joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a6b50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.005ca540
mov eax, dword [0x6c6f60]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x28], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x18], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x5a6d15
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea esp, [esp]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x5a6ca5
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call fcn.00452640
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x5a6c40
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x5a6cfc
mov ecx, dword [esp + 0x24]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005c950e
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005c950e
add esp, 0x28
ret
Function at 0x5a87c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.005ca540
mov eax, dword [0x6c6f60]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
mov ebx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xb4]
test edi, edi
je 0x5a8963
push ebp
dec edi
lea ebp, [ebx + 0xc]
add ebx, 0x14
shr edi, 3
push esi
mov esi, dword [esp + 0xb8]
inc edi
mov dword [esp + 0x18], ebx
jmp 0x5a8810
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ecx, byte [esi - 8]
shl eax, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [esi - 3]
shl eax, 8
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ecx
movzx ecx, byte [esi - 4]
or ecx, eax
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [ebp]
and al, 0xdf
mov dword [esp + 0x14], ecx
or al, 0x40
mov dword [esp + 0x28], ecx
mov byte [ebp], al
movzx eax, byte [ebx]
and al, 0xbf
mov dword [esp + 0x20], ecx
or al, 0x20
push ebp
mov byte [ebx], al
call fcn.0056caf0
lea eax, [esp + 0x30]
push eax
push ebp
call fcn.0056c8b0
push 1
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0043abc0
push ebx
call fcn.0056caf0
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.0056c8b0
push 1
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.0043abc0
mov ecx, dword [esp + 0x44]
add esp, 0x30
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
xor edx, ecx
xor ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
xor ebx, eax
mov dword [esp + 0x14], ecx
xor eax, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x10], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [esp + 0x10]
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
shr eax, 8
mov byte [ecx], bl
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [ecx + 3], bl
mov ebx, ecx
shr eax, 8
mov byte [ecx + 4], dl
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
dec edi
jne 0x5a8810
pop esi
pop ebp
mov ecx, dword [esp + 0xa4]
pop edi
pop ebx
xor ecx, esp
call fcn.005c950e
add esp, 0xa0
ret
Function at 0x5ae490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x70
call fcn.005ca540
mov eax, dword [0x6c6f60]
xor eax, esp
mov dword [esp + 0x6c], eax
cmp dword [esp + 0x88], 0x40000000
mov eax, dword [esp + 0x7c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x84]
push ebp
mov ebp, dword [esp + 0x78]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x90]
push esi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0
ja 0x5ae667
mov esi, dword [esp + 0x80]
cmp esi, 0x40000000
ja 0x5ae667
cmp dword [esp + 0x88], 0x40000000
ja 0x5ae667
push ebx
push edi
push eax
call fcn.00549bf0
mov edi, eax
lea eax, [esp + 0x28]
push eax
call fcn.0053ce20
push 0
push dword [esp + 0x28]
lea eax, [esp + 0x34]
mov ebx, 1
push eax
call fcn.0053ca00
push dword [esp + 0xa4]
lea eax, [esp + 0x3c]
mov dword [esp + 0x28], 0x1000000
push dword [esp + 0x30]
push eax
call fcn.0053cbb0
add esp, 0x20
test eax, eax
je 0x5ae643
push 4
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0053cbb0
add esp, 0xc
test eax, eax
je 0x5ae643
push dword [esp + 0x98]
lea eax, [esp + 0x28]
push dword [esp + 0x24]
push eax
call fcn.0053cbb0
add esp, 0xc
test eax, eax
je 0x5ae643
push 0
cmp esi, edi
jb 0x5ae60b
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.0053c930
add esp, 0xc
test eax, eax
