joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56b6e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.USER32.DLL_GetMessagePos
call fcn.00509484
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00565704
test ebx, ebx
jne 0x56b733
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0056b55c
mov ebx, eax
test ebx, ebx
je 0x56b829
cmp esi, ebx
je 0x56b75c
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x56b771
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x56b7a9
add eax, 0xffffff5f
sub eax, 2
jb 0x56b7c1
dec eax
sub eax, 2
jb 0x56b7d5
dec eax
sub eax, 2
jb 0x56b7cb
jmp 0x56b7df
add eax, 0xfffffdff
sub eax, 2
jb 0x56b7c1
dec eax
sub eax, 2
jb 0x56b7d5
dec eax
sub eax, 2
jb 0x56b7cb
jmp 0x56b7df
mov byte [esp + 0x120], 0
jmp 0x56b7e7
mov byte [esp + 0x120], 2
jmp 0x56b7e7
mov byte [esp + 0x120], 1
jmp 0x56b7e7
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.USER32.DLL_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00547174
mov esi, eax
call fcn.00562038
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.005670dc
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x56b82b
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x579e10
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x579e3e
mov eax, ebx
call fcn.0057a8c4
cmp dword [ebx + 0x40], 0
je 0x579e37
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x579eaf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x579ea1
cmp dword [ebx + 8], 0
je 0x579e60
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x579e72
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x579ea1
cmp dword [ebx + 8], 0
je 0x579e53
cmp eax, 3
je 0x579e85
dec eax
jne 0x579e53
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x579e53
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x579e53
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x579ecd
cmp dword [ebx + 0x14], 0xcc
je 0x579ecd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00579ed8
pop ebx
ret
Function at 0x58ff2c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x6001d8
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x58ff4e
shr eax, 1
xor eax, 0xedb88320
jmp 0x58ff50
shr eax, 1
dec edx
jne 0x58ff3c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x58ff35
mov byte [0x6005d8], 1
pop esi
pop ebx
ret

Function at 0x58ff6c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x6005d8], 0
jne 0x58ff83
call fcn.0058ff2c
mov eax, edi
dec eax
test eax, eax
jl 0x58ffab
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x6001d8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x58ff8d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x592d38
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x592dd2.0
jmp dword [ecx*4 + 0x592d6b]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x592d9d
sub dl, 8
je 0x592dac
jmp case.0x592dd2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5929e0
jmp case.0x592dd2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x592a38
jmp case.0x592dd2.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x592dd2.0
movzx ecx, byte [ecx + 0x592dd9]
jmp dword [ecx*4 + 0x592dea]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x592ae4
jmp case.0x592dd2.0
cmp dl, 3
jne 0x592e17
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x592b3c
jmp case.0x592dd2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x592af8
jmp case.0x592dd2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x592b80
jmp case.0x592dd2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x592e42
sub dl, 8
je 0x592e4e
jmp case.0x592dd2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x592bac
jmp case.0x592dd2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x592c18
jmp case.0x592dd2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x592e6d
sub dl, 8
je 0x592e79
jmp case.0x592dd2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x592cd4
jmp case.0x592dd2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x592cfc
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x592f1b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00591ee4
test eax, eax
je 0x592f1b
mov eax, ebx
call fcn.00592f24
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x592eb4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x592f24
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x592f55
dec al
je 0x592f90
dec al
je 0x592fd5
dec al
je 0x59303e
jmp 0x5930c8
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5930c8
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x592f65
jmp 0x5930c8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5930c8
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x592fa0
jmp 0x5930c8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5930c8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x593004
xor ebp, ebp
jmp 0x593014
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x59301d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x592fe5
jmp 0x5930c8
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5930c8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x593097
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0058ffb4
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x593052
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5a3558
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x5a3574
call fcn.005a4924
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x5a3593
test bl, 1
je 0x5a3593
call fcn.005abd24
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x5a3774
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.005a44a0
test byte [ebp + 0xd], 0xc0
jne 0x5a3798
mov eax, dword [0x5f7768]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x5a37a5
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x5a37d2
je 0x5a37e4
sub ecx, 0x100
je 0x5a37f6
sub ecx, 0x100
je 0x5a37ff
sub ecx, 0x100
je 0x5a37ed
jmp 0x5a3808
sub ecx, 0x600
je 0x5a37ff
sub ecx, 0x100
je 0x5a37e4
jmp 0x5a3808
mov dword [ebp - 8], 1
jmp 0x5a380f
mov dword [ebp - 8], 2
jmp 0x5a380f
mov dword [ebp - 8], 4
jmp 0x5a380f
mov dword [ebp - 8], 5
jmp 0x5a380f
mov dword [ebp - 8], 3
test byte [ebp + 0xd], 1
je 0x5a3836
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5f71e0]
test al, 0x80
je 0x5a382f
mov ebx, 0x80
jmp 0x5a3848
mov ebx, 1
jmp 0x5a3848
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x5a3848
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x5a385a
je 0x5a3863
dec eax
je 0x5a386c
jmp 0x5a3875
mov dword [ebp - 4], connect
jmp 0x5a3884
mov dword [ebp - 4], 0x40000000
jmp 0x5a3884
mov dword [ebp - 4], 0xc0000000
jmp 0x5a3884
push 1
call fcn.005a48b8
pop ecx
mov ebx, eax
jmp 0x5a3984
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x5a38a0
sub eax, 0x10
je 0x5a38a4
sub eax, 0x10
je 0x5a38ab
sub eax, 0x10
je 0x5a38b2
jmp 0x5a38b2
xor edi, edi
jmp 0x5a38b7
mov edi, 1
jmp 0x5a38b7
mov edi, 2
jmp 0x5a38b7
mov edi, 3
test byte [ebp + 0xc], 4
je 0x5a38cf
cmp dword [ebp - 4], 0x80000000
jne 0x5a38cd
mov edi, 1
jmp 0x5a38cf
xor edi, edi
mov dword [ebp - 0x14], 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
and edx, 0x80
cmp edx, 1
sbb ecx, ecx
neg ecx
mov dword [ebp - 0xc], ecx
push 0
push ebx
mov ecx, dword [ebp - 8]
push ecx
lea eax, [ebp - 0x14]
push eax
push edi
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x5a393d
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x5a3932
test byte [ebp + 0xd], 1
je 0x5a392d
mov ebx, 0x50
jmp 0x5a3932
mov ebx, 2
push ebx
call fcn.005a48b8
pop ecx
mov ebx, eax
jmp 0x5a3984
mov edi, esi
push edi
call fcn.005a36d8
pop ecx
test eax, eax
je 0x5a3951
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x5a395d
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.005a45e0
add esp, 8
mov ebx, eax
inc eax
jne 0x5a3984
push 4
call fcn.005a48b8
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.005a44d4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a7f2c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x5f8493
lea ecx, [ebp - 0x200]
push ecx
call fcn.005a22a4
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
call fcn.005a2354
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.005a2354
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x5f8495
lea ecx, [ebp - 0x200]
push ecx
call fcn.005a22a4
add esp, 8
push 0xa
lea ecx, [ebp - 0x200]
push ecx
call fcn.005a2354
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov eax, dword [ebx]
push eax
call fcn.005a9414
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x5a803d
push esi
call fcn.005a2354
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.005a2354
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.005a13a0
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x5a8014
xor eax, eax
jmp 0x5a80c4
push esi
call fcn.005a2354
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.005a2354
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.005a21d3
add esp, 0xc
jmp 0x5a807d
mov edi, dword [ebx + 0x24]
push edi
call fcn.005a2354
pop ecx
push eax
push esi
call fcn.005a2354
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.005a2354
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.005a13c0
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x5a807d
xor eax, eax
jmp 0x5a80c4
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.005a22a4
add esp, 8
push 0x5f8497
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.005a22a4
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call fcn.005a22a4
add esp, 8
push 0x5f8499
mov edx, dword [ebx + 0x24]
push edx
call fcn.005a22a4
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5abcb8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x5abce5
jmp 0x5abd1c
call fcn.005abc68
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.005a2354
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.005a2354
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5abda0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x5f8b58], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x5abe7a
cmp dword [0x5f8b54], 0
jne 0x5abe7a
cmp dword [0x5f8d54], 0
je 0x5abe34
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.005ab770
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5abe1a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.005ab770
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5abe1a
lea ebx, [ebp - 0x84]
jmp 0x5abe1b
inc ebx
call fcn.005abd58
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x5abeb5
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x5f8b5c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.005a2354
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x5f8b5f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x5abeb5
cmp dword [0x5f8b54], 0
je 0x5abe94
cmp dword [0x5f8b54], 0xffffffff
je 0x5abeb5
push esi
call dword [0x5f8b54]
pop ecx
mov eax, dword [0x5f8b58]
test eax, eax
je 0x5abeb5
cmp dword [0x5f8b58], 0xffffffff
je 0x5abeb5
cmp byte [eax], 0
je 0x5abeb5
push esi
push eax
call fcn.005abcb8
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ac7c4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x600e4c], 0
jne 0x5ac845
cmp dword [0x600e6c], 0
jne 0x5ac7f4
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x600e6c], eax
test eax, eax
jne 0x5ac7f4
push str.GetEnvironmentStrings_failed
call fcn.005abecc
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x600e6c]
jmp 0x5ac808
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.005a2354
pop ecx
mov edi, eax
test eax, eax
jne 0x5ac800
lea edi, [ebp + 1]
push edi
call fcn.005a13a0
pop ecx
mov ebx, eax
mov dword [0x600e50], ebx
test ebx, ebx
jne 0x5ac832
xor eax, eax
jmp 0x5ac908
push edi
mov edx, dword [0x600e6c]
push edx
push ebx
call fcn.005a2008
add esp, 0xc
jmp 0x5ac865
xor esi, esi
mov ebx, dword [0x600e4c]
jmp 0x5ac85f
push eax
call fcn.005a2354
pop ecx
test eax, eax
jne 0x5ac85b
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x5ac84f
lea ebx, [esi + 4]
push 4
mov dword [0x600e54], ebx
inc ebx
push ebx
call fcn.005a1304
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x5ac888
xor eax, eax
jmp 0x5ac908
cmp dword [0x600e4c], 0
jne 0x5ac8b9
xor esi, esi
mov ebx, dword [0x600e50]
mov eax, dword [esp]
mov ebp, eax
jmp 0x5ac8aa
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.005a2354
pop ecx
mov edi, eax
test eax, eax
jne 0x5ac8a0
jmp 0x5ac8ea
xor esi, esi
mov ebx, dword [0x600e4c]
mov eax, dword [esp]
mov edi, eax
jmp 0x5ac8e4
push eax
call fcn.005a2354
pop ecx
test eax, eax
je 0x5ac8d9
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x5ac8dd
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x5ac8c8
mov eax, dword [0x600e4c]
test eax, eax
je 0x5ac8fa
push eax
call fcn.005a13b0
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x600e4c], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5ad418
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x5ad43e
test esi, esi
je 0x5ad43e
call fcn.005abd24
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x5ad4b0
call fcn.005ad11c
mov ebx, eax
test eax, eax
jne 0x5ad459
call fcn.005abd24
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x5ad4b0
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebx + 4], edx
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ebx + 0x58], ecx
push eax
mov edx, dword [ebp + 0x18]
push edx
push ebx
push 0x5ad374
push esi
mov ecx, dword [ebp + 0x14]
push ecx
call sub.KERNEL32.DLL_CreateThread
test eax, eax
jne 0x5ad4a4
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x5ad49d
push 0x59
call fcn.005a48b8
pop ecx
jmp 0x5ad4b0
call fcn.005a4924
jmp 0x5ad4b0
mov dword [ebx + 8], eax
test edi, edi
je 0x5ad4b0
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5b01b0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.0050fdf8
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4f4411
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4f440b
test ah, 4
je 0x4f440b
test al, 0x10
je 0x4f440b
mov eax, esi
call fcn.0050fdf8
push eax
call sub.KERNEL32.DLL_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4f4411
push edi
call sub.KERNEL32.DLL_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
jmp 0x4f43bc
Function at 0x401260
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push 0x20
call dword [0x40d050]
push eax
call dword [0x40d00c]
test eax, eax
je 0x4012ad
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push 0
call dword [0x40d004]
test eax, eax
jne 0x4012be
push dword [ebp - 0x20]
call dword [0x40d024]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401da9
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [0x40d008]
push dword [ebp - 0x20]
mov esi, eax
call dword [0x40d024]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401da9
mov esp, ebp
pop ebp
ret

Function at 0x4017f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x401910
push esi
mov esi, dword [edx + 0x3c]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi - 0x148]
cmp esi, eax
ja 0x40190e
add edx, esi
cmp dword [edx], 0x4550
jne 0x40190e
movzx eax, word [edx + 4]
mov esi, 0x14c
push ebx
cmp ax, si
jne 0x40189d
movzx ebx, word [edx + 0x14]
mov dword [edx + 0x34], ecx
movzx ecx, word [edx + 6]
mov esi, ecx
lea eax, [esi*4 + 0xb]
add eax, esi
lea eax, [ebx + eax*8]
cmp edi, eax
jb 0x40190d
xor eax, eax
cmp ax, cx
jae 0x401875
lea ecx, [edx + 0x2c]
add ecx, ebx
mov eax, dword [ecx - 8]
lea ecx, [ecx + 0x28]
mov dword [ecx - 0x28], eax
mov eax, dword [ecx - 0x34]
mov dword [ecx - 0x2c], eax
sub esi, 1
jne 0x401861
cmp dword [edx + 0x74], 5
jbe 0x40190d
pop ebx
pop edi
mov dword [edx + 0xa0], 0
mov dword [edx + 0xa4], 0
or word [edx + 0x16], 1
pop esi
pop ebp
ret
mov esi, 0x8664
cmp ax, si
jne 0x40190d
movzx ebx, word [edx + 0x14]
mov dword [edx + 0x30], ecx
movzx ecx, word [edx + 6]
mov esi, ecx
mov dword [edx + 0x34], 0
lea eax, [esi*4 + 0xb]
add eax, esi
lea eax, [ebx + eax*8]
cmp edi, eax
jb 0x40190d
xor eax, eax
cmp ax, cx
jae 0x4018eb
lea ecx, [edx + 0x2c]
add ecx, ebx
mov eax, dword [ecx - 8]
lea ecx, [ecx + 0x28]
mov dword [ecx - 0x28], eax
mov eax, dword [ecx - 0x34]
mov dword [ecx - 0x2c], eax
sub esi, 1
jne 0x4018d7
cmp dword [edx + 0x84], 5
jbe 0x40190d
mov dword [edx + 0xb0], 0
mov dword [edx + 0xb4], 0
or word [edx + 0x16], 1
pop ebx
pop edi
pop esi
pop ebp
ret