joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50c22c
Capabilities:
Create process on windows

Disassembly:
push edi
push ebp
push ecx
mov eax, 0x154
call fcn.006021b0
mov ecx, dword [esp + 0x154]
mov ebp, ecx
mov edx, dword [esp + 0x168]
mov eax, dword [esp + 0x16c]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x50c264
xor eax, eax
add esp, 0x158
pop ebp
pop edi
ret 0xc
lea ecx, [esp]
xor edi, edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x1c], edi
mov dword [ecx + 0x20], edi
mov dword [ecx + 0x24], edi
mov dword [ecx + 0x28], edi
mov dword [ecx + 0x2c], edi
mov dword [ecx + 0x30], edi
mov dword [ecx + 0x34], edi
mov dword [ecx + 0x38], edi
mov dword [ecx + 0x3c], edi
mov dword [ecx + 0x40], edi
mov dword [esp], 0x44
mov dword [esp + 4], 0
mov dword [esp + 0x2c], 1
test eax, eax
je 0x50c2ba
mov dword [esp + 0xc], eax
cmp edx, 1
je 0x50c394
mov eax, 5
mov word [esp + 0x30], ax
lea edx, [esp + 0x44]
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea eax, [esp + 0x54]
push dword [esp + 0x164]
push dword [ebp]
push str.__s___s
push eax
call fcn.00602336
add esp, 0x10
xor ecx, ecx
lea edi, [esp + 0x54]
lea edx, [esp]
lea eax, [esp + 0x44]
push eax
push edx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x50c328
xor eax, eax
add esp, 0x158
pop ebp
pop edi
ret 0xc
push dword [ebp + 4]
push dword [esp + 0x48]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
lea eax, [esp + 0x154]
push eax
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x154]
cmp eax, 0x103
je 0x50c376
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x158
pop ebp
pop edi
ret 0xc
mov edx, dword [esp + 0x44]
mov dword [ebp + 0x10], edx
mov eax, dword [esp + 0x4c]
mov dword [ebp + 0x14], eax
mov eax, 1
add esp, 0x158
pop ebp
pop edi
ret 0xc
xor eax, eax
mov word [esp + 0x30], ax
jmp 0x50c2cd

Function at 0x50c3a0
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push ebp
mov edi, ecx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x50c417
xor ebp, ebp
push dword [edi + 0x14]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x50c411
mov eax, dword [edi + 0x18]
test eax, eax
je 0x50c3d8
xor edx, edx
push edx
push edx
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push dword [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x50c3ed
mov ebp, 1
jmp 0x50c3ff
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x50c3ff
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov eax, ebp
pop ebp
pop esi
pop edi
ret
xor eax, eax
pop ebp
pop esi
pop edi
ret
Function at 0x50c640
Capabilities:
Read file via mapping

Disassembly:
push edi
mov edi, ecx
xor eax, eax
push 0x100
push eax
push eax
push 6
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0x20], eax
test eax, eax
je 0x50c665
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x50dd78
Capabilities:
Connect to http server

Disassembly:
push ebx
mov ebx, ecx
movzx edx, word [esp + 0x14]
xor eax, eax
push eax
push eax
push 3
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edx
push dword [esp + 0x20]
push dword [ebx + 8]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebx + 0xc], eax
test eax, eax
je 0x50dda9
xor eax, eax
pop ebx
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx + 4]
mov dword [edx + 4], eax
mov eax, dword [ebx + 0x4a]
test eax, eax
je 0x50ddce
mov edx, dword [eax]
push str.Internet_Connect_nfailure_
push eax
call dword [edx + 0x48]
add esp, 8
pop ebx
ret 0x10
mov eax, 1
pop ebx
ret 0x10
Function at 0x52232c
Capabilities:
Enumerate pe sections

Disassembly:
push edi
push esi
push ebp
push ebx
push ecx
mov eax, 0x1c
call fcn.006021b0
mov ecx, dword [esp + 0x1c]
mov ebp, ecx
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x3c]
xor edx, edx
mov dl, byte [eax + 2]
mov dword [esp + 0x18], edx
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x20]
add esi, ebx
test edi, edi
je 0x522426
mov edx, dword [edi + 4]
test edx, edx
je 0x522426
mov edi, dword [esp + 0x34]
xor eax, eax
mov al, byte [edi + 6]
mov dword [esp + 0xc], eax
xor ecx, ecx
mov dword [esp + 0x14], edx
test edx, edx
je 0x5223e3
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp], esi
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [esp + 0xc]
mov ebp, dword [esp + 0x38]
cmp ebx, dword [edx + 0xc]
jle 0x5223cd
lea esi, [ebp + eax]
cmp esi, dword [edx + 0x14]
jge 0x5223cd
mov esi, dword [edx + 0x10]
test esi, esi
jl 0x5223cd
mov edi, dword [edx + 0x18]
test edi, edi
jl 0x5223cd
add ecx, esi
sub ecx, edi
mov edx, dword [edx + 4]
test edx, edx
jne 0x5223ad
mov edx, dword [esp + 0x1c]
mov esi, dword [esp]
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
sub esi, ecx
xor eax, eax
test edx, edx
je 0x522424
mov dword [esp], esi
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov ecx, dword [esp + 0xc]
mov ebx, dword [esp + 0x38]
cmp ebx, dword [edx + 0xc]
jl 0x522412
lea ebp, [ebx + ecx]
cmp ebp, dword [edx + 0x14]
jge 0x522412
mov ebp, dword [edx + 0x10]
test ebp, ebp
jle 0x52248f
mov edx, dword [edx + 4]
test edx, edx
jne 0x5223fe
mov esi, dword [esp]
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
add ebx, eax
cmp esi, ebx
jle 0x522485
mov ecx, dword [esp + 0x34]
xor eax, eax
mov al, byte [ecx + 6]
mov dword [esp + 0xc], eax
push dword [ebp + 0x10]
call fcn.00523f14
mov dword [esp + 0x14], eax
xor eax, eax
mov edx, dword [esp + 0x18]
test dl, 2
setne al
mov dword [esp + 0x1c], eax
xor edx, edx
mov eax, dword [esp + 0x18]
test al, 8
setne dl
mov dword [esp + 0x18], edx
mov edi, dword [esp + 0x14]
push edi
mov eax, dword [esp + 0x10]
push eax
push 1
mov eax, edx
push eax
mov eax, dword [esp + 0x2c]
push eax
push ebx
mov ebx, dword [esp + 0x50]
push ebx
push esi
push ebx
mov ecx, ebp
call fcn.0057a02c
add esp, 0x20
pop ebx
pop ebp
pop esi
pop edi
ret 0xc
mov esi, dword [edx + 0x18]
test esi, esi
jg 0x522412
add eax, esi
sub eax, ebp
