0x4fe67b
cmp eax, 3
je 0x4fe6ad
dec eax
jne 0x4fe67b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4fe67b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4fe67b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4fe6f5
cmp dword [ebx + 0x14], 0xcc
je 0x4fe6f5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004fe700
pop ebx
ret
Function at 0x50ec18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 1
call fcn.0050eba4
mov ebx, eax
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x50ec77
mov eax, esi
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.004054fc
push ebx
call sub.advapi32.dll_RegCloseKey_1
jmp 0x50ec84
mov eax, esi
call fcn.0040528c
push ebx
call sub.advapi32.dll_RegCloseKey_1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x50f7d8
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov byte [ebp - 1], al
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x50f853
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x18]
push eax
push 0x50f85c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp byte [ebp - 1], 0
je 0x50f81f
mov dword [ebp - 0x10], 2
jmp 0x50f824
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50fca8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], 0
xor edx, edx
push ebp
push 0x50fce9
push dword fs:[edx]
mov dword fs:[edx], esp
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x50fcdf
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50fcf3
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x533858
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040570c
xor eax, eax
push ebp
push 0x533969
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040528c
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x53394c
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x294]
mov edx, dword [ebp - 4]
call fcn.0040addc
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x533939
mov edx, dword [eax + 0xc]
test edx, edx
je 0x533939
mov esi, dword [edx]
test esi, esi
je 0x533939
push ebx
movzx eax, byte [esi]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [esi + 1]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [esi + 2]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
movzx eax, byte [esi + 3]
mov dword [ebp - 0x29c], eax
mov byte [ebp - 0x298], 0
lea edx, [ebp - 0x2b4]
mov ecx, 3
mov eax, 0x533980
call fcn.0040b44c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533953
call sub.wsock32.dll_WSACleanup
ret
Function at 0x53398c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x533b01
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x384]
call fcn.004dd000
cmp dword [eax + 0xc], 0
je 0x533ade
mov eax, dword [ebx + 0x384]
call fcn.004dd000
mov eax, dword [eax + 0xc]
cmp dword [eax + 8], 0
je 0x533ade
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x3ec]
cmp eax, 0x1f4
jbe 0x533ade
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x3ec], eax
xor edx, edx
mov eax, dword [ebx + 0x37c]
call fcn.00475154
xor edx, edx
mov eax, dword [ebx + 0x37c]
call fcn.0047521c
xor edx, edx
mov eax, dword [ebx + 0x37c]
call fcn.0047519c
mov eax, dword [ebx + 0x384]
call fcn.004dd000
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
lea eax, [ebp - 4]
call fcn.00405324
mov eax, dword [ebp - 4]
call fcn.004d26e4
test al, al
jne 0x533a56
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00533858
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00405324
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x37c]
call fcn.0047519c
mov eax, dword [ebx + 0x384]
call fcn.004dd000
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x37c]
call fcn.0047529c
mov dl, 1
mov eax, dword [ebx + 0x37c]
call fcn.00475154
mov dl, 1
mov eax, dword [ebx + 0x380]
call fcn.0043c0a8
mov eax, dword [ebx + 0x384]
call fcn.004dd000
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x1c]
mov eax, 0x558a54
call fcn.004052e0
lea eax, [ebp - 0xc]
mov edx, dword [0x558a54]
call fcn.00405c14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x374]
call fcn.004f5b20
mov dl, 1
mov eax, dword [ebx + 0x378]
call fcn.004509d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533b08
lea eax, [ebp - 0xc]
call fcn.00405a94
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052b0
ret
Function at 0x535008
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x535010
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x535235
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417f08]
call fcn.00404338
mov edx, dword [0x54f010]
mov dword [edx], eax
mov eax, dword [0x54f010]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 8]
mov dl, 1
mov eax, dword [0x418574]
call fcn.00404338
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x5351f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5351e0
inc ebx
xor esi, esi
lea ecx, [ebp - 4]
mov edx, esi
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp dword [ebp - 4], 0
je 0x5351d8
mov eax, dword [ebp - 4]
cmp byte [eax], 0x3b
je 0x5351d8
push 1
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0051014c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.00405324
push 1
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0051014c
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00405324
push 1
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0051014c
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.00405324
push 1
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0051014c
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.00405324
push 1
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0051014c
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 4]
call fcn.00405324
cmp dword [ebp - 8], 0
je 0x5351d8
cmp dword [ebp - 0xc], 0
je 0x5351d8
cmp dword [ebp - 0x14], 0
je 0x5351d8
mov edx, dword [0x4d13b8]
mov eax, 0x14
call fcn.004062bc
mov edi, eax
mov eax, dword [ebp - 8]
call fcn.0040a00c
mov dword [edi], eax
lea eax, [edi + 4]
mov edx, dword [ebp - 0xc]
call fcn.004052e0
lea eax, [edi + 8]
mov edx, dword [ebp - 0x10]
call fcn.004052e0
lea eax, [edi + 0xc]
mov edx, dword [ebp - 0x14]
call fcn.004052e0
lea eax, [edi + 0x10]
mov edx, dword [ebp - 0x18]
call fcn.004052e0
mov eax, dword [0x54f010]
mov eax, dword [eax]
mov edx, edi
call fcn.0041a5ac
inc esi
dec ebx
jne 0x53508a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5351fd
mov eax, dword [ebp - 0x20]
call fcn.00404368
ret
Function at 0x535fa0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040570c
xor eax, eax
push ebp
push 0x5360b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040528c
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x536094
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x294]
mov edx, dword [ebp - 4]
call fcn.0040addc
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x536081
mov edx, dword [eax + 0xc]
test edx, edx
je 0x536081
mov esi, dword [edx]
test esi, esi
je 0x536081
push ebx
movzx eax, byte [esi]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [esi + 1]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [esi + 2]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
movzx eax, byte [esi + 3]
mov dword [ebp - 0x29c], eax
mov byte [ebp - 0x298], 0
lea edx, [ebp - 0x2b4]
mov ecx, 3
mov eax, 0x5360c8
call fcn.0040b44c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53609b
call sub.wsock32.dll_WSACleanup
ret

Function at 0x537d90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x537ddc
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
lea eax, [ebp - 4]
call fcn.00537d54
mov eax, dword [ebp - 4]
call fcn.0040571c
push eax
push 0x537de8
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537de3
lea eax, [ebp - 4]
call fcn.0040528c
ret