je 0x5ae643
sub esi, edi
je 0x5ae63b
push 0
push dword [esp + 0x20]
lea eax, [esp + 0x2c]
add ebp, edi
push eax
inc ebx
call fcn.0053ca00
push dword [esp + 0x9c]
mov eax, ebx
mov byte [esp + 0x23], bl
push dword [esp + 0x28]
shr eax, 8
mov byte [esp + 0x26], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x25], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x24], al
lea eax, [esp + 0x38]
push eax
call fcn.0053cbb0
add esp, 0x18
test eax, eax
jne 0x5ae557
jmp 0x5ae643
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0053c930
add esp, 0xc
test eax, eax
je 0x5ae643
push esi
lea eax, [esp + 0x40]
push eax
push ebp
call fcn.005e2940
lea eax, [esp + 0x48]
push edi
push eax
call fcn.00438a20
add esp, 0x14
mov dword [esp + 0x14], 1
lea eax, [esp + 0x24]
push eax
call fcn.0053cbc0
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.005c950e
add esp, 0x70
ret
mov ecx, dword [esp + 0x74]
xor eax, eax
pop esi
pop ebp
xor ecx, esp
call fcn.005c950e
add esp, 0x70
ret
Function at 0x5b03e0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov eax, dword [ebp + 4]
cmp eax, dword [ecx + 4]
jge 0x5b03f7
mov edi, ecx
jmp 0x5b03fb
mov edi, ebp
mov ebp, ecx
mov ebx, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [ebx + 8]
jg 0x5b040b
mov eax, ebx
jmp 0x5b0415
push eax
push ebx
call fcn.00537dd0
add esp, 8
test eax, eax
jne 0x5b041d
pop edi
pop ebp
pop ebx
ret
push esi
xor esi, esi
cmp dword [ebp + 4], esi
jle 0x5b043b
mov eax, dword [edi]
mov ecx, dword [ebp]
mov edx, dword [eax + esi*4]
mov eax, dword [ebx]
xor edx, dword [ecx + esi*4]
mov dword [eax + esi*4], edx
inc esi
cmp esi, dword [ebp + 4]
jl 0x5b0425
cmp esi, dword [edi + 4]
jge 0x5b0450
mov eax, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [edi + 4]
jl 0x5b0440
mov ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
pop esi
test ecx, ecx
jle 0x5b0474
mov edx, dword [ebx]
add edx, 0xfffffffc
lea edx, [edx + ecx*4]
mov eax, dword [edx]
lea edx, [edx - 4]
test eax, eax
jne 0x5b0471
dec ecx
test ecx, ecx
jg 0x5b0463
mov dword [ebx + 4], ecx
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x5c23b0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x204]
push 0x100
push 0
push eax
call fcn.005e2ec0
add esp, 0xc
cmp byte [ebp - 0x204], 0
jne 0x5c23ea
xor ecx, ecx
jmp 0x5c23fc
lea ecx, [ebp - 0x204]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c23f3
sub ecx, edx
push ecx
lea eax, [ebp - 0x204]
mov ecx, esi
push eax
call fcn.00491030
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.005e2ec0
add esp, 0xc
lea eax, [ebp - 0x308]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0xfa
lea eax, [ebp - 0x305]
push 0
push eax
call fcn.005e2ec0
add esp, 0xc
lea eax, [ebp - 0x40c]
push 0x104
push eax
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x514]
push eax
push 0x104
lea eax, [ebp - 0x510]
push eax
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
jne 0x5c249a
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c950e
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0x514]
lea eax, [ebp - 0x104]
push 0x64353c
push eax
call fcn.0047e710
add esp, 0xc
cmp byte [ebp - 0x104], 0
jne 0x5c24c1
xor ecx, ecx
jmp 0x5c24d9
lea ecx, [ebp - 0x104]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c24d0
sub ecx, edx
push ecx
lea eax, [ebp - 0x104]
mov ecx, esi
push eax
call fcn.00491210
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.005c950e
mov esp, ebp
pop ebp
ret 4
Function at 0x5c8030
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x6cdf64], eax
mov eax, dword [ebp + 0xc]
mov dword [0x6cdf68], eax
mov eax, dword [ebp + 0x10]
mov dword [0x6cdf6c], eax
mov eax, dword [ebp + 0x14]
push 0x1bc
mov dword [0x6cdf70], eax
call fcn.005c97b8
add esp, 4
test eax, eax
je 0x5c806d
mov ecx, eax
call fcn.005beff0
jmp 0x5c806f
xor eax, eax
push 0
push 0
push 0
push 0x5c3100
push 0
push 0
mov dword [0x6cdf60], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
xor eax, eax
pop ebp
ret

Function at 0x5c8b20
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x616ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005c9b2c
add esp, 4
mov edi, eax
lea eax, [ebp - 0x44]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
test eax, eax
je 0x5c8bcc
cmp word [edi], 0
jne 0x5c8bae
xor ecx, ecx
jmp 0x5c8bc2
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5c8bb3
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x40]
call fcn.0047d160
push edi
call fcn.005c98d2
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [eax + eax*2]
push 0x20
push eax
call fcn.00490fa0
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push 0
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x40]
push ecx
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
ja 0x5c8c46
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
cmovae ecx, dword [ebp - 0x28]
mov byte [ecx + eax], 0
jmp 0x5c8c53
sub eax, ecx
lea ecx, [ebp - 0x28]
push 0
push eax
call fcn.00491180
lea eax, [ebp - 0x28]
cmp ebx, eax
je 0x5c8c66
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.004910b0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x5c8c7b
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004943f0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp eax, 8
jb 0x5c8ca2
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.0047d480
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c950e
mov esp, ebp
pop ebp
ret 4
Function at 0x5c8cd0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push eax
push 0x101
mov esi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x6a56f1
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x5c8d53
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, eax
cmp byte [edx], 0
jne 0x5c8d23
xor ecx, ecx
jmp 0x5c8d3a
mov ecx, edx
push ebx
lea ebx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c8d30
sub ecx, ebx
pop ebx
push ecx
push edx
mov ecx, esi
call fcn.00491030
cmp edi, esi
je 0x5c8d53
push 0xffffffffffffffff
push 0
push esi
mov ecx, edi
call fcn.004910b0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.005c950e
mov esp, ebp
pop ebp
ret 4
Function at 0x5c8d70
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
push str.RtlGetVersion
push 0x66b210
mov dword [ebp - 0x220], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x110
mov esi, eax
lea eax, [ebp - 0x330]
push 0
push eax
call fcn.005e2ec0
add esp, 0xc
mov dword [ebp - 0x334], 0x114
lea eax, [ebp - 0x334]
push eax
call esi
push 0x18
push str.unknown_OperatingSystem.
mov ecx, edi
mov esi, eax
call fcn.00491030
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je case.0x5c8e5e.7
test esi, esi
jne case.0x5c8e5e.7
push 0x100
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.005e2ec0
push dword [ebp - 0x218]
lea eax, [ebp - 0x104]
push dword [ebp - 0x21c]
push str._d__d
push eax
call fcn.0047e710
lea eax, [ebp - 0x104]
push eax
call fcn.004cbc00
mov eax, dword [ebp - 0x330]
add esp, 0x20
add eax, 0xfffffffc
cmp eax, 6
ja case.0x5c8e5e.7
jmp dword [eax*4 + 0x5c9028]
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x5c8e91
cmp eax, 0xa
je 0x5c8e87
cmp eax, 0x5a
jne case.0x5c8e5e.7
push 0x66b28c
jmp 0x5c900d
push str.Microsoft_Windows_98
jmp 0x5c900d
mov eax, dword [ebp - 0x210]
cmp eax, 2
jne 0x5c8ea6
push str.Microsoft_Windows_NT_4.0
jmp 0x5c900d
cmp eax, 1
jne case.0x5c8e5e.7
push str.Microsoft_Windows_95
jmp 0x5c900d
mov eax, dword [ebp - 0x32c]
sub eax, 0
je 0x5c8f27
sub eax, 1
je 0x5c8f1d
sub eax, 1
jne case.0x5c8e5e.7
cmp byte [ebp - 0x106], 1
jne 0x5c8eef
cmp word [ebp - 0x358], 9
jne 0x5c8eef
push 0x66b2c0
jmp 0x5c900d
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x5c8f07
push 0x66b2e4
jmp 0x5c900d
push 0x59
call esi
test eax, eax
je case.0x5c8e5e.7
push 0x66b2f8
jmp 0x5c900d
push 0x66b2b4
jmp 0x5c900d
push 0x66b2a4
jmp 0x5c900d
mov eax, dword [ebp - 0x32c]
cmp eax, 3
ja case.default.0x5c8f40
jmp dword [eax*4 + 0x5c9044]
cmp byte [ebp - 0x106], 1
mov ecx, edi
jne 0x5c8f59
push 0x66b310
jmp 0x5c8fd5
push 0x66b320
jmp 0x5c8fd5
cmp byte [ebp - 0x106], 1
mov ecx, edi
jne 0x5c8f72
push 0x66b334
jmp 0x5c8fd5
push 0x66b340
jmp 0x5c8fd5
cmp byte [ebp - 0x106], 1
jne 0x5c8fb7
