joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fcf13
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, 0x6a7c02
call fcn.00664608
sub esp, 0x34
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x28], ebx
push str.http:__
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
call fcn.00427ba3
push 1
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x5fcfdb
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5fcfdb
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x5fcfd5
push 4
push str.http
push esi
call fcn.0067db97
add esp, 0xc
test eax, eax
je 0x5fcf9a
push 4
push str.feed
push esi
call fcn.0067db97
add esp, 0xc
test eax, eax
jne 0x5fcfd5
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5fcf9f
sub ecx, edx
cmp ecx, 0x12c
jae 0x5fcfd5
push esi
lea eax, [ebp - 0x40]
push eax
call fcn.00471937
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x5fcfcd
mov byte [ebp + 8], bl
push dword [ebp + 8]
push eax
call fcn.00427ad3
lea ecx, [ebp - 0x40]
call fcn.00427afc
call dword [sym.imp.USER32.dll_CloseClipboard]
push ebx
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00427a37
call fcn.005fce28
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x5fd032
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x5fd029
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004279ae
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4

Function at 0x5feac6
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6c13af
call fcn.00664608
push ecx
mov eax, dword [0x7ed94c]
test eax, eax
je 0x5feae5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x5feb24
push esi
push 0xcc
call fcn.00664379
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x5feb07
mov ecx, eax
call fcn.005fd9db
mov esi, eax
jmp 0x5feb09
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
push 0
push 0x25
call fcn.0059b660
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x5ff8d4
Capabilities:
Delete file

Disassembly:
mov eax, 0x6a7c02
call fcn.00664608
sub esp, 0x1c
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 0x78], edi
cmp dword [ebp + 8], edi
je 0x5ff980
push dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x28], edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00427ba3
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edi
push eax
mov ecx, esi
call fcn.005d8915
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x5ff95a
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x5ff951
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004279ae
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
cmp dword [esi + 0xc4], edi
je 0x5ff977
lea eax, [esi + 0xb4]
cmp dword [eax + 0x14], 8
jb 0x5ff970
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push esi
push edi
push 0x801e
jmp 0x5ff987
push esi
push edi
push 0x8023
push dword [0x7ed500]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x5ff9a3
Capabilities:
Delete file

Disassembly:
mov eax, 0x6c26d6
call fcn.00664608
sub esp, 0x3f4
push ebx
push esi
mov ebx, ecx
xor eax, eax
xor ecx, ecx
push 7
pop edx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
mov word [ebp - 0x48], ax
mov dword [ebp - 4], ecx
cmp dword [ebx + 0x8c], ecx
jne 0x5ffb15
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x7bb3c8
call fcn.0042a2bd
mov eax, dword [ebp - 0x10]
add eax, 8
push 8
pop esi
cmp dword [eax + 0x14], esi
jb 0x5ffa09
mov eax, dword [eax]
push edi
lea edi, [ebx + 0xb4]
mov ecx, edi
cmp dword [edi + 0x14], esi
jb 0x5ffa19
mov ecx, dword [edi]
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x18]
push edx
push eax
push ecx
lea ecx, [ebp - 0x200]
call fcn.005fae0c
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 2
jne 0x5ffa5a
push 0x6ce190
lea ecx, [ebp - 0x48]
call fcn.00436e07
test al, al
je 0x5ffa5a
push 0x6ce190
lea ecx, [ebp - 0x30]
call fcn.00436e07
test al, al
jne 0x5ffac9
push 0x100
lea eax, [ebp - 0x400]
push eax
push dword [ebp - 0x18]
call fcn.00454114
lea ecx, [ebp - 0x30]
cmp dword [ebp - 0x1c], esi
jb 0x5ffa79
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], esi
jb 0x5ffa84
mov eax, dword [ebp - 0x48]
cmp dword [edi + 0x14], esi
jb 0x5ffa8b
mov edi, dword [edi]
push ecx
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x400]
push eax
push edi
lea eax, [ebp - 0x60]
push str.The_install_of__s_failed._n__s__d_.___s____s_
push eax
call fcn.004577f2
add esp, 0x1c
cmp dword [eax + 0x14], esi
jb 0x5ffab0
mov eax, dword [eax]
push 0
push 0
push eax
push dword [0x7c8a28]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x60]
call fcn.00427afc
lea ecx, [ebp - 0x200]
call fcn.005fb336
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 0
pop edi
cmp eax, esi
jb 0x5ffb31
mov ecx, dword [ebp - 0x30]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
cmp eax, 0x1000
jb 0x5ffb0a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004279ae
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
jmp 0x5ffb31
push 8
lea eax, [ebx + 0x7c]
pop esi
cmp dword [eax + 0x14], esi
jb 0x5ffb22
mov eax, dword [eax]
push ecx
push ecx
push eax
push dword [0x7c8a28]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [ebx + 0xe4], 0
jne 0x5ffb4e
lea eax, [ebx + 0xb4]
cmp dword [eax + 0x14], esi
jb 0x5ffb47
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp byte [ebx + 0xe6], 0
je 0x5ffb5c
call fcn.0047ac9e
mov eax, dword [ebp - 0x34]
cmp eax, esi
pop esi
pop ebx
jb 0x5ffb98
mov ecx, dword [ebp - 0x48]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x5ffb8f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004279ae
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov al, 1
mov dword fs:[0], ecx
leave
ret
Function at 0x60296d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
push edi
mov edi, dword [esp + 0x74]
mov ebx, ecx
mov dword [esp + 0x18], ebx
test edi, edi
je 0x602b90
fld1
fst dword [esp + 0x14]
fld qword [0x726fa8]
fst qword [esp + 0x64]
fld qword [0x6d6a68]
fstp qword [esp + 0x24]
fld qword [0x726fd8]
fstp qword [esp + 0x2c]
fld qword [0x726fe0]
fstp qword [esp + 0x34]
fldz
fstp dword [esp + 8]
fld qword [0x726fe8]
fst qword [esp + 0x1c]
fld qword [0x727008]
fstp qword [esp + 0x4c]
fld qword [0x726fb0]
fstp qword [esp + 0x54]
fld qword [0x726fa0]
push ebp
mov ebp, dword [esp + 0x74]
fstp qword [esp + 0x60]
push esi
mov esi, dword [ebx + 0xc]
mov dword [esp + 0x18], esi
lea eax, [esi + 1]
mov dword [ebx + 0xc], eax
cmp esi, 0x56220
jb 0x602a02
xor ecx, ecx
jmp 0x602b78
fxch st(2)
fstp dword [esp + 0x7c]
cmp esi, 0x35d54
jae 0x602a53
mov dword [esp + 0x7c], esi
fstp st(1)
fild dword [esp + 0x7c]
test esi, esi
jns 0x602a24
fadd dword [0x6d7138]
fstp dword [esp + 0x7c]
fmul dword [esp + 0x7c]
fstp dword [esp + 0x7c]
fld dword [esp + 0x7c]
call fcn.00680a10
fstp dword [esp + 0x7c]
fld dword [esp + 0x7c]
fld qword [esp + 0x2c]
fmul st(1), st(0)
fsubrp st(1)
fstp dword [esp + 0x7c]
fld qword [esp + 0x24]
jmp 0x602a55
fstp st(0)
fld dword [esp + 0x7c]
lea esi, [ebx + 0x54]
fst qword [esp + 0x4c]
fld st(0)
xor ebx, ebx
fmul qword [esp + 0x34]
fsubr qword [esp + 0x3c]
fstp dword [esp + 0x14]
fld dword [esp + 0x10]
fstp dword [esp + 0x7c]
jmp 0x602a7c
fxch st(1)
fld dword [ebx + 0x726df8]
fld dword [ebx + 0x726db0]
fsub st(1)
fmulp st(2)
faddp st(1)
fadd dword [esi]
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
fst dword [esi]
fst qword [esp + 0x44]
fmulp st(1)
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
call fcn.00680a10
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
fmul dword [esp + 0x14]
fadd qword [esp + 0x44]
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
call fcn.00680a10
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
add ebx, 4
fadd dword [esp + 0x7c]
add esi, 4
fstp dword [esp + 0x7c]
fld qword [esp + 0x4c]
fld qword [esp + 0x24]
cmp ebx, 0x48
jl 0x602a7a
mov esi, dword [esp + 0x18]
fstp st(1)
fstp st(0)
fld dword [esp + 0x7c]
fmul qword [esp + 0x54]
fstp dword [esp + 0x7c]
cmp esi, 0x2b11
jae 0x602b29
mov dword [esp + 0x78], esi
fild dword [esp + 0x78]
test esi, esi
jns 0x602b1b
fadd dword [0x6d7138]
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
fmul qword [esp + 0x5c]
jmp 0x602b54
cmp esi, 0x40998
jbe 0x602b5c
mov eax, 0x56220
sub eax, esi
mov dword [esp + 0x78], eax
fild dword [esp + 0x78]
jns 0x602b48
fadd dword [0x6d7138]
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
fmul qword [esp + 0x64]
fmul dword [esp + 0x7c]
fstp dword [esp + 0x7c]
fld dword [esp + 0x7c]
call fcn.00664e40
fld dword [esp + 0x1c]
fld qword [esp + 0x6c]
fld qword [esp + 0x24]
mov ebx, dword [esp + 0x20]
movzx ecx, ax
mov word [ebp], cx
lea ebp, [ebp + 2]
sub edi, 1
jne 0x6029e6
fstp st(2)
fstp st(0)
pop esi
fstp st(0)
pop ebp
pop edi
pop ebx
add esp, 0x64
ret 8
Function at 0x602fed
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0x25
mov edi, ecx
call esi
cwde
push 0x27
mov dword [ebp - 4], eax
call esi
cwde
push 0x26
mov dword [ebp - 8], eax
call esi
cwde
push 0x28
mov dword [ebp - 0xc], eax
call esi
cmp byte [edi + 0x14], 1
movsx ebx, ax
jne 0x603061
test byte [ebp - 4], 1
je 0x603034
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.00602fa5
test byte [ebp - 8], 1
je 0x603045
push 0
push 1
mov ecx, edi
call fcn.00602fa5
test byte [ebp - 0xc], 1
je 0x603054
push 1
mov ecx, edi
call fcn.006033b7
test bl, 1
jne 0x60305d
test ebx, ebx
jns 0x603061
mov byte [edi + 0x15], 0xa
cmp byte [edi + 0x16], 0
jne 0x60307b
inc byte [edi + 0x15]
cmp byte [edi + 0x15], 0xa
jb 0x60307b
mov ecx, edi
mov byte [edi + 0x15], 0
call fcn.00602d8a
pop edi
pop esi
pop ebx
leave
ret

