joyce8/EMBER2024-capa huggingface dataset:
Function at 0x574c6c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x14], eax
push 2
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x574d32
mov word [ebx], 2
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_getsockname
inc eax
je 0x574d32
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x1008
push 0xffff
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_getsockopt
inc eax
je 0x574d32
cmp dword [ebx + 4], 0
jne 0x574cfd
mov ebx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x574d3e
mov eax, ebx
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00402db8
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_getpeername
mov ebx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x574d3e
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
or ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x57976c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404344
xor eax, eax
push ebp
push 0x5797f4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00404354
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 8], eax
push 2
push 4
lea eax, [ebp - 8]
push eax
call sub.wsock32.dll_gethostbyaddr
mov ebx, eax
test ebx, ebx
je 0x5797d2
mov eax, esi
mov edx, dword [ebx]
call fcn.004040c8
jmp 0x5797d9
mov eax, esi
call fcn.00403f10
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5797fb
lea eax, [ebp - 4]
call fcn.00403f10
ret
Function at 0x589e04
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404344
xor eax, eax
push ebp
push 0x58a009
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.00402db8
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404140
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040d784
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x58a020
call fcn.004041dc
mov dl, 1
mov eax, dword [0x4111e4]
call fcn.00403140
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x589fd7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004097a4
test al, al
je 0x589ee3
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x589f2a
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x124]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00408f80
mov ecx, dword [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x589ef5
mov edx, 0x58a034
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x589f4d
mov edx, 0x58a048
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor ebx, ebx
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.00402db8
push 0x105
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
call fcn.00404354
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404140
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov edx, 0x58a05c
call fcn.004041dc
mov ecx, dword [ebp - 0x128]
lea edx, [ebx + 1]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x589fde
mov eax, dword [ebp - 0xc]
call fcn.00403170
ret

Function at 0x58a5c4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov edx, 0x40
call fcn.00409634
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x58a609
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58a610
mov eax, dword [ebp - 8]
call fcn.00409734
ret
Function at 0x58ff48
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov edx, 0x40
call fcn.00409634
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x58ff8d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58ff94
mov eax, dword [ebp - 8]
call fcn.00409734
ret
Function at 0x5908e8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
mov edx, 0x59095c
call fcn.00403f64
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x590947
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x59093b
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.0040a168
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x59092c
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x594dd8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404344
xor eax, eax
push ebp
push 0x594eab
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x456678]
call fcn.004567e4
mov dword [ebp - 8], eax
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.004568c0
xor eax, eax
push ebp
push 0x594e5b
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x594ec4
mov eax, dword [ebp - 8]
call fcn.00456a04
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409c00
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0045703c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x594e7d
mov eax, dword [ebp - 8]
call fcn.00456890
mov eax, dword [ebp - 8]
call fcn.00403170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x594eb2
lea eax, [ebp - 0xc]
call fcn.00403f10
lea eax, [ebp - 4]
call fcn.00403f10
ret

Function at 0x5963dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x596476
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [0x6454e4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 8]
mov edx, 0x64
call fcn.004044c4
mov eax, dword [ebp - 8]
call fcn.00404354
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDList
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x59648c
mov eax, esi
call fcn.0050afe0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x59649c
call fcn.004041dc
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00403f64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59647d
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403f34
ret
Function at 0x5964d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x596572
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [0x6454e4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 8]
mov edx, 0x64
call fcn.004044c4
mov eax, dword [ebp - 8]
call fcn.00404354
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDList
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x596588
mov eax, esi
call fcn.0050afe0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x596588
call fcn.004041dc
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00403f64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x596579
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403f34
ret

Function at 0x596744
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov edx, 0x40
call fcn.00409634
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x596789
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x596790
mov eax, dword [ebp - 8]
call fcn.00409734
ret