push 0
push 0
push 0xa
call fcn.005c9370
add esp, 0xc
test al, al
je 0x5c8fb0
cmp dword [ebp - 0x328], 0x55f0
mov ecx, edi
jb 0x5c8fa9
push 0x66b358
jmp 0x5c8fd5
push 0x66b364
jmp 0x5c8fd5
push 0x66b370
jmp 0x5c8fd3
push 0x66b37c
jmp 0x5c8fd3
cmp byte [ebp - 0x106], 1
jne 0x5c8fce
push 0x66b390
jmp 0x5c8fd3
push str.Windows_Server_2012_R2
mov ecx, edi
call fcn.004a8ec0
cmp dword [ebp - 0x32c], 0
jne case.0x5c8e5e.7
cmp byte [ebp - 0x106], 1
jne 0x5c9008
cmp dword [ebp - 0x328], 0x55f0
mov ecx, edi
jb 0x5c9001
push 0x66b358
jmp 0x5c900f
push 0x66b364
jmp 0x5c900f
push str.Windows_Server_2016_Technical_Preview
mov ecx, edi
call fcn.004a8ec0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005c950e
mov esp, ebp
pop ebp
ret 4
Function at 0x5c91a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push esi
mov esi, dword [ebp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREGuidGuidold
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x110], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5c92e4
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.guid
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5c92e4
push str._n_CPU_INFO:
call fcn.004cbc00
lea eax, [ebp - 0x108]
push eax
push str._s_n
call fcn.004cbc00
add esp, 0xc
cmp byte [ebp - 0x108], 0
jne 0x5c924d
xor ecx, ecx
jmp 0x5c925f
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c9256
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, ebx
push eax
call fcn.00491030
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.user_id
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5c92e4
push str._n_CPU_INFO:
call fcn.004cbc00
lea eax, [ebp - 0x108]
push eax
push str._s_n
call fcn.004cbc00
add esp, 0xc
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004a8ec0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c950e
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
xor ecx, ebp
pop ebx
call fcn.005c950e
mov esp, ebp
pop ebp
ret 8

Function at 0x5c9420
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 2
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREGuidGuidold
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x5c945c
or esi, 0xffffffff
jmp 0x5c94c9
push dword [ebp + 0x18]
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmovae eax, dword [ebp + 8]
push eax
push 1
push 0
push str.guid
push dword [ebp - 4]
call esi
test eax, eax
jne 0x5c9490
push str._self_run_success_n
call fcn.004cbc00
add esp, 4
push dword [ebp + 0x30]
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push eax
push 1
push 0
push str.user_id
push dword [ebp - 4]
call esi
test eax, eax
jne 0x5c94be
push str._self_run_success_n
call fcn.004cbc00
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x5c94de
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.004943f0
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
cmp ecx, 0x10
jb 0x5c9505
inc ecx
push ecx
push dword [ebp + 0x20]
lea ecx, [ebp + 0x20]
call fcn.004943f0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x30
Function at 0x5cc8eb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x601e15
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00601ad8

Function at 0x601e20
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00601c59

Function at 0x606087
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00605d47
Function at 0x405d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405d89
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405dc4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x405dc0
lea ebx, [ebx]
cmp esi, edx
jae 0x405dc4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x405db0
cmp esi, edx
jb 0x405dcb
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xf5d370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xf5d38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xf86074
push ecx
mov edi, eax
call fcn.00f71198
mov esi, eax
add esp, 8
test esi, esi
jne 0xf5d3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00f7102e
push esi
call fcn.00f70fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret