joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b3bd
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
cmp dword [0x48d204], 0
jne 0x43b3f7
lea eax, [ebp - 0x198]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x43b3f7
push 0x480e38
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], str.Could_not_start_WSA
call fcn.00440c8e
inc dword [0x48d204]
leave
ret

Function at 0x43b3ff
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ecx
and dword [esi + 4], 0
mov dword [esi], vtable.Socket.0
call fcn.0043b3bd
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 4
mov dword [esi + 4], eax
call fcn.0043c5aa
pop ecx
test eax, eax
je 0x43b432
mov dword [eax], 1
jmp 0x43b434
xor eax, eax
mov dword [esi + 8], eax
mov eax, esi
pop ecx
ret

Function at 0x43b4a9
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov eax, 0x465348
call fcn.0045ea44
sub esp, 0x2c
push ebx
push esi
push edi
lea ecx, [ebp - 0x38]
call fcn.00405580
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00405c20
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
cmp esi, ebx
jne 0x43b50e
call fcn.0044003f
push dword [eax]
call fcn.0043ff91
pop ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00405ad0
xor bl, bl
lea ecx, [ebp - 0x38]
call fcn.00407d30
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
push 2
pop eax
push dword [ebp + 0x10]
mov word [ebp - 0x1c], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1a], ax
mov eax, dword [esi + 0xc]
cmp dword [eax], ebx
je 0x43b4f1
xor ecx, ecx
mov eax, dword [eax + ecx]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x43b555
push 0x10
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x43b566
mov eax, dword [esi + 0xc]
inc ebx
mov ecx, ebx
shl ecx, 2
cmp dword [eax + ecx], 0
jne 0x43b52b
jmp 0x43b4f1
mov bl, 1
jmp 0x43b4f3

