joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57b424
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
mov ebx, eax
call fcn.00402b8c
mov dword [ebx + 4], 1
mov dword [ebx + 8], 3
mov dword [ebx + 0xc], 7
mov dword [ebx + 0x10], 0xf
mov dword [ebx + 0x14], 0x1f
mov dword [ebx + 0x18], 0x3f
mov dword [ebx + 0x1c], 0x7f
mov dword [ebx + 0x20], 0xff
mov dword [ebx + 0x24], 0x1ff
mov dword [ebx + 0x28], 0x3ff
mov dword [ebx + 0x2c], 0x7ff
mov dword [ebx + 0x30], 0xfff
mov dword [ebx + 0x34], 0x1fff
mov dword [ebx + 0x38], 0x3fff
mov dword [ebx + 0x3c], 0x7fff
mov dword [ebx + 0x40], 0xffff
mov dword [ebx + 0x44], 0x1ffff
mov dword [ebx + 0x48], 0x3ffff
mov dword [ebx + 0x4c], 0x7ffff
mov dword [ebx + 0x50], 0xfffff
mov dword [ebx + 0x54], 0x1fffff
mov dword [ebx + 0x58], 0x3fffff
mov dword [ebx + 0x5c], 0x7fffff
mov dword [ebx + 0x60], 0xffffff
mov dword [ebx + 0x64], 0x1ffffff
mov dword [ebx + 0x68], 0x3ffffff
mov dword [ebx + 0x6c], 0x7ffffff
mov dword [ebx + 0x70], 0xfffffff
mov dword [ebx + 0x74], 0x1fffffff
mov dword [ebx + 0x78], 0x3fffffff
mov dword [ebx + 0x7c], 0x7fffffff
mov dword [ebx + 0x80], 1
mov dword [ebx + 0x84], 2
mov dword [ebx + 0x88], 4
mov dword [ebx + 0x8c], 8
mov dword [ebx + 0x90], 0x10
mov dword [ebx + 0x94], 0x20
mov dword [ebx + 0x98], 0x40
mov dword [ebx + 0x9c], 0x80
mov dword [ebx + 0xa0], pe_nt_image_headers32
mov dword [ebx + 0xa4], 0x200
mov dword [ebx + 0xa8], 0x400
mov dword [ebx + 0xac], 0x800
mov dword [ebx + 0xb0], 0x1000
mov dword [ebx + 0xb4], 0x2000
mov dword [ebx + 0xb8], 0x4000
mov dword [ebx + 0xbc], 0x8000
mov dword [ebx + 0xc0], 0x10000
mov dword [ebx + 0xc4], 0x20000
mov dword [ebx + 0xc8], 0x40000
mov dword [ebx + 0xcc], 0x80000
mov dword [ebx + 0xd0], 0x100000
mov dword [ebx + 0xd4], 0x200000
mov dword [ebx + 0xd8], 0x400000
mov dword [ebx + 0xdc], 0x800000
mov dword [ebx + 0xe0], 0x1000000
mov dword [ebx + 0xe4], 0x2000000
mov dword [ebx + 0xe8], 0x4000000
mov dword [ebx + 0xec], 0x8000000
mov dword [ebx + 0xf0], 0x10000000
mov dword [ebx + 0xf4], 0x20000000
mov dword [ebx + 0xf8], 0x40000000
pop ebx
ret

Function at 0x57d404
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x57d475
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x60e378]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x57d45f
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0057d3f4
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x57d200]
call fcn.0057d49c
mov dword [0x60e3dc], eax
mov eax, dword [ebp - 4]
call fcn.0057d3a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57d47c
lea eax, [ebp - 8]
call fcn.004063bc
ret
Function at 0x58054c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, dword [0x60eb5c]
xor eax, eax
push ebp
push 0x5805f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [edi]
call fcn.00404550
mov eax, edi
call fcn.004044b8
mov eax, dword [ebp - 4]
call fcn.00404778
mov ebx, eax
test ebx, ebx
jle 0x5805b9
mov esi, 1
mov eax, dword [ebp - 4]
mov al, byte [eax + esi - 1]
xor al, 0xd
and eax, 0xff
lea ecx, [ebp - 8]
mov edx, 2
call fcn.004097f0
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00404780
inc esi
dec ebx
jne 0x580590
mov ecx, dword [edi]
mov eax, edi
mov edx, 0x580610
call fcn.004047c4
lea edx, [ebp - 0xc]
mov eax, 0x3afc
call fcn.004096dc
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x580600
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004044dc
ret
Function at 0x5b6934
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404968
xor eax, eax
push ebp
push 0x5b69a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x1505
mov eax, dword [ebp - 4]
call fcn.00404778
test eax, eax