jmp 0x522412
Function at 0x54104c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push edi
push esi
push ebp
push ebx
push ecx
mov eax, 0x1c
call fcn.006021b0
mov ecx, dword [esp + 0x1c]
mov ebx, ecx
xor edi, edi
xor ebp, ebp
mov ecx, ebx
call fcn.005411fc
mov esi, eax
cmp esi, 1
je 0x5411e4
mov edx, dword [esp + 0x34]
mov dword [edx], 0xffffffff
lea eax, [esp]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov edx, 2
mov word [esp], dx
cmp esi, 1
je 0x5410a4
movzx ebp, word [esp + 0x3c]
push ebp
call sub.WSOCK32.dll_htons
mov word [esp + 2], ax
lea ecx, [esp + 0x10]
call fcn.004e2900
cmp esi, 1
je 0x5411d5
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x38]
push edx
call fcn.004e292c
lea ecx, [esp + 0x10]
call fcn.004e2a14
push eax
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x541102
lea ecx, [esp + 0x10]
call fcn.004e2a14
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x5411bd
mov edx, dword [eax + 0xc]
mov ebp, dword [edx]
mov eax, dword [ebp]
mov dword [esp + 4], eax
test esi, esi
je 0x54116c
mov ecx, ebx
call fcn.005415bc
test eax, eax
jne 0x541119
xor ebp, ebp
jmp 0x541122
mov ecx, ebx
call fcn.00541508
mov ebp, eax
mov ecx, ebx
call fcn.005415bc
test eax, eax
jne 0x541131
xor eax, eax
jmp 0x541138
mov ecx, ebx
call fcn.00541630
lea edx, [esp]
push eax
push ebp
movzx eax, word [esp + 0x44]
push eax
mov ebp, dword [esp + 0x44]
push ebp
push edx
mov esi, dword [esp + 0x48]
push esi
mov ecx, ebx
call fcn.005416e4
mov ebx, eax
lea ecx, [esp + 0x10]
call fcn.004e2a1c
mov eax, ebx
add esp, 0x20
pop ebx
pop ebp
pop esi
pop edi
ret 0xc
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
lea edx, [esp]
push 0x10
push edx
push ebx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
je 0x5411a5
mov edx, dword [esp + 0x34]
mov dword [edx], ebx
lea ecx, [esp + 0x10]
call fcn.004e2a1c
xor eax, eax
add esp, 0x20
pop ebx
pop ebp
pop esi
pop edi
ret 0xc
lea ecx, [esp + 0x10]
call fcn.004e2a1c
mov eax, 1
add esp, 0x20
pop ebx
pop ebp
pop esi
pop edi
ret 0xc
lea ecx, [esp + 0x10]
call fcn.004e2a1c
mov eax, 1
add esp, 0x20
pop ebx
pop ebp
pop esi
pop edi
ret 0xc
lea ecx, [esp + 0x10]
push edi
call fcn.004e292c
jmp 0x5410cf
mov ecx, ebx
call fcn.00541270
mov edi, eax
mov ecx, ebx
call fcn.005414c8
mov ebp, eax
jmp 0x541077
Function at 0x5413c0
Capabilities:
Parse url

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 8
mov esi, ecx
mov ebx, dword [esp + 0x1c]
mov dword [esi], 0x636548
mov dword [esp], 1
lea ebp, [esi + 4]
xor eax, eax
mov dword [ebp], eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], eax
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], eax
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x38], eax
mov dword [esi + 4], 0x3c
xor edx, edx
mov dword [esi + 8], edx
mov dword [esi + 0x14], edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x28], edx
mov dword [esi + 0x30], edx
mov dword [esi + 0x38], edx
mov eax, 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], eax
lea eax, [esp + 4]
lea edi, [esp]
push edx
push edi
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov dword [esi + 0x44], 1
mov ecx, dword [esp]
inc ecx
call fcn.004dbf60
mov dword [esi + 0x40], eax
lea edx, [esp]
push 0
push edx
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov edx, dword [esp]
mov eax, dword [esi + 0x40]
xor ebx, ebx
mov byte [eax + edx], bl
mov edi, dword [esi + 0x40]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x541490
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x541488
push ebp
push ebx
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x5414b1
mov dword [esi + 0x44], 0
mov eax, esi
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret 4
mov ebx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov byte [edx + ebx], 0
mov eax, esi
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret 4
Function at 0x543a18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
push ebp
push ebx
push ecx
mov eax, 0x1114
call fcn.006021b0
mov ecx, dword [esp + 0x1114]
mov esi, dword [esp + 0x112c]
mov edi, dword [esp + 0x1130]
mov ebx, dword [esp + 0x1134]
lea ebp, [esp + 4]
mov edx, 0x753a54
mov eax, dword [edx]
mov dword [ebp], eax
mov eax, dword [edx + 4]
mov dword [ebp + 4], eax
mov eax, dword [edx + 8]
mov dword [ebp + 8], eax
mov eax, dword [edx + 0xc]
mov dword [ebp + 0xc], eax
xor eax, eax
mov al, byte [edx + 0x10]
mov byte [ebp + 0x10], al
test esi, esi
je 0x543a7c
cmp edi, ebx
jl 0x543a7c
mov eax, ebx
and eax, 7
test eax, eax
je 0x543a8b
xor eax, eax
add esp, 0x1118
pop ebx
pop ebp
pop esi
pop edi
ret 0xc
lea ecx, [ebx + 1]
mov dword [esp], ecx
call fcn.004dbf60
mov ebp, eax
mov edi, ebp
xor eax, eax
mov ecx, dword [esp]
push ecx
shr ecx, 2
rep stosd dword es:[edi], eax
pop ecx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, ebp
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 4], 0x54
mov byte [esp + 5], 0x20
mov byte [esp + 6], 0x87
mov byte [esp + 7], 0x84
mov byte [esp + 8], 0x22
mov byte [esp + 9], 0x36
mov byte [esp + 0xa], 2
mov byte [esp + 0xb], 0x99
mov byte [esp + 0xc], 0x55
mov byte [esp + 0xd], 6
mov byte [esp + 0xe], 9
mov byte [esp + 0xf], 0x23
mov byte [esp + 0x10], 0x53
mov byte [esp + 0x11], 0x12
mov byte [esp + 0x12], 0x51
mov byte [esp + 0x13], 0x66
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x18]
lea edx, [esp + 4]
push 0x10
call fcn.0059172c
lea ecx, [esp + 0x18]
push ebx
push ebp
xor edx, edx
call fcn.00592348
cmp eax, 0xffffffff
je 0x543b51
lea ecx, [esp + 4]
xor edx, edx
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], edx
mov eax, ebp
add esp, 0x1118
pop ebx
pop ebp
pop esi
pop edi
ret 0xc
lea ecx, [esp + 4]
xor edx, edx
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], edx
mov ecx, ebp
call fcn.004dbc10
xor eax, eax
add esp, 0x1118
pop ebx
pop ebp
pop esi
pop edi
ret 0xc

Function at 0x543b78
Capabilities:
Generate random numbers via winapi

Disassembly:
push edi
push esi
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
push eax
call fcn.00602169
mov edi, eax
add esp, 4
call fcn.00602146
mov ecx, eax
mov eax, edi
cdq
mov esi, edx
add edi, 0
adc esi, ecx
mov dword [esp], edi
mov dword [esp + 4], esi
xor ecx, ecx
mov dword [esp + 8], ecx
lea eax, [esp + 8]
push 0xf0000000
push 1
push ecx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x543bee
lea ecx, [esp]
push ecx
push 8
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x543be2
mov dword [esp], edi
mov dword [esp + 4], esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop esi
pop edi
ret
Function at 0x54682c
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov esi, ecx
mov edi, edx
mov ecx, 0x80
shr ecx, 3
mov eax, 0
mov ebx, 0
xor dword [esi], eax
xor dword [esi + 4], ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
call fcn.00592f98
mov dword [esi], eax
mov dword [esi + 4], ebx
add esi, 8
loop 0x546845
pop ebx
pop edi
pop esi
ret
Function at 0x547574
Capabilities:
Inspect section memory permissions

Disassembly:
sub eax, eax
sub ebx, ebx
bt ecx, 0xa
jae 0x547583
or eax, 0x80
bt ecx, 0x17
jae 0x54758c
or eax, 0x40
bt ecx, 0xd
jae 0x547595
or eax, 0x20
bt ecx, 0x10
jae 0x54759e
or eax, 0x10
bt ecx, 7
jae 0x5475a7
or eax, 8
bt ecx, 3
jae 0x5475b0
or eax, 4
bt ecx, 5
jae 0x5475b9
or eax, 2
bt ecx, 0x1c
jae 0x5475c2
or eax, 1
bt ecx, 9
jae 0x5475cd
or eax, 0x8000
bt ecx, 2
jae 0x5475d8
or eax, 0x4000
bt ecx, 0x13
jae 0x5475e3
or eax, 0x2000
bt ecx, 0xe
jae 0x5475ee
or eax, 0x1000
bt ecx, 0x11
jae 0x5475f9
or eax, 0x800
bt ecx, 0x15
jae 0x547604
or eax, 0x400
bt ecx, 0xc
jae 0x54760f
or eax, 0x200
bt ecx, 4
jae 0x54761a
or eax, 0x100
bt ecx, 0x1e
jae 0x547625
or eax, 0x800000
bt ecx, 0
jae 0x547630
or eax, 0x400000
bt ecx, 8
jae 0x54763b
or eax, 0x200000
bt ecx, 1
jae 0x547646
or eax, 0x100000
bt ecx, 0x1d
jae 0x547651
or eax, 0x80000
bt ecx, 0x14
jae 0x54765c
or eax, 0x40000
bt ecx, 0xb
jae 0x547667
or eax, 0x20000
bt ecx, 6
jae 0x547672
or eax, 0x10000
bt edx, 0xf
jae 0x54767d
or eax, 0x80000000
bt edx, 0x14
jae 0x547688
or eax, 0x40000000
bt edx, 0x19
jae 0x547693
or eax, 0x20000000
bt edx, 3
jae 0x54769e
or eax, 0x10000000
bt edx, 9
jae 0x5476a9
or eax, 0x8000000
bt edx, 0x11
jae 0x5476b4
or eax, 0x4000000
bt edx, 0x1a
jae 0x5476bf
or eax, 0x2000000
bt edx, 0
jae 0x5476ca
or eax, 0x1000000
bt edx, 0x15
jae 0x5476d6
or ebx, 0x80
bt edx, 0xb
jae 0x5476df
or ebx, 0x40
bt edx, 7
jae 0x5476e8
or ebx, 0x20
bt edx, 8
jae 0x5476f1
or ebx, 0x10
bt edx, 0xc
jae 0x5476fa
or ebx, 8
bt edx, 0x17
jae 0x547703
or ebx, 4
bt edx, 1
jae 0x54770c
or ebx, 2
bt edx, 0x10
jae 0x547715
or ebx, 1
bt edx, 6
jae 0x547721
or ebx, 0x8000
bt edx, 0x13
jae 0x54772d
or ebx, 0x4000
bt edx, 0xa
jae 0x547739
or ebx, 0x2000
bt edx, 0xe
jae 0x547745
or ebx, 0x1000
bt edx, 0x16
jae 0x547751
or ebx, 0x800
bt edx, 4
jae 0x54775d
or ebx, 0x400
bt edx, 0x1b
jae 0x547769
or ebx, 0x200
bt edx, 0x18
jae 0x547775
or ebx, 0x100
ret
Function at 0x566354
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
push esi
push ebp
push ebx
mov esi, dword [ecx + 0x31]
mov edi, esi
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x56636f
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x566367
inc eax
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x5663dd
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
mov edi, esi
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x56639c
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x566394
mov edi, ebp
mov ecx, eax
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x5663c8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x5663dd
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
pop ebx
pop ebp
pop esi
pop edi
ret

Function at 0x5663e4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
push ebp
push ebx
push esi
mov ebp, ecx
xor eax, eax
mov dword [esp], eax
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x5663fe
xor ebx, ebx
jmp 0x56645a
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x566494
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x56642b
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x566423
test eax, eax
jne 0x566440
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor ebx, ebx
jmp 0x56645a
lea ecx, [esp]
mov edx, edi
call fcn.004ee018
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ebx, dword [esp]
test ebx, ebx
je 0x566472
push ebx
mov ecx, ebp
call fcn.005664a0
cmp eax, 0xffffffff
je 0x566483
mov ecx, ebx
call fcn.004dbc10
push 0x8002f
mov ecx, ebp
call fcn.00566030
pop ecx
pop ebx
pop ebp
pop edi
ret
mov ecx, ebx
call fcn.004dbc10
mov eax, 0xffffffff
pop ecx
pop ebx
pop ebp
pop edi
ret
call dword [sym.imp.USER32.dll_CloseClipboard]
xor ebx, ebx
jmp 0x56645a
Function at 0x5677e8
Capabilities:
Parse url

Disassembly:
push edi
push esi
push ebp
push ebx
push ecx
mov eax, 0x40
call fcn.006021b0
mov ecx, dword [esp + 0x40]
mov esi, ecx
mov ebp, dword [esp + 0x58]
mov dword [esp], 1
lea edx, [esp + 4]
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [edx + 0x38], eax
mov dword [esp + 4], 0x3c
mov eax, 1
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
lea ebx, [esp + 0x40]
lea edx, [esp]
push 0
push edx
push ebx
push ebp
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov ecx, dword [esp]
cmp ecx, 1
ja 0x56788f
add esi, 0x14
mov ecx, esi
mov edx, ebp
call fcn.004ee018
add esp, 0x44
pop ebx
pop ebp
pop esi
pop edi
ret 4
inc ecx
call fcn.004dbf60
mov dword [esi + 0x14], eax
lea ebx, [esp]
push 0
push ebx
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov edi, dword [esp]
mov eax, dword [esi + 0x14]
xor ebx, ebx
mov byte [eax + edi], bl
mov edi, dword [esi + 0x14]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x5678c6
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x5678be
mov edx, eax
lea eax, [esp + 4]
push eax
push ebx
push edx
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x56796b
mov eax, dword [esp + 0xc]
test eax, eax
je 0x5678f3
lea ecx, [esi + 0x18]
push eax
mov edx, dword [esp + 0xc]
call fcn.004ececc
mov eax, dword [esp + 0x18]
test eax, eax
je 0x567908
lea ecx, [esi + 0x1c]
push eax
mov edx, dword [esp + 0x18]
call fcn.004ececc
movzx eax, word [esp + 0x1c]
test eax, eax
jne 0x56791c
mov eax, 0x15
mov word [esi + 0x20], ax
jmp 0x567920
mov word [esi + 0x20], ax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x567935
lea ecx, [esi + 0x22]
push eax
mov edx, dword [esp + 0x24]
call fcn.004ececc
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x56794a
lea ecx, [esi + 0x26]
push eax
mov edx, dword [esp + 0x2c]
call fcn.004ececc
mov eax, dword [esp + 0x34]
test eax, eax
je 0x567986
add esi, 0x2a
push eax
mov ecx, esi
mov edx, dword [esp + 0x34]
call fcn.004ececc
add esp, 0x44
pop ebx
pop ebp
pop esi
pop edi
ret 4
mov ecx, dword [esi + 0x14]
call fcn.004dbc10
mov dword [esi + 0x14], 0
add esi, 0x14
mov ecx, esi
mov edx, ebp
call fcn.004ee018
add esp, 0x44
pop ebx
pop ebp
pop esi
pop edi
ret 4
Function at 0x567a6c
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x567b31
push 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x567a8f
mov eax, 1
pop ebx
ret 8
xor eax, eax
push eax
push eax
push eax
push eax
push 0x74e434
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, eax
mov dword [ebx + 0x10], ecx
test ecx, ecx
je 0x567b7c
movzx eax, word [ebx + 0x20]
xor edx, edx
push edx
push edx
push 1
push dword [ebx + 0x26]
push dword [ebx + 0x22]
push eax
push dword [ebx + 0x1c]
push ecx
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebx + 0xc], eax
test eax, eax
je 0x567b3a
push 0
push 2
push dword [esp + 0x10]
push dword [ebx + 0x2a]
push eax
call dword [sym.imp.WININET.dll_FtpOpenFileA]
mov dword [ebx + 8], eax
test eax, eax
je 0x567aee
xor eax, eax
pop ebx
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx + 4]
mov dword [edx + 4], eax
push dword [ebx + 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebx + 0x10]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov edx, dword [esp + 0xc]
test edx, edx
jne 0x567b31
push dword [ebx + 0x14]
push 0x751d9c
push 0
push dword [ebx + 4]
call fcn.00570f5c
add esp, 0x10
mov eax, 1
pop ebx
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx + 4]
mov dword [edx + 4], eax
push dword [ebx + 0x10]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebx + 0x10], 0
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x567b73
push dword [ebx + 0x14]
push 0x751d78
push 0
push dword [ebx + 4]
call fcn.00570f5c
add esp, 0x10
mov eax, 1
pop ebx
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx + 4]
mov dword [edx + 4], eax
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x567ba5
push dword [ebx + 0x14]
push 0x751d50
push 0
push dword [ebx + 4]
call fcn.00570f5c
add esp, 0x10
mov eax, 1
pop ebx
ret 8