Function at 0x6033f8
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6c2879
call fcn.00664608
push ecx
mov eax, dword [0x7ed9a8]
test eax, eax
je 0x603417
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x603467
push ebx
push esi
mov ebx, 0x1c8
push ebx
call fcn.00664379
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
je 0x603449
push ebx
push 0
push esi
call fcn.006678b0
add esp, 0xc
mov ecx, esi
call fcn.00602523
mov esi, eax
jmp 0x60344b
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
push 0
push 0x1e
call fcn.0059b660
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x6041f3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
call fcn.00455bff
push dword [edi + 4]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov dword [edi + 0x38], eax
mov eax, dword [edi + 0x48]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x4c]
mov dword [edi + 0x3c], edx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edx, dword [edi]
mov esi, eax
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push esi
call dword [edx + 0x24]
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [edi + 0x104], 0
je 0x60428a
push 0x50
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x604264
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [edi + 4]
jne 0x604264
xor byte [edi + 0x122], 1
lea ecx, [edi + 0x10c]
call fcn.00602fed
mov eax, dword [edi + 0x124]
cmp eax, dword [edi + 0x108]
je 0x60428a
mov ecx, edi
mov dword [edi + 0x108], eax
call fcn.006035f4
pop edi
pop esi
leave
ret 4
Function at 0x6042e6
Capabilities:
Hide graphical window

Disassembly:
jmp 0x6042eb
mov eax, 0x6ae5c9
call fcn.00664608
push ecx
mov eax, dword [0x7ede24]
test eax, eax
je 0x60430a
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x60434f
push 0x38
call fcn.00664379
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x604326
mov ecx, eax
call fcn.006042a5
jmp 0x604328
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov ecx, eax
push 0
push 0x183
mov dword [0x7ede24], eax
call fcn.0059b660
mov eax, dword [0x7ede24]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x605997
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov byte [ebp - 4], 0
je 0x6059c2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6059be
mov byte [ebp - 4], 1
test al, 0x10
jne 0x6059c2
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov ecx, esi
push 0x51d
call fcn.0059b6b3
push dword [ebp - 4]
mov ecx, esi
push 0x51e
call fcn.0059b6b3
pop esi
leave
ret 4

Function at 0x606349
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6c2b65
call fcn.00664608
push ecx
push esi
push 0xe8
call fcn.00664379
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x60637c
push dword [ebp + 0xc]
mov ecx, eax
push dword [ebp + 8]
call fcn.006060cc
mov esi, eax
jmp 0x60637e
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
push 0
push 0xfd
call fcn.0059b660
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x606998
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10b8
call section..text
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
cmp dword [eax + 8], 0xfffffffe
je 0x6069bb
cmp dword [eax + 8], 0xfffffffc
jne 0x606a0a
add eax, 0xc
push 0x10b8
push eax
lea eax, [ebp - 0x10b8]
push eax
call fcn.006661f0
add esp, 0xc
push 0x5d4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esi + 0xc]
cmp dword [ecx], eax
jne 0x606a0a
cmp dword [ebp - 0x10b4], 0
jne 0x606a0a
push 5
xor ecx, ecx
lea eax, [ebp - 0x1048]
push ecx
push ecx
push eax
push 0x6ce504
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
leave
ret 4
Function at 0x607315
Capabilities:
Delete file

Disassembly:
mov eax, 0x6c2ca9
call fcn.00664608
sub esp, 0xd0
push ebx
push esi
lea ecx, [ebp - 0xc4]
call fcn.00607236
push 1
xor ebx, ebx
push ebx
push 0x20
mov dword [ebp - 4], ebx
call fcn.0059a05f
push eax
lea ecx, [ebp - 0xc4]
call fcn.0059b8d4
cmp eax, 1
jne 0x6074d2
cmp dword [ebp - 0x48], ebx
je 0x60742f
push 0x18
call fcn.00664379
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x607389
lea eax, [ebp - 0x74]
mov dword [esi], ebx
push eax
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00427a37
jmp 0x60738b
mov esi, ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x607417
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
jb 0x6073a2
mov eax, dword [ebp - 0x58]
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x6073ac
mov ecx, dword [esi]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push 0x6076da
push eax
push ebx
push ebx
push ecx
call fcn.004c2f77
mov esi, eax
test esi, esi
je 0x607417
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x58]
jb 0x6073d4
mov ecx, dword [ebp - 0x58]
push ecx
lea eax, [ebp - 0xdc]
push eax
call fcn.0047181f
cmp dword [ebp - 0xc8], 0x10
lea eax, [ebp - 0xdc]
mov byte [ebp - 4], 2
jb 0x6073fa
mov eax, dword [ebp - 0xdc]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.0041046f
mov ecx, esi
call fcn.004610b4
lea ecx, [ebp - 0xdc]
call fcn.00410858
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
mov dword [ebp - 0x48], ebx
jb 0x6074f9
mov eax, dword [ebp - 0x58]
jmp 0x6074f9
cmp dword [ebp - 0x30], ebx
je 0x607472
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
jb 0x607440
mov eax, dword [ebp - 0x40]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push fcn.00497a4c
push ebx
push ebx
push 0x200
push eax
call fcn.004c2f77
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
jb 0x6074f9
mov eax, dword [ebp - 0x40]
jmp 0x6074f9
cmp dword [ebp - 0x18], ebx
je 0x6074ae
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
jb 0x607483
mov eax, dword [ebp - 0x28]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push fcn.00497a4c
push ebx
push ebx
push 0x10000
push eax
call fcn.004c2f77
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
jb 0x6074f9
mov eax, dword [ebp - 0x28]
jmp 0x6074f9
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
jb 0x6074ba
mov eax, dword [ebp - 0x74]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push fcn.00497a4c
push ebx
push ebx
push ebx
push eax
call fcn.004c2f77
jmp 0x6074ea
cmp dword [ebp - 0x64], ebx
je 0x6074fe
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
jb 0x6074e3
mov eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
mov dword [ebp - 0x64], ebx
jb 0x6074f9
mov eax, dword [ebp - 0x74]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0xc4]
call fcn.006072b4
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x608d75
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x210
push ebp
push edi
push dword [esp + 0x21c]
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
lea eax, [esp + 8]
push eax
push dword [esp + 0x220]
push edi
call fcn.00599b73
mov ecx, dword [esp + 0x220]
test ecx, ecx
jne 0x608dc4
push 0xfe
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x224]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x14]
xor ebp, ebp
sub eax, dword [esp + 0xc]
push ebp
push dword [0x7ebde0]
push ebp
push edi
push eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
push eax
push dword [esp + 0x24]
mov eax, dword [esp + 0x244]
push dword [esp + 0x24]
or eax, 0x50010000
push eax
push ecx
push 0x6cfdec
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
mov eax, dword [esp + 0x224]
test eax, eax
jne 0x608e21
push ebp
push ebp
push 0x31
push dword [esp + 0x228]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push eax
push 0x30
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, edi
pop edi
pop ebp
add esp, 0x210
ret 0x10

Function at 0x60a0d9
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [eax], ecx
je 0x60a0f7
push 5
push ecx
push ecx
add eax, 0x7c
push eax
push 0x6ce504
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret 4
Function at 0x60b85f
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x38]
cmp eax, 1
je fcn.00609c49
test eax, eax
jne 0x60b870
inc eax
push 0
push 3
push eax
mov dword [ecx + 0x38], eax
call fcn.0060b895
ret 4

Function at 0x60c8fd
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x6c30ed
call fcn.00664608
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004294b0
push dword [ebp + 0xc]
xor edi, edi
lea ecx, [esi + 0x18]
mov dword [ebp - 4], edi
call fcn.004294b0
push dword [ebp + 0x10]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.004294b0
push 7
pop ecx
xor eax, eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], ecx
mov word [esi + 0x48], ax
mov dword [esi + 0x60], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], ecx
mov word [esi + 0x60], ax
mov dword [esi + 0x78], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], ecx
mov word [esi + 0x78], ax
mov dword [esi + 0x90], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], ecx
mov word [esi + 0x90], ax
mov dword [esi + 0xa8], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], ecx
mov word [esi + 0xa8], ax
mov dword [esi + 0xc0], edi
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], ecx
mov word [esi + 0xc0], ax
mov dword [esi + 0xd8], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], ecx
mov word [esi + 0xd8], ax
mov dword [esi + 0xf0], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], ecx
mov word [esi + 0xf0], ax
push edi
push edi
mov ecx, esi
mov byte [ebp - 4], 0xa
mov dword [esi + 0x114], edi
call fcn.006a42a6
push edi
mov ecx, esi
call fcn.006a4299
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x60d661
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
push ebx
push ebx
or dword [esi], 0xffffffff
push 3
push ebx
push 3
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x60d68e
xor eax, eax
jmp 0x60d6c2
push ebx
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x2d1080
push edi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x60d6b3
mov eax, dword [ebp - 8]
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
cmp dword [esi], 0xffffffff
setne al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x6104c5
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x6ad590
call fcn.00664608
push ecx
push esi
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0041046f
push dword [ebp + 8]
xor eax, eax
lea ecx, [esi + 0x18]
mov dword [ebp - 4], eax
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.00427a37
mov al, byte [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x30], al
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc