joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57b7cb
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5fe0c8
push eax
mov al, byte [0x1a6b978]
mov dword fs:[0], esp
sub esp, 0x14
test al, 1
push ebp
push esi
push edi
mov esi, ecx
jne 0x57b65e
mov dl, al
push 0x57b890
or dl, 1
mov byte [0x1a6b978], dl
call fcn.004af3ba
add esp, 4
mov al, byte [0x1a6b978]
test al, 2
jne 0x57b67f
mov dl, al
push 0x57b880
or dl, 2
mov byte [0x1a6b978], dl
call fcn.004af3ba
add esp, 4
mov eax, dword [0x1a0de58]
mov dword [esp + 0xc], eax
mov ecx, dword [0x1a6b968]
mov eax, dword [0x1a6b970]
test ecx, ecx
mov dword [esp + 0x28], 0
jne 0x57b719
test eax, eax
jne 0x57b719
mov edx, dword [0x1a6b96c]
test edx, edx
jne 0x57b719
mov edx, dword [0x1a6b974]
test edx, edx
jne 0x57b719
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, esi
call fcn.005c9e4c
mov edx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_GetWindowRect]
push 0x1a6b968
push edx
mov edi, eax
call ebp
mov ecx, dword [edi + 0x1c]
lea eax, [esp + 0x10]
push eax
push ecx
call ebp
mov edx, dword [0x1a6b96c]
mov ecx, dword [0x1a6b968]
mov eax, dword [0x1a6b970]
mov dword [0x1a6b95c], edx
mov edx, dword [0x1a6b974]
mov dword [0x1a6b958], ecx
mov dword [0x1a6b964], edx
mov edx, dword [esp + 0x14]
mov dword [0x1a6b960], eax
mov dword [0x1a6b964], edx
mov edx, dword [esp + 0x34]
push 6
test edx, edx
je 0x57b7ab
mov edx, dword [0x1a6b974]
mov ebp, dword [0x1a6b96c]
sub edx, ebp
sub eax, ecx
push edx
push eax
push 0
push 0
push 0x1a6ad60
mov ecx, esi
call fcn.005ca12d
push 0xa240
lea ecx, [esp + 0x10]
call fcn.005cba8c
lea eax, [esp + 0xc]
lea ecx, [esp + 0x34]
push eax
push 0x1a14fe8
push ecx
call fcn.005c529d
push 0x1a14fe4
lea edx, [esp + 0x34]
push eax
push edx
mov byte [esp + 0x34], 1
call fcn.005c5229
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.005c50cd
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 1
call fcn.005c4f94
mov byte [esp + 0x28], 0
lea ecx, [esp + 0x34]
jmp 0x57b834
mov eax, dword [0x1a6b964]
mov edi, dword [0x1a6b95c]
mov ecx, dword [0x1a6b958]
sub eax, edi
push eax
mov eax, dword [0x1a6b960]
sub eax, ecx
mov ecx, esi
push eax
push 0
push 0
push 0x1a6ad60
call fcn.005ca12d
push 0xa240
lea ecx, [esp + 0x10]
call fcn.005cba8c
lea eax, [esp + 0xc]
lea ecx, [esp + 0x34]
push eax
push 0x1a14fe8
push ecx
call fcn.005c529d
push 0x1a14fe0
lea edx, [esp + 0x34]
push eax
push edx
mov byte [esp + 0x34], 3
call fcn.005c5229
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 4
call fcn.005c50cd
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 3
call fcn.005c4f94
mov byte [esp + 0x28], 0
lea ecx, [esp + 0x34]
call fcn.005c4f94
mov ecx, esi
call fcn.005a84c0
mov eax, dword [esp + 0xc]
mov ecx, esi
push eax
push 3
call fcn.005c9f0b
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005c4f94
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x582a50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fe7f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x2c]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
mov dword [esi], 0x19ba274
mov dword [0x1a6b980], ebx
call fcn.005cd009
mov eax, dword [edi + 0x1a4]
push ebx
mov dword [esi + 4], eax
mov edi, dword [edi + 0x1a0]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov dword [esp + 0x30], 0
mov dword [esi + 8], edi
call fcn.00582b90
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005cd07b
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8

Function at 0x583350
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5fe8d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x14]
push edi
mov eax, dword [esi]
lea edx, [esp + 0x14]
xor ebx, ebx
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x20], ebx
call dword [eax + 0x14c]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov dword [esp + 0x34], ebx
call fcn.005c4d09
mov eax, dword [esp + 0x10]
mov byte [esp + 0x30], 1
cmp byte [eax], 0x40
jne 0x5833de
mov eax, dword [eax - 8]
lea ecx, [esp + 0x1c]
dec eax
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.005c0db7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 2
call fcn.005c50cd
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.005c4f94
mov eax, dword [esp + 0x10]
mov al, byte [eax]
cmp al, 0x20
jle 0x5833e8
mov byte [esp + 0x3c], al
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x130]
mov ebp, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x134]
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x24], eax
call dword [edx + 0x164]
test eax, eax
mov eax, dword [esi]
mov ecx, esi
setne byte [esp + 0x3c]
call dword [eax + 0x148]
mov edx, dword [esp + 0x38]
mov cl, byte [esp + 0x3c]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov byte [edx + 0x14], cl
or ecx, 0xffffffff
xor eax, eax
mov dword [edx + 8], ebx
mov dword [edx + 0xc], ebx
mov byte [edx + 0x15], bl
mov byte [edx + 0x16], bl
mov byte [edx + 0x17], 1
mov byte [edx + 0x18], bl
mov byte [edx + 0x19], bl
mov byte [edx + 0x1a], bl
mov byte [edx + 0x1b], bl
repne scasb al, byte es:[edi]
not ecx
lea esi, [edx + 0x1c]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x3c], esi
mov esi, edi
mov edi, dword [esp + 0x3c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x24]
and ecx, 3
mov byte [esp + 0x30], bl
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov dword [edx], ebp
mov dword [edx + 4], ecx
lea ecx, [esp + 0x10]
mov dword [edx + 0x10], eax
call fcn.005c4f94
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.005c4f94
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x5834c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x583522
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret

Function at 0x583530
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
push esi
push edi
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x58360d
lea ecx, [esp + 8]
push ecx
push str..htm
push accept
call fcn.005834c0
add esp, 0xc
test eax, eax
jne 0x58360d
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 8]
push str._shellopencommand
push edx
call edi
lea eax, [esp + 8]
lea ecx, [esp + 8]
push eax
push ecx
push accept
call fcn.005834c0
add esp, 0xc
test eax, eax
jne 0x58360d
lea edx, [esp + 8]
push str.__1_
push edx
call fcn.004af8c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x5835e8
lea eax, [esp + 8]
push 0x1a12594
push eax
call fcn.004af840
mov esi, eax
add esp, 8
test esi, esi
jne 0x5835e8
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 7]
jmp 0x5835eb
mov byte [esi], 0
push 0x1a11e7c
push esi
call edi
mov edx, dword [esp + 0x214]
push edx
push esi
call edi
lea eax, [esp + 8]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
lea ecx, [esp + 0x214]
call fcn.005c4f94
mov eax, esi
pop edi
pop esi
add esp, 0x208
ret
Function at 0x58a110
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ff1ba
push eax
mov dword fs:[0], esp
mov eax, 0x1a6cc78
sub esp, 0x40
test eax, eax
je 0x58a13a
mov eax, dword [0x1a6cc7c]
test eax, eax
jne 0x58a1a5
lea ecx, [esp + 4]
push esi
push ecx
push 0x3c
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea edx, [esp + 8]
push edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
mov ecx, 0x1a6cc78
call fcn.005cd2b1
push 8
call fcn.005c4cd5
mov esi, eax
add esp, 4
mov dword [esp + 4], esi
test esi, esi
mov dword [esp + 0x4c], 0
je 0x58a195
push 0x18
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
mov ecx, esi
call fcn.005cd36e
jmp 0x58a197
xor eax, eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [0x1a6cc90], eax
pop esi
call fcn.0058a070
mov eax, dword [0x1a6cc94]
test eax, eax
jne 0x58a1ce
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x58a1e0
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x1a6cc94], eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x5935f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
lea eax, [esp]
push esi
push eax
push 1
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
mov esi, 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x593663
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.WheelScrollLines
push ecx
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x593658
push 0xa
lea edx, [esp + 0x14]
push eax
push edx
call fcn.004b2b16
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x8c
ret
Function at 0x59e020
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6006ac
push eax
mov dword fs:[0], esp
sub esp, 0x414
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push ebp
push esi
mov ebp, ecx
push edi
push 0
push 0
mov eax, dword [ebp + 0xb4]
push 0x184
push eax
call ebx
mov ecx, dword [ebp + 0x78]
push 0
push 0
push 0x188
push ecx
call ebx
test eax, eax
jl 0x59e1be
mov edx, dword [0x1a0de58]
mov dword [esp + 0x10], edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x42c], 0
push ecx
push eax
lea ecx, [ebp + 0x5c]
call fcn.005d52b3
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
test eax, eax
je 0x59e1aa
push str.MenuData.ini
lea eax, [esp + 0x18]
push 0x1a6b600
push eax
call fcn.005c5229
mov eax, dword [eax]
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push 0x400
push ecx
push 0x19a9e10
push edx
push str.MenuData
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x14]
call fcn.005c4f94
lea eax, [esp + 0x24]
lea ecx, [esp + 0x18]
push eax
call fcn.005c5002
mov ecx, dword [0x1a0de58]
mov dword [esp + 0x1c], ecx
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x434], 2
call fcn.005c4d09
call fcn.00543cd0
mov edi, eax
mov esi, 1
add esp, 4
cmp edi, esi
jle 0x59e188
push esi
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.005c4d09
lea ecx, [esp + 0x1c]
push ecx
call fcn.005433a0
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x430], 3
call fcn.005c50cd
lea ecx, [esp + 0x14]
mov byte [esp + 0x42c], 2
call fcn.005c4f94
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x59e188
mov edx, dword [ebp + 0xb4]
push eax
push 0
push 0x180
push edx
call ebx
inc esi
cmp esi, edi
jl 0x59e125
lea ecx, [esp + 0x1c]
mov byte [esp + 0x42c], 1
call fcn.005c4f94
lea ecx, [esp + 0x18]
mov byte [esp + 0x42c], 0
call fcn.005c4f94
lea ecx, [esp + 0x10]
mov dword [esp + 0x42c], 0xffffffff
call fcn.005c4f94
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x420
ret
Function at 0x5a5120
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x600fd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 0xc]
mov dword [esp + 0x24], 0
mov ecx, edi
call fcn.004e2090
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esi + 4], eax
lea edx, [esp + 0x34]
lea eax, [esp + 0xc]
mov dword [esi + 8], ecx
push edx
push eax
mov ecx, edi
mov dword [esi], 0x19bcec0
call fcn.004e20b0
mov ecx, dword [esp + 0x40]
mov eax, esi
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x18
Function at 0x5ab030
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6018c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], ebx
call fcn.005c56c1
mov eax, dword [esp + 0x30]
push ebx
push ebx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 1
call fcn.005c5873
test eax, eax
jne 0x5ab09e
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.005c57b6
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.005c4f94
mov eax, 0x65
jmp 0x5ab14e
lea ecx, [esp + 0x10]
call fcn.005c5b6d
mov edi, eax
cmp edi, ebx
jne 0x5ab0d2
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.005c57b6
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.005c4f94
mov eax, 0x66
jmp 0x5ab14e
push edi
call fcn.005c4cd5
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x5ab106
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.005c57b6
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.005c4f94
mov eax, 0x64
jmp 0x5ab14e
push edi
push esi
lea ecx, [esp + 0x18]
call fcn.005c5990
lea ecx, [esp + 0x10]
call fcn.005c5a8e
push edi
push esi
mov ecx, ebp
call fcn.005aae20
push esi
mov edi, eax
call fcn.005c4cfe
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.005c57b6
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.005c4f94
mov eax, edi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x5c63de
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x5c6400
cmp dword [edi + 0x3c], 0
jne 0x5c6400
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.005db896
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.005c642d
pop edi
pop esi
pop ebx
ret 8

Function at 0x5c647b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.005db896
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5c64ac
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.005c64bf
pop edi
pop esi
pop ebx
ret 8

Function at 0x5c7ad5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5c7b0d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005c543b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005c5413
jmp 0x5c7b19
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5c9671
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5c96b3
call fcn.005db896
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5c96b3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5c96aa
xor eax, eax
jmp 0x5c96bb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005c96c1
pop edi
pop esi
pop ebx
ret 4

Function at 0x5da052
Capabilities:
Create http request

Disassembly:
mov eax, 0x602994
call fcn.004b1598
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x5da08a
call fcn.005db896
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x5da0af
push eax
push dword [esi + 4]
call fcn.005daee1
jmp 0x5da0bb
push esi
push eax
mov ecx, 0x1a6ce10
call fcn.005da0cc
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x5da3c8
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x602a07
call fcn.004b1598
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.005cc016
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x1a0de58]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.005c511d
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.005c511d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x5dbdc5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5dbdf3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5dbe11
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005dbd2b
jmp 0x5dbe11
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5dbe11
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005dbd2b
test edi, edi
mov eax, edi
jne 0x5dbdfb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x409735
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
popal
jp 0x40976d
sahf
mov dword [0xf5ede19b], eax
insb byte es:[edi], dx
jge 0x4097c1
mov al, byte [ebp - 0x74]
fnstenv [edi + 0xb14e1bb]
shrd dword [ebx], edx, cl
aaa
sub eax, 0x4c533604
push esp
mov ecx, 0x9df6adb3
xchg ebp, eax
test byte [edx + eax*8 - 0x33], bh
and eax, 0xba608545
test byte [edx - 0x4f], bh
cmp eax, 0xed150c0
lodsb al, byte [esi]
or eax, 0xee9faee4
in al, 0xa
mov bh, ch
sub al, 0xfc
invalid
dec eax
outsb dx, byte [esi]
dec ebp
out 0x79, eax
mov edi, 0x2b8be766
pop ds
mov bh, 0x67
and eax, 0xada97d29
mov bh, 0x31
stosd dword es:[edi], eax
inc ecx
xor ch, byte [eax]
pop ebx
je 0x40981a
cmp al, 0x1c
daa
sbb al, 0x27
je 0x409860
cmc
salc
or al, 5
invalid
mov dl, 0xc0
cmp eax, 0x1a94322d
xor al, 0x41
push esp
sbb bh, dl
xor byte [edx], bh
in eax, 0xf5
sub byte [ebx + 0xf], bh
out 0xca, eax
inc esp
cmp eax, 0xd55820c2
cmp eax, 0x78c7751e
hlt
push ds
jne 0x4097dd
js 0x40980c
xor al, 0xef
adc al, 0x55
inc eax
iretd
jb 0x4097f7
or eax, 0xa346b5e4
pushfd
aad 0xba
int 0xa4
xor dword [ecx + 0x39957722], esi
push 0xa2f3baf1
xor dword [edx], ecx
cmp dword [eax - 0xf], ebp
mov edx, 0xa31a2f3
inc ecx
loop 0x409813
jno 0x409821
xchg edi, eax
pop ebx
inc edx
dec ebx
xchg ebx, eax
dec esi
inc edi
int3
loop 0x4098b2
loope 0x4098ad
movsd dword es:[edi], dword [esi]
pop esi
adc ebx, dword [edx + 0x788d4b92]
invalid
jnp 0x409833
jmp 0x409911
push esp
nop
push ebp
push eax
sbb esp, edx
push esp
popfd
inc edi
and al, 0xba
xor al, 4
sal byte [ecx], 0xd4
sub dword [edi + ebp], ebx
arpl word [ecx], di
sub dword [edx + ebx*8 + 0x3237a869], ebp
popfd
ret 0x49a
sahf
sbb dword [eax], edi
ja 0x40995f
jle 0x40993c
invalid
ja 0x4098c6
cmp al, bl
imul edi, ebx, 0x47
adc dword [esi], 0x9b94418a
wait
mov ch, 0xf
movsd dword es:[edi], dword [esi]
xchg byte [eax + 0x576b8430], bl
shld dword [esi + 0x6b843098], eax, cl
push edi
dec esi
aam 0xed
jne 0x409949
fnstenv [esi]
add eax, 0x75ac3b7d
test eax, 0x571cdd84
cwde
jg 0x40994b
invalid
Function at 0x4207b5
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xa8
xchg esi, eax
insb byte es:[edi], dx
mov dword [0x76e4a1a4], eax
or cl, byte [ebx + ebx*4]
xlatb
retf
mov eax, 0x4f3c0e77
imul eax, dword [esi], 0x144ee938
rcr eax, 1
push ds
sahf
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
out 0x8f, eax
dec ebx
and al, ch
mov dword [0x52fc531a], eax
sbb dl, byte [ebx - 4]
push edx
dec ebx
xchg dl, bh
jbe 0x42079f
cmp al, 0x2a
test byte [esi], 0x86
dec ebp
stc
sub dh, dh
push cs
xchg byte [ebp - 7], cl
dec ebx
push ebx
inc eax
std
sbb eax, 0x9e686f39
out 0xbd, al
xor ecx, dword [0xfdda001e]
ja 0x4207d6
cmc
or eax, dword [0xa3023f]
stosd dword es:[edi], eax
cmp byte [ebx - 0x78], cl
dec edi
scasd eax, dword es:[edi]
xor ebx, dword [esi + 0x30a3f3e1]
xor byte [esi - 0x652b4aeb], dl
push ds
mov word [edx - 0x18cc2c17], ds
js 0x420832
sbb esi, edi
sbb bl, byte [eax + 0x559ea18b]
cmc
fdivr qword [ecx + 0x27]
leave
cli
cmp byte [edx - 0x215b61d2], ch
daa
cmp eax, ecx
mov esp, dword [esi]
fst st(7)
int1
invalid
salc
test byte [eax], bh
not esi
cmp byte [ebx], ah
clc
and eax, 0xbf134e52
push esi
jnp 0x4207cc
add al, 0xf8
mov esi, 0x807fdf8b
pop ebx
arpl word [ebx + 0x13f5fa66], di
call 0x3c90b34c
insd dword es:[edi], dx
lds esi, [ecx + 0x32]
dec ebx
xor byte [edx - 4], ch
sahf
push edx
arpl word [edi + 0x24b30746], ax
mov bh, 0x5b
invalid
xchg esi, eax
invalid
invalid
invalid

Function at 0x4ba4fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23c8
cmp edx, dword [eax]
je 0x4ba51f
add eax, 8
inc ecx
cmp eax, 0x4c2458
jl 0x4ba510
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23c8]
jne 0x4ba64d
mov eax, dword [0x4c6d4c]
cmp eax, 1
je 0x4ba627
test eax, eax
jne 0x4ba550
cmp dword [0x4c22f0], 1
je 0x4ba627
cmp edx, 0xfc
je 0x4ba64d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba587
lea eax, [ebp - 0x1a4]
push 0x4bf888
push eax
call fcn.004baee0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb370
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba5ca
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb370
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf884
push edi
call fcn.004bd240
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bf868
push eax
call fcn.004baee0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baef0
lea eax, [ebp - 0xa0]
push 0x4bf864
push eax
call fcn.004baef0
push dword [esi + 0x4c23cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baef0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf83c
push eax
call fcn.004bd1b4
add esp, 0x2c
pop edi
jmp 0x4ba64d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23cc]
push 0
push eax
push dword [esi]
call fcn.004bb370
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret