joyce8/EMBER2024-capa huggingface dataset:
Function at 0x528a50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffac0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0xa0], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xbf], 0
lea edx, [ebp - 0x53d]
mov eax, dword [ebp - 4]
call fcn.0052c6d8
xor edx, edx
push ebp
push 0x528ac5
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15c]
call fcn.0050f08c
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15c]
call fcn.0050f0a8
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x528afe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x11c]
xor edx, edx
call fcn.00496e64
xor edx, edx
push ebp
push 0x528b45
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp word [eax + 0x35a], 0
je 0x528b3b
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x35c]
call dword [ebx + 0x358]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x528b7e
xor edx, edx
push ebp
push 0x528ba3
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 7
mov eax, dword [ebp - 4]
call fcn.00528a24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x528bdc
mov byte [ebp - 0x532], 3
xor edx, edx
push ebp
push 0x528c0e
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x53d]
mov ecx, 0x539
mov eax, dword [ebp - 4]
call fcn.0052aafc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x528c47
xor edx, edx
push ebp
push 0x528c73
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5d5], 0
je 0x528c69
mov eax, dword [ebp - 4]
call fcn.00528d40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x528cac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52bdf8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffac0
push ebx
xor edx, edx
mov dword [ebp - 0x540], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52befc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0052bde4
push 5
mov eax, dword [ebx + 0x15c]
call fcn.0050f08c
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [ebx + 0x15c]
call fcn.0050f0a8
push eax
call sub.user32.dll_ShowWindow
lea edx, [ebp - 0x540]
mov eax, ebx
call fcn.0052a644
mov edx, dword [ebp - 0x540]
mov eax, ebx
call fcn.00532964
mov edx, dword [ebx + 0x520]
mov eax, ebx
call fcn.0053243c
xor edx, edx
mov eax, dword [ebx + 0x128]
call fcn.00496e64
mov dl, 1
mov eax, dword [ebx + 0x15c]
call fcn.0050e9d8
mov edx, 5
mov eax, dword [ebx + 0x15c]
call fcn.0050f0cc
mov dl, 1
mov eax, dword [ebx + 0x11c]
call fcn.00496e64
xor edx, edx
mov eax, ebx
call fcn.00528a24
cmp word [ebx + 0x5a], 0
je 0x52bebd
mov edx, ebx
mov eax, dword [ebx + 0x5c]
call dword [ebx + 0x58]
lea edx, [ebp - 0x539]
mov eax, ebx
call fcn.0052c6d8
mov byte [ebp - 0x52e], 1
lea edx, [ebp - 0x539]
mov ecx, 0x539
mov eax, ebx
call fcn.0052aafc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52bf03
lea eax, [ebp - 0x540]
call fcn.00404e5c
ret

Function at 0x52bf08
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff3c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x52c03d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xa4]
mov eax, dword [esi + 0x360]
call fcn.0040bc3c
cmp dword [ebp - 0xa4], 0
je 0x52c01c
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
jmp 0x52c005
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0xc0], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xac], eax
mov byte [ebp - 0xa8], 0
lea edx, [ebp - 0xc4]
mov ecx, 3
mov eax, 0x52c054
call fcn.0040d570
mov eax, dword [ebp - 4]
mov edx, dword [esi + 0x360]
call fcn.00405284
jne 0x52bff6
xor eax, eax
push ebp
push 0x52bfea
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
lea eax, [ebp - 0xa0]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52c01c
inc ebx
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, 0x3e8
jae 0x52c01c
lea eax, [ebp - 0xa0]
push eax
push ebx
push 0
call sub.user32.dll_EnumDisplaySettingsA
test eax, eax
jne 0x52bf5b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52c044
lea eax, [ebp - 0xa4]
call fcn.00404e5c
lea eax, [ebp - 4]
call fcn.00404e5c
ret
Function at 0x52c638
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffac4
push ebx
mov ebx, eax
mov edx, 5
mov eax, dword [ebx + 0x15c]
call fcn.0050f0cc
push 5
mov eax, dword [ebx + 0x15c]
call fcn.0050f08c
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [ebx + 0x15c]
call fcn.0050f0a8
push eax
call sub.user32.dll_ShowWindow
mov edx, 2
mov eax, ebx
call fcn.00528a24
lea edx, [ebp - 0x539]
mov eax, ebx
call fcn.0052c6d8
mov byte [ebp - 0x52e], 1
lea edx, [ebp - 0x539]
mov ecx, 0x539
mov eax, ebx
call fcn.0052aafc
cmp word [ebx + 0x5a], 0
je 0x52c6bb
mov edx, ebx
mov eax, dword [ebx + 0x5c]
call dword [ebx + 0x58]
cmp word [ebx + 0x222], 0
je 0x52c6d3
mov edx, ebx
mov eax, dword [ebx + 0x224]
call dword [ebx + 0x220]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52e000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9b0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x64c], ecx