Function at 0x43b56a
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [ebx + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, 0x400
mov eax, edi
test ecx, ecx
je 0x43b5b8
test eax, eax
je 0x43b5b8
cmp eax, 0x2746
je 0x43b5b8
test esi, esi
je 0x43b5b8
push 0
cmp esi, edi
mov eax, esi
cmovge eax, edi
push eax
mov eax, dword [esp + 0x14]
sub eax, esi
add eax, dword [esp + 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x43b5b8
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x43b5b8
sub esi, eax
jmp 0x43b57e
mov eax, dword [esp + 0x10]
pop edi
sub eax, esi
pop esi
ret 8
Function at 0x43b64f
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, 0x464e29
call fcn.0045ea44
sub esp, 0x5c
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x30]
call fcn.00405580
and dword [ebp - 4], 0
push str._r_n_r_n
lea ecx, [ebp - 0x4c]
call fcn.00405b00
mov byte [ebp - 4], 1
push ebx
mov eax, dword [edi + 4]
test eax, eax
je 0x43b78b
push 0
push 1
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x43b73a
test eax, eax
je 0x43b764
push dword [ebp - 0x14]
lea ecx, [ebp - 0x30]
call fcn.004092c0
lea ecx, [ebp - 0x4c]
call fcn.00402d60
lea ecx, [ebp - 0x30]
mov ebx, eax
call fcn.00402d60
cmp eax, ebx
jb 0x43b709
push 0xffffffffffffffff
lea ecx, [ebp - 0x4c]
call fcn.00402d60
lea ecx, [ebp - 0x30]
mov ebx, eax
call fcn.00402d60
sub eax, ebx
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x30]
call fcn.00409340
lea ecx, [ebp - 0x4c]
push ecx
mov byte [ebp - 4], 2
or dword [ebp - 0x10], 2
push eax
call fcn.004052f0
pop ecx
pop ecx
test al, al
je 0x43b709
mov bl, 1
jmp 0x43b70b
xor bl, bl
mov dword [ebp - 4], 1
test byte [ebp - 0x10], 2
je 0x43b724
and dword [ebp - 0x10], 0xfffffffd
lea ecx, [ebp - 0x68]
call fcn.00407d30
test bl, bl
je 0x43b67e
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
call fcn.00406180
jmp 0x43b798
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x43b67e
push dword [edi + 4]
push eax
push str.recv
push 8
push dword [0x48d1c4]
call fcn.00454eb0
add esp, 0x14
lea ecx, [ebp - 0x30]
call fcn.00405c20
push eax
lea ecx, [ebp - 0x30]
call fcn.00402d60
push eax
push str.ReceiveHttpHeader
push 8
push dword [0x48d1c4]
call fcn.00454eb0
add esp, 0x14
mov ecx, dword [ebp + 8]
push 0x47b6a4
call fcn.00405b00
lea ecx, [ebp - 0x4c]
call fcn.00407d30
lea ecx, [ebp - 0x30]
call fcn.00407d30
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x43b7ba
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
push edi
jle 0x43b827
mov eax, dword [ebx + 4]
cmp eax, esi
je 0x43b823
cmp esi, dword [esp + 0x10]
jge 0x43b823
mov ecx, dword [esp + 0x10]
push 0
sub ecx, esi
push ecx
mov ecx, dword [esp + 0x14]
add ecx, esi
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43b7fc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x43b807
mov eax, dword [ebx + 4]
add esi, edi
test eax, eax
jne 0x43b7cb
jmp 0x43b823
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.sendbytes_socket_error:__d_n
push 8
push dword [0x48d1c4]
call fcn.00454eb0
add esp, 0x10
mov eax, esi
jmp 0x43b82a
or eax, 0xffffffff
pop edi
pop esi
ret 8
Function at 0x43bb43
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x48b4d8], 0
push esi
jne 0x43bab6
call fcn.0043b9dc
test eax, eax
je 0x43baf9
mov eax, dword [0x48b4d8]
cmp eax, 1
jne 0x43bad7
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x43baf9
pop esi
ret
push eax
call dword [0x48b4e0]
test eax, eax
jne 0x43bb41
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x43bafd
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x48b4d8]
call dword [0x48b4e0]
mov edi, eax
test edi, edi
je 0x43bb22
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x43bb3e
mov edi, esi
add esi, 0xff0
push edi
push dword [0x48b4d8]
call dword [0x48b4dc]
add edi, 0x10
cmp edi, esi
jb 0x43bb2a
mov eax, edi
pop edi
pop esi
ret
jmp 0x43baa3

Function at 0x43bc88
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4891c0]
jne 0x43bc92
repz ret
jmp fcn.0044131c

Function at 0x44dffa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00441494
and dword [ebp - 4], 0
cmp dword [0x48bff0], 0
mov ebx, eax
jne 0x44e0ab
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44e15c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x44e15c
push eax
call fcn.00441422
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48bff0], eax
call esi
push eax
call fcn.00441422
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48bff4], eax
call esi
push eax
call fcn.00441422
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48bff8], eax
call esi
push eax
call fcn.00441422
pop ecx
mov dword [0x48c000], eax
test eax, eax
je 0x44e0ab
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00441422
pop ecx
mov dword [0x48bffc], eax
mov eax, dword [0x48bffc]
cmp eax, ebx
je 0x44e103
cmp dword [0x48c000], ebx
je 0x44e103
push eax
call fcn.0044149d
push dword [0x48c000]
mov esi, eax
call fcn.0044149d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44e103
test edi, edi
je 0x44e103
call esi
test eax, eax
je 0x44e0fa
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44e0fa
test byte [ebp - 0xc], 1
jne 0x44e103
or dword [ebp + 0x10], 0x200000
jmp 0x44e13c
mov eax, dword [0x48bff4]
cmp eax, ebx
je 0x44e13c
push eax
call fcn.0044149d
pop ecx
test eax, eax
je 0x44e13c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44e13c
mov eax, dword [0x48bff8]
cmp eax, ebx
je 0x44e13c
push eax
call fcn.0044149d
pop ecx
test eax, eax
je 0x44e13c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48bff0]
call fcn.0044149d
pop ecx
test eax, eax
je 0x44e15c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44e15e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4516a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463036
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4891c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.0045dde0
mov ecx, eax
call fcn.0045de70
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004015b0
movzx ecx, al
test ecx, ecx
jne 0x451789
push 0x4742f0
lea ecx, [ebp - 0x2c]
call fcn.00401600
push str.http:__123.ie.sogou.com_static_feedback.html
lea ecx, [ebp - 0x2c]
call fcn.00401600
push 0x474354
lea ecx, [ebp - 0x2c]
call fcn.00401600
mov dword [ebp - 0x84], 0x44
push 0x40
push 0
lea edx, [ebp - 0x80]
push edx
call fcn.0043c260
add esp, 0xc
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x84]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
call fcn.00401d50
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004026a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bc88
mov esp, ebp
pop ebp
ret 4
Function at 0x4531a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1878
call fcn.0044e520
mov eax, dword [0x4891c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0x824]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x4743d8
lea edx, [ebp - 0x1870]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x1870]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 8], eax
xor ecx, ecx
mov word [ebp - 0x810], cx
push 0x7fe
push 0
lea edx, [ebp - 0x80e]
push edx
call fcn.0043c260
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1028], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x1026]
push ecx
call fcn.0043c260
add esp, 0xc
push 0x400
lea edx, [ebp - 0x810]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x1028]
push ecx
call fcn.00409dc0
add esp, 8
push 0x5c
lea edx, [ebp - 0x1028]
push edx
call fcn.00409de0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x453289
jmp 0x453375
xor eax, eax
mov ecx, dword [ebp - 4]
mov word [ecx], ax
mov dword [ebp - 0x1070], 0x44
push 0x40
push 0
lea edx, [ebp - 0x106c]
push edx
call fcn.0043c260
add esp, 0xc
mov dword [ebp - 0x820], 0
xor eax, eax
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x814], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x824]
push edx
mov eax, dword [ebp - 0xc]
push eax
movzx ecx, byte [ebp + 0xc]
neg ecx
sbb ecx, ecx
neg ecx
push ecx
movzx edx, byte [0x48c126]
neg edx
sbb edx, edx
neg edx
push edx
mov eax, dword [0x48c12c]
push eax
lea ecx, [ebp - 0x1028]
push ecx
push str.__sSogouExplorer.exe___dump__d__d__d__d__d__d
lea edx, [ebp - 0x1870]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
lea eax, [ebp - 0x820]
push eax
lea ecx, [ebp - 0x1070]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [ebp - 0x1870]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x45336b
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1878], eax
mov ecx, dword [ebp - 0x820]
mov dword [ebp - 0x1874], ecx
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x1878]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bc88
mov esp, ebp
pop ebp
ret
Function at 0x453400
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x4891c0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0043c260
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x474508
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x474510
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x468]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x453568
lea ecx, [ebp - 0x43c]
test ecx, ecx
je 0x4534be
push 0x474518
lea edx, [ebp - 0x43c]
push edx
call fcn.0043bdd5
add esp, 8
test eax, eax
je 0x4534be
push 0x474520
lea eax, [ebp - 0x43c]
push eax
call fcn.0043bdd5
add esp, 8
test eax, eax
jne 0x4534c0
jmp 0x453535
xor ecx, ecx
mov word [ebp - 0x678], cx
push 0x208
push 0
lea edx, [ebp - 0x676]
push edx
call fcn.0043c260
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x474524
lea ecx, [ebp - 0x678]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, dword [ebp - 0x468]
and ecx, 0x10
je 0x453528
lea edx, [ebp - 0x678]
push edx
call fcn.00453400
add esp, 4
jmp 0x453535
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x468]
push ecx
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x453484
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bc88
mov esp, ebp
pop ebp
ret
Function at 0x453580
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x4891c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x239], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.0043c260
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x45362c
push 0x474468
lea eax, [ebp - 0x214]
push eax
call fcn.0043e459
add esp, 8
test eax, eax
jne 0x453615
mov byte [ebp - 0x239], 1
jmp 0x45362c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4535f4
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, byte [ebp - 0x239]
test ecx, ecx
jne 0x453648
mov al, 1
jmp 0x453673
push 4
push 0x47448c
push 0x474494
mov edx, dword [0x48c128]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x453671
mov byte [0x48c125], 1
mov al, 1
jmp 0x453673
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bc88
mov esp, ebp
pop ebp
ret