Function at 0x59743c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x5974e6
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x597499
push 0x90
lea eax, [ebp - 0x91]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x128]
lea eax, [ebp - 0x91]
call fcn.0040a168
mov eax, dword [ebp - 0x128]
mov edx, ebx
call fcn.00408f80
jmp 0x5974c8
push 0x90
lea eax, [ebp - 0x122]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x122]
call fcn.0040a168
mov eax, dword [ebp - 0x12c]
mov edx, ebx
call fcn.00408f80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5974ed
lea eax, [ebp - 0x12c]
mov edx, 2
call fcn.00403f34
ret
Function at 0x5987ec
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
push 3
push 0x13f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
call sub.advapi32.dll_EnumServicesStatusA
test eax, eax
je 0x598835
mov eax, dword [ebp + 8]
push eax
call fcn.005985e8
pop ecx
pop ebp
ret
call sub.kernel32.dll_GetLastError_1
sub eax, 5
je 0x598850
dec eax
je 0x59885c
sub eax, 0x51
je 0x598868
sub eax, 0x93
je 0x598874
jmp 0x5988a7
mov eax, 0x5988bc
call fcn.005982f0
jmp 0x5988b1
mov eax, 0x598914
call fcn.005982f0
jmp 0x5988b1
mov eax, 0x59893c
call fcn.005982f0
jmp 0x5988b1
mov eax, dword [ebp + 8]
push eax
call fcn.005985e8
pop ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
call fcn.00402788
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp + 8]
mov dword [edx - 0x18], eax
mov eax, dword [ebp + 8]
push eax
call fcn.005987ec
pop ecx
jmp 0x5988b1
mov eax, 0x598970
call fcn.005982f0
pop ebp
ret
Function at 0x5998b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404344
xor eax, eax
push ebp
push 0x5999ec
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.00599854
mov esi, eax
test esi, esi
jle 0x5999ce
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404398
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404354
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x5999ce
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404190
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00404398
cmp dword [ebp - 0xc], 0
jne 0x599955
xor esi, esi
jmp 0x59995f
mov eax, dword [ebp - 0xc]
call fcn.00404354
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x5999c5
mov eax, dword [ebp - 0x18]
call fcn.00402758
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x5999be
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jne 0x5999b5
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov bl, 1
jmp 0x5999c5
mov eax, edi
call fcn.00402770
jmp 0x5999c5
mov eax, edi
call fcn.00402770
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5999f3
lea eax, [ebp - 0xc]
call fcn.00403f10
lea eax, [ebp - 4]
call fcn.00403f10
ret
Function at 0x59f86c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404344
xor eax, eax
push ebp
push 0x59fa71
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.00402db8
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404140
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040d784
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x59fa88
call fcn.004041dc
mov dl, 1
mov eax, dword [0x4111e4]
call fcn.00403140
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x59fa3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004097a4
test al, al
je 0x59f94b
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x59f992
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x124]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00408f80
mov ecx, dword [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x59f95d
mov edx, 0x59fa9c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x59f9b5
mov edx, 0x59fab0
mov eax, dword [ebp - 0xc]
call fcn.00413a78
xor ebx, ebx
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.00402db8
push 0x105
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
call fcn.00404354
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404140
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov edx, 0x59fac4
call fcn.004041dc
mov ecx, dword [ebp - 0x128]
lea edx, [ebx + 1]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59fa46
mov eax, dword [ebp - 0xc]
call fcn.00403170
ret
Function at 0x5a0a04
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2f
push 0
push 0
dec ecx
jne 0x5a0a0c
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404344
xor eax, eax
push ebp
push 0x5a172a
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x18]
mov eax, dword [0x65a234]
mov eax, dword [eax + 0x24]
mov edx, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408f80
mov edx, dword [ebp - 0x14]
mov eax, 0x5a1740
call fcn.0040447c
test eax, eax
jg 0x5a1704
mov eax, dword [0x645708]
cmp byte [eax], 0
jne 0x5a0ab7
mov eax, dword [0x6456e0]
cmp byte [eax], 0
je 0x5a0a97
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5a1758
call fcn.00413a78
jmp 0x5a1704
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5a177c
call fcn.00413a78
jmp 0x5a1704
mov edx, dword [ebp - 4]
mov eax, dword [0x65a234]
call fcn.0050ad98
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5a0bee
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x5a0bd7
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x5a0bc2
mov eax, dword [0x6456c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x374]
mov dl, 1
call fcn.00555d1c
mov eax, dword [0x6456c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
mov dl, 1
call fcn.0045a094
mov eax, dword [0x645354]
mov eax, dword [eax]
mov eax, dword [eax + 0x32c]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x5a0b73
lea edx, [ebp - 0x20]
mov eax, dword [0x6454e4]
mov eax, dword [eax]
call fcn.00454428
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409adc
lea eax, [ebp - 0x1c]
mov edx, 0x5a17c4
call fcn.00404198
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x6456c8]
mov eax, dword [eax]
call fcn.0061c45c
mov eax, dword [0x6456e0]
cmp byte [eax], 0
je 0x5a0b9a
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5a17dc
call fcn.00413a78
jmp 0x5a0bb5
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5a17f4
call fcn.00413a78
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x5a0bd7
push 0
mov cx, word [0x5a1814]
mov dl, 1
mov eax, 0x5a1820
call fcn.0045f148
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0bf5
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a1731
lea eax, [ebp - 0x178]
mov edx, 0x5b
call fcn.00403f34
lea eax, [ebp - 8]
call fcn.00403f10
ret
Function at 0x5a1960
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
mov edx, ebx
mov eax, dword [0x65a234]
call fcn.0050ad98
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a1a1e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x5a1a07
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x5a19f2
mov eax, dword [0x6456e0]
cmp byte [eax], 0
je 0x5a19ca
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5a1a34
call fcn.00413a78
jmp 0x5a19e5
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5a1a4c
call fcn.00413a78
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x5a1a07
push 0
mov cx, word [0x5a1a6c]
mov dl, 1
mov eax, 0x5a1a78
call fcn.0045f148
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a1a25
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x5a88dc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5a89f8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5a89d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x456678]
call fcn.004567e4
mov esi, eax
mov dl, 1
mov eax, dword [0x4111e4]
call fcn.00403140
mov dword [ebp - 4], eax
mov edx, 0x80000002
mov eax, esi
call fcn.004568c0
mov cl, 1
mov edx, 0x5a8a10
mov eax, esi
call fcn.00456a04
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00456ed8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5a8996
inc ebx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov eax, esi
call fcn.00457068
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00408f80
mov edx, dword [ebp - 0xc]
mov eax, dword [0x65a240]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc dword [ebp - 8]
dec ebx
jne 0x5a895d
mov eax, esi
call fcn.00403170
mov eax, dword [ebp - 4]
call fcn.00403170
mov eax, dword [0x65a224]
cmp dword [eax + 0xc80], 0
jne 0x5a89c9
mov eax, dword [0x65a240]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, dword [0x65a224]
mov dword [edx + 0xc80], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a89dd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a89ff
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403f34
ret