mov dword [ebp - 0x650], ecx
mov dword [ebp - 4], ecx
mov esi, edx
lea edi, [ebp - 0x10d]
mov ecx, 0x42
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, eax
xor eax, eax
push ebp
push 0x52e126
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x646]
mov eax, ebx
call fcn.0052c6d8
mov byte [ebp - 0x63b], 0x14
mov edx, dword [0x59fe68]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x52e13c
call fcn.00405184
mov eax, dword [ebp - 4]
call fcn.0040c5d8
test al, al
jne 0x52e07a
mov eax, dword [ebp - 4]
call fcn.0040c5fc
lea eax, [ebp - 0x650]
lea edx, [ebp - 0x104]
call fcn.004050c0
mov eax, dword [ebp - 0x650]
lea edx, [ebp - 0x64c]
call fcn.0040c9dc
mov edx, dword [ebp - 0x64c]
lea eax, [ebp - 4]
call fcn.00405140
mov eax, dword [ebp - 4]
call fcn.0040c5c8
test al, al
je 0x52e0e6
cmp byte [ebp - 0x109], 0
je 0x52e0da
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405338
push eax
push 0x52e148
push 0
call sub.shell32.dll_ShellExecuteA
mov dword [ebp - 0x545], 1
jmp 0x52e0ee
xor eax, eax
mov dword [ebp - 0x545], eax
lea edx, [ebp - 0x646]
mov ecx, 0x539
mov eax, ebx
call fcn.0052aafc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52e12d
lea eax, [ebp - 0x650]
mov edx, 2
call fcn.00404e80
lea eax, [ebp - 4]
call fcn.00404e5c
ret

Function at 0x52e188
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x52e274
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x39c]
call fcn.0040c5c8
test al, al
je 0x52e25e
mov eax, ebx
call fcn.00526a64
cmp word [ebx + 0x36a], 0
je 0x52e1d0
mov edx, ebx
mov eax, dword [ebx + 0x36c]
call dword [ebx + 0x368]
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0052e400
mov edx, 5
mov eax, dword [ebx + 0x15c]
call fcn.0050f0cc
push 5
mov eax, dword [ebx + 0x15c]
call fcn.0050f08c
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [ebx + 0x15c]
call fcn.0050f0a8
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.005301ac
mov eax, ebx
call fcn.0052e150
push 5
push 0
lea eax, [ebp - 4]
mov ecx, dword [ebx + 0x154]
mov edx, 0x52e288
call fcn.00405184
mov eax, dword [ebp - 4]
call fcn.00405338
push eax
mov eax, dword [ebx + 0x39c]
call fcn.00405338
push eax
push 0x52e294
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52e27b
lea eax, [ebp - 4]
call fcn.00404e5c
ret
Function at 0x52e29c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405328
xor eax, eax
push ebp
push 0x52e324
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403774
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00403774
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405338
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52e32b
lea eax, [ebp - 4]
call fcn.00404e5c
ret

Function at 0x52e620
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, dword [esi + 0x3a8]
call fcn.0040c5c8
test al, al
je 0x52e64e
push 0x80
mov eax, dword [esi + 0x3a8]
call fcn.00405338
push eax
call sub.kernel32.dll_SetFileAttributesA
mov edx, dword [esi + 0x3a8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, esi
call fcn.0052e5fc
test eax, eax
jbe 0x52e675
push 0
push 5
push 0x609
push eax
call sub.user32.dll_PostMessageA
pop edi
pop esi
pop ebp
ret
Function at 0x52e8d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x119]
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405328
xor eax, eax
push ebp
push 0x52eb23
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x130], 1
jne 0x52eb0d
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00526788
test al, al
je 0x52ea4d
xor edx, edx
push ebp
push 0x52e986
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
lea edi, [eax + 0x240]
lea esi, [ebp - 0x119]
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
cmp word [eax + 0x23a], 0
je 0x52e97c
lea eax, [ebp - 0x119]
push eax
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x23c]
call dword [ebx + 0x238]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52e9bf
xor edx, edx
push ebp
push 0x52ea0f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
xor edx, edx
call fcn.00496e64
imul edx, dword [ebp - 0x10], 0x3e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
call fcn.00496e74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
mov dl, 1
call fcn.00496e64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52eb0d
xor edx, edx
push ebp
push 0x52ead4
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
push ebp
push 0x52ea8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040c5c8
test al, al
je 0x52ea83
mov eax, dword [ebp - 8]
call fcn.00405338
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52ea97
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
xor edx, edx
call fcn.00496e64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
mov edx, 0x2710
call fcn.00496e74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
mov dl, 1
call fcn.00496e64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52eb0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52eb2a
lea eax, [ebp - 8]