Function at 0x453710
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x4891c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0
push 0x110
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.0043c260
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x453765
mov eax, 2
jmp 0x4537d8
cmp dword [ebp - 0x110], 1
jne 0x453775
mov eax, 2
jmp 0x4537d8
cmp dword [ebp - 0x110], 2
jne 0x4537d3
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 0x124], edx
cmp dword [ebp - 0x124], 5
je 0x4537a5
cmp dword [ebp - 0x124], 6
je 0x45379e
jmp 0x4537cc
mov eax, 0x10
jmp 0x4537d8
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jbe 0x4537cc
cmp dword [ebp - 0x128], 2
jbe 0x4537c5
jmp 0x4537cc
mov eax, 4
jmp 0x4537d8
mov eax, 2
jmp 0x4537d8
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bc88
mov esp, ebp
pop ebp
ret
Function at 0x4537f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0044e520
mov eax, dword [0x4891c0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4538a1
mov dword [ebp - 0x100c], 1
xor eax, eax
mov word [ebp - 0x1008], ax
push 0xffe
push 0
lea ecx, [ebp - 0x1006]
push ecx
call fcn.0043c260
add esp, 0xc
mov dword [ebp - 0x1010], 0x800
lea edx, [ebp - 0x1010]
push edx
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp - 0x100c]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4538a1
lea ecx, [ebp - 0x1008]
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.00401d00
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x4538a3
xor al, al
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043bc88
mov esp, ebp
pop ebp
ret

Function at 0x4538c0
Capabilities:
Create process on windows
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4891c0]
xor eax, ebp
mov dword [ebp - 8], eax
movzx eax, byte [0x48c125]
test eax, eax
je 0x4539de
mov byte [0x48c125], 0
push 0
lea ecx, [ebp - 0x24]
push ecx
call fcn.0045dde0
mov ecx, eax
call fcn.0045de70
lea ecx, [ebp - 0x24]
call fcn.004015b0
movzx edx, al
test edx, edx
jne 0x453926
push 5
push 0
push 0x4744c0
lea ecx, [ebp - 0x24]
call fcn.00401d50
push eax
push 0x4744d0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x28], 0x32
push 0
push 0x4744dc
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x45395b
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
sub ecx, 1
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x45395b
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x45392d
call fcn.00453690
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4539c2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4539c2
push 0
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
je 0x4539c2
push 1
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea ecx, [ebp - 0x24]
call fcn.004026a0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043bc88
mov esp, ebp
pop ebp
ret
Function at 0x453a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, word [0x48e710]
test eax, eax
jne 0x453a57
mov dword [ebp - 8], 0xa
mov dword [ebp - 4], 1
lea ecx, [ebp - 8]
push ecx
push 0x48e710
lea edx, [ebp - 4]
push edx
push str.region
push str.SoftWareSogouExplorer
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x453a57
push str.0000
push 0x48e710
call fcn.00409670
add esp, 8
mov eax, 0x48e710
mov esp, ebp
pop ebp
ret

Function at 0x453ab0
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jbe 0x453af4
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x453ae0
or eax, 0xffffffff
jmp 0x453af6
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 4]
mov dword [ebp + 0x10], edx
jmp 0x453abb
xor eax, eax
mov esp, ebp
pop ebp
ret