call fcn.00404e5c
ret
Function at 0x52f4a0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
mov dl, 1
mov eax, dword [0x49dbb0]
call fcn.0049dcb0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x52f5d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0049dd50
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 1
xor ecx, ecx
mov edx, 0x52f5e8
mov eax, dword [ebp - 8]
call fcn.0049ddb8
test al, al
je 0x52f540
xor eax, eax
push ebp
push 0x52f539
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x52f620
mov eax, dword [ebp - 8]
call fcn.0049e4cc
test al, al
je 0x52f523
mov byte [ebp - 1], 1
call fcn.0040485c
call fcn.0040485c
jmp 0x52f5d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52f540
mov eax, dword [ebp - 8]
call fcn.0049dd20
ret
cmp byte [ebp - 1], 0
jne 0x52f5bc
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0049dd50
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 1
mov edx, 0x52f5e8
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.0049ddb8
test al, al
je 0x52f5bc
xor eax, eax
push ebp
push 0x52f5b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x52f620
mov eax, dword [ebp - 8]
call fcn.0049e4cc
test al, al
je 0x52f59f
mov byte [ebp - 1], 1
call fcn.0040485c
call fcn.0040485c
jmp 0x52f5d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52f5bc
mov eax, dword [ebp - 8]
call fcn.0049dd20
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52f5d9
mov eax, dword [ebp - 8]
call fcn.00403f0c
ret
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x52f62c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x52f829
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [0x5a03b0]
mov eax, dword [eax]
call fcn.004c76bc
mov dl, 1
mov eax, dword [0x49dbb0]
call fcn.0049dcb0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x52f804
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0049dd50
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0xf003f
mov byte [ebp - 9], 1
xor ecx, ecx
mov edx, 0x52f840
mov eax, dword [ebp - 8]
call fcn.0049ddb8
test al, al
je 0x52f718
xor eax, eax
push ebp
push 0x52f70e
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
mov edx, 0x52f878
mov eax, dword [ebp - 8]
call fcn.0049e2e4
mov eax, dword [ebp - 8]
call fcn.0049dd20
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0049dd50
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0xf003f
mov edx, 0x52f878
mov eax, dword [ebp - 8]
call fcn.0049e4cc
test al, al
je 0x52f700
mov edx, 0x52f878
mov eax, dword [ebp - 8]
call fcn.0049e054
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52f718
mov eax, dword [ebp - 8]
call fcn.0049dd20
cmp byte [ebp - 9], 0
je 0x52f7ee
mov bl, 1
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0049dd50
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 1
mov edx, 0x52f840
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.0049ddb8
test al, al
je 0x52f788
mov edx, 0x52f878
mov eax, dword [ebp - 8]
call fcn.0049e4cc
test al, al
je 0x52f788
lea ecx, [ebp - 0x10]
mov edx, 0x52f878
mov eax, dword [ebp - 8]
call fcn.0049e310
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040bab4
test eax, eax
jne 0x52f788
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.0049dd20
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0049dd50
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0xf003f
mov edx, 0x52f840
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.0049ddb8
test al, al
je 0x52f7ee
test bl, bl
je 0x52f7d0
mov edx, 0x52f878
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0049e2e4
jmp 0x52f7ee
mov edx, 0x52f878
mov eax, dword [ebp - 8]
call fcn.0049e4cc
test al, al
je 0x52f7ee
mov edx, 0x52f878
mov eax, dword [ebp - 8]
call fcn.0049e054
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52f80b
mov eax, dword [ebp - 8]
call fcn.00403f0c
ret
Function at 0x52fd90
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 6], 0
mov dl, 1
mov eax, dword [0x49dbb0]
call fcn.0049dcb0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x52ff2f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x52fe17
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.0049dd50
xor ecx, ecx
mov edx, 0x530098
mov eax, dword [ebp - 0x10]
call fcn.0049ddb8
test al, al
je 0x52fe0d
mov edx, 0x5300d0
mov eax, dword [ebp - 0x10]
call fcn.0049e4cc
test al, al
je 0x52fe0d
mov edx, 0x5300d0
mov eax, dword [ebp - 0x10]
call fcn.0049e054
mov byte [ebp - 6], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52fe21
mov eax, dword [ebp - 0x10]
call fcn.0049dd20
xor eax, eax
push ebp
push 0x52fe83
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.0049dd50
mov edx, 0x530098
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.0049ddb8
test al, al
je 0x52fe79
mov edx, 0x5300d0
mov eax, dword [ebp - 0x10]
call fcn.0049e4cc
test al, al
je 0x52fe79
mov edx, 0x5300d0
mov eax, dword [ebp - 0x10]
call fcn.0049e054
mov byte [ebp - 6], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52fe8d
mov eax, dword [ebp - 0x10]
call fcn.0049dd20
xor eax, eax
push ebp
push 0x52ff01
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15c]
cmp byte [eax + 0x50], 0
jne 0x52fef7
mov cl, 1
mov edx, 0x5300e4
mov eax, dword [ebp - 0x10]
call fcn.0049ddb8
test al, al
je 0x52fef3
mov edx, 0x5300d0
mov eax, dword [ebp - 0x10]
call fcn.0049e4cc
test al, al
je 0x52feed
mov edx, 0x5300d0
mov eax, dword [ebp - 0x10]
call fcn.0049e054
mov eax, dword [ebp - 0x10]
call fcn.0049dd20
jmp 0x52fef7
mov byte [ebp - 6], 0
jmp 0x52fef7
mov byte [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52ff0b
mov eax, dword [ebp - 0x10]
call fcn.0049dd20
mov al, byte [ebp - 6]
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52ff36
mov eax, dword [ebp - 0x10]
call fcn.00403f0c
ret
Function at 0x5305b8
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 1], cl
mov ebx, edx
xor eax, eax
push ebp
push 0x5307b2
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x530792
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 1], 0
jne 0x530604
test bl, bl
jne 0x530604
cmp byte [ebp + 0xc], 0
jne 0x530604
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53079c
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
xor edx, edx
push ebp
push 0x530781
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
call fcn.00402bf4
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x530763
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0x10], 0
jbe 0x53064b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x53074a
test bl, bl
je 0x53067d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
and eax, 0x100000
cmp eax, 0x100000
je 0x5306a9
cmp byte [ebp + 0xc], 0
je 0x530695
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
and eax, 0x200000
cmp eax, 0x200000
je 0x5306a9
cmp byte [ebp - 1], 0
je 0x5306f9
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
and eax, 1
cmp eax, 1
jne 0x5306f9
cmp byte [ebp + 8], 0
je 0x5306bd
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
jmp 0x5306f9
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
call fcn.00405054
mov edx, dword [ebp - 0x14]
mov eax, 0x5307cc
call fcn.0040547c
test eax, eax
jne 0x5306e9
mov edx, dword [ebp - 0x14]
mov eax, 0x5307dc
call fcn.0040547c
test eax, eax
jne 0x5306f9
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00402c24
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_FindNextUrlCacheEntryA
mov eax, dword [ebp - 0x10]
call fcn.00402bf4
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], 0
jbe 0x530731
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
jne 0x530667
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53076a
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00402c24
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5307b9
lea eax, [ebp - 0x14]
call fcn.00404e5c
ret
Function at 0x533718
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, edx
mov eax, ebx
call fcn.00404e5c
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.0052091c
mov eax, dword [ebx]
call fcn.00405138
test eax, eax
jle 0x533772
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
jne 0x533772
mov eax, dword [ebx]
call fcn.00405138
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.004053d8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5436b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov esi, dword [eax]
mov edi, dword [ecx]
mov eax, ebx
mov ecx, 3
xor edx, edx
div ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
lea ecx, [0x599cb4]
xor eax, eax
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 4], 0
je 0x543717
lodsw ax, word [esi]
mov bl, al
shr bl, 2
mov dl, byte [ebx + ecx]
mov bh, ah
and bh, 0xf
rol ax, 4
and ax, 0x3f
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
lodsb al, byte [esi]
mov bl, al
shr bx, 6
mov dl, byte [ebx + ecx]
and al, 0x3f
xor ah, ah
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
dec dword [ebp - 4]
jne 0x5436dd
cmp dword [ebp - 8], 0
je 0x543767
xor eax, eax
xor ebx, ebx
xor edx, edx
lodsb al, byte [esi]
shl ax, 6
mov bl, ah
mov dl, byte [ebx + ecx]
dec dword [ebp - 8]
je 0x543752
shl ax, 2
and ah, 3
lodsb al, byte [esi]
shl ax, 4
mov bl, ah
mov dh, byte [ebx + ecx]
shl edx, 0x10
shr al, 2
mov bl, al
mov dl, byte [ebx + ecx]
mov dh, 0x3d
jmp 0x543761
shr al, 2
mov bl, al
mov dh, byte [ebx + ecx]
shl edx, 0x10
mov dh, 0x3d
mov dl, 0x3d
mov eax, edx
ror eax, 0x10
stosd dword es:[edi], eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x544c70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x544c79
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00404e5c
cmp esi, 0xffffffff
je 0x544cca
push 0
push 0x10000
lea eax, [ebp - 0x10000]
push eax
push esi
call sub.ws2_32.dll_recv_1
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.004054c4
lea edx, [ebp - 0x10000]
mov eax, dword [ebx]
mov ecx, esi
call fcn.004085fc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8