jle 0x5b6983
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
mov edi, ebx
shl edi, 5
add ebx, edi
add ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5b696c
mov edx, esi
mov eax, ebx
and eax, 0x7fffffff
call fcn.004096dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b69ae
lea eax, [ebp - 4]
call fcn.004044b8
ret
Function at 0x5c80a4
Capabilities:
Connect to http server
Create http request
Parse url
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1058], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404968
lea ebx, [ebp - 0xc50]
xor eax, eax
push ebp
push 0x5c82ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x3c
call fcn.00407bc4
lea eax, [ebp - 0xc12]
mov edx, 0xc06
call fcn.00407bc4
mov esi, 0x84000000
mov dword [ebx], 0x3c
lea eax, [ebp - 0xc12]
mov dword [ebx + 4], eax
mov dword [ebx + 8], 0x200
lea eax, [ebp - 0xa11]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], 0x200
lea eax, [ebp - 0x810]
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], 0x200
lea eax, [ebp - 0x60f]
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], 0x200
lea eax, [ebp - 0x40e]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0x200
lea eax, [ebp - 0x20d]
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], 0x200
mov eax, dword [ebp - 4]
call fcn.00404978
mov edx, 0x5c82dc
mov ecx, 7
call fcn.0040a0d8
test eax, eax
je 0x5c8190
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x5c82ec
call fcn.004047c4
push ebx
push 0x10000000
mov eax, dword [ebp - 4]
call fcn.00404778
push eax
mov eax, dword [ebp - 4]
call fcn.00404978
push eax
call sub.wininet.dll_InternetCrackUrlA
test eax, eax
je 0x5c82a1
push 0
push 0
push 0
push 0
push 0x5c82f4
call sub.wininet.dll_InternetOpenA
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, 0x5c8304
call fcn.00404550
test ebx, ebx
je 0x5c8296
push 0
push 0
push 3
push 0
push 0
push 0x50
lea eax, [ebp - 0xa11]
push eax
push ebx
call sub.wininet.dll_InternetConnectA
mov edi, eax
test edi, edi
je 0x5c8290
push 0
push esi
push 0x5c830c
push 0
push 0x5c8310
lea eax, [ebp - 0x40e]
push eax
push 0x5c831c
push edi
call sub.wininet.dll_HttpOpenRequestA
mov esi, eax
test esi, esi
je 0x5c828a
push 0
push 0
push 0
push 0
push esi
call sub.wininet.dll_HttpSendRequestA
test eax, eax
je 0x5c8284
lea eax, [ebp - 0xc]
call fcn.004044b8
lea eax, [ebp - 8]
push eax
push 0x401
lea eax, [ebp - 0x1051]
push eax
push esi
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 8], 0
je 0x5c8284
lea ecx, [ebp - 0x1058]
lea eax, [ebp - 0x1051]
mov edx, 0x400
call fcn.005c8028
mov edx, dword [ebp - 0x1058]
lea eax, [ebp - 0xc]
call fcn.00404780
jmp 0x5c8242
push esi
call sub.wininet.dll_InternetCloseHandle
push edi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.0040450c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c82d1
lea eax, [ebp - 0x1058]
call fcn.004044b8
lea eax, [ebp - 0xc]
call fcn.004044b8
lea eax, [ebp - 4]
call fcn.004044b8
ret
Function at 0x5c902c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404968
xor eax, eax
push ebp
push 0x5c9083
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404978
push eax
push 0x5c9090
mov eax, dword [0x60ece4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c908a
lea eax, [ebp - 4]
call fcn.004044b8
ret
Function at 0x5ca630
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
mov edx, 0x94
call fcn.00407bc4
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
xor eax, eax
cmp dword [esp + 0x10], 2
jne 0x5ca68d
mov edx, dword [esp + 4]
sub edx, 3
je 0x5ca669
dec edx
je 0x5ca66d
dec edx
je 0x5ca671
jmp 0x5ca6c1
mov al, 4
jmp 0x5ca6c1
mov al, 5
jmp 0x5ca6c1
mov edx, dword [esp + 8]
sub edx, 1
jb 0x5ca681
je 0x5ca685
dec edx
je 0x5ca689
jmp 0x5ca6c1
mov al, 6
jmp 0x5ca6c1
mov al, 7
jmp 0x5ca6c1
mov al, 8
jmp 0x5ca6c1
cmp dword [esp + 4], 4
jne 0x5ca69f
cmp dword [esp + 8], 0
jne 0x5ca69f
mov al, 1
jmp 0x5ca6c1
cmp dword [esp + 4], 4
jne 0x5ca6b1
cmp dword [esp + 8], 0xa
jne 0x5ca6b1
mov al, 2
jmp 0x5ca6c1
cmp dword [esp + 4], 4
jne 0x5ca6c1
cmp dword [esp + 8], 0x5a
jne 0x5ca6c1
mov al, 3
add esp, 0x94
ret

Function at 0x5ca7c4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404968
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x5ca932
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.004fbd10
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.004fbd30
jmp 0x5ca8fe
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404728
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409e4c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408f48
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408f48
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004048c4
je 0x5ca8de
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404728
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408f48
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408f48
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004048c4
jne 0x5ca8f5
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.004fbd50
test eax, eax
jne 0x5ca83f
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ca939
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004044dc
lea eax, [ebp - 4]
call fcn.004044b8
ret
Function at 0x5cb410
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, edx
mov esi, eax
mov eax, esi
call fcn.00404778
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
shl edx, 2
mov eax, ebp
call fcn.00404b04
mov eax, esi
call fcn.00404778
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edi, eax
test edi, edi
jle 0x5cb54e
mov ebx, 1
mov eax, esi
call fcn.00404778
lea edx, [ebx + ebx*2]
cmp eax, edx
jge 0x5cb48b
mov eax, esi
call fcn.00404778
mov ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
sub ecx, eax
mov edx, esp
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
call fcn.004029fc
jmp 0x5cb4a0
mov edx, esp
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
mov ecx, 3
call fcn.004029fc
mov al, byte [esp]
mov edx, eax
and dl, 0xfc
and edx, 0xff
shr edx, 2
mov ecx, 0x5cb5fc
mov dl, byte [ecx + edx]
mov byte [esp + 3], dl
and al, 3
and eax, 0xff
shl eax, 4
mov dl, byte [esp + 1]
and dl, 0xf0
and edx, 0xff
shr edx, 4
or eax, edx
mov edx, 0x5cb5fc
mov al, byte [edx + eax]
mov byte [esp + 4], al
mov dl, byte [esp + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov al, byte [esp + 2]
mov ecx, eax
and cl, 0xc0
and ecx, 0xff
shr ecx, 6
or edx, ecx
mov ecx, 0x5cb5fc
mov dl, byte [ecx + edx]
mov byte [esp + 5], dl
and al, 0x3f
and eax, 0xff
mov edx, 0x5cb5fc
mov al, byte [edx + eax]
mov byte [esp + 6], al
mov eax, ebp
call fcn.004049d0
mov edx, ebx
dec edx
shl edx, 2
lea edx, [eax + edx]
lea eax, [esp + 3]
mov ecx, 4
call fcn.004029fc
inc ebx
dec edi
jne 0x5cb45a
mov eax, esi
call fcn.00404778
mov ecx, 3
cdq
idiv ecx
dec edx
jne 0x5cb5a9
mov eax, dword [ebp]
call fcn.00404778
mov ebx, eax
mov eax, ebp
call fcn.004049d0
mov byte [eax + ebx - 2], 0x3d
mov eax, dword [ebp]
call fcn.00404778
mov ebx, eax
mov eax, ebp
call fcn.004049d0
mov byte [eax + ebx - 1], 0x3d
push ebp
mov eax, dword [ebp]
call fcn.00404778
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp]
mov edx, 1
call fcn.004049d8
jmp 0x5cb5ec
mov eax, esi
call fcn.00404778
mov ecx, 3
cdq
idiv ecx
cmp edx, 2
jne 0x5cb5ec
mov eax, dword [ebp]
call fcn.00404778
mov ebx, eax
mov eax, ebp
call fcn.004049d0
mov byte [eax + ebx - 1], 0x3d
push ebp
mov eax, dword [ebp]
call fcn.00404778
mov ecx, eax
dec ecx
mov eax, dword [ebp]
mov edx, 1
call fcn.004049d8
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5cbe64
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x558], eax
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x54c], eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x538], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5cc086
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push 0x3ff
lea eax, [ebp - 0x534]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov ecx, eax
lea edx, [ebp - 0x534]
lea eax, [ebp - 0xc]
call fcn.004045a8
lea eax, [ebp - 0xc]
mov edx, 0x5cc09c
call fcn.00404550
lea edx, [ebp - 0x538]
mov eax, 0x5cc0a8
call fcn.005cbdec
mov edx, dword [ebp - 0x538]
lea eax, [ebp - 0xc]
call fcn.00404780
xor edx, edx
mov eax, 2
call fcn.004fbd10
mov ebx, eax
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, ebx
call fcn.004fbd30
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x5cc022
lea eax, [ebp - 0x540]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.00404728
mov eax, dword [ebp - 0x540]
lea edx, [ebp - 0x53c]
call fcn.00408f48
mov eax, dword [ebp - 0x53c]
push eax
lea edx, [ebp - 0x54c]
xor eax, eax
call fcn.00402b28
mov eax, dword [ebp - 0x54c]
lea edx, [ebp - 0x548]
call fcn.00409e4c
mov eax, dword [ebp - 0x548]
lea edx, [ebp - 0x544]
call fcn.00408f48
mov edx, dword [ebp - 0x544]
pop eax
call fcn.004048c4
jne 0x5cbfc5
mov eax, dword [ebp - 0x11c]
mov esi, eax
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
jmp 0x5cc005
lea eax, [ebp - 0x554]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.00404728
mov eax, dword [ebp - 0x554]
lea edx, [ebp - 0x550]
call fcn.00408f48
mov eax, dword [ebp - 0x550]
mov edx, dword [ebp - 0xc]
call fcn.004048c4
jne 0x5cc005
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, ebx
call fcn.004fbd50
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5cbf40
cmp esi, dword [ebp - 8]
je 0x5cc059
lea edx, [ebp - 0x558]
mov eax, 0x5cc0d0
call fcn.005cbdec
mov eax, dword [ebp - 0x558]
call fcn.00409c58
test al, al
jne 0x5cc059
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
mov byte [0x61e12a], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5cc08d
lea eax, [ebp - 0x558]
mov edx, 9
call fcn.004044dc
lea eax, [ebp - 0xc]
call fcn.004044b8
ret
Function at 0x5cc8b8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x5cc8c0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404968
mov eax, dword [ebp - 8]
call fcn.00404968
xor eax, eax
push ebp
push 0x5cca2d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov ecx, 0x5cca48
mov edx, dword [ebp - 4]
call fcn.004047c4
lea eax, [ebp - 0x10]
mov edx, dword [0x61e1b8]
call fcn.00404550
xor eax, eax
push ebp
push 0x5cc9dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00409c58
test al, al
je 0x5cc92f
mov eax, dword [ebp - 0xc]
call fcn.00409d80
lea edx, [ebp - 0x24]
mov eax, 0x5cca58
call fcn.004ac958
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.00415b1c
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea edx, [ebp - 0x38]
mov ecx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a674
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea edx, [ebp - 0x38]
mov ecx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a674
mov eax, dword [ebp - 0x3c]
push eax
push 0x5cca68
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.004112f8
add esp, 0x14
push 0
mov eax, dword [ebp - 4]
call fcn.00404978
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404978
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 0xc]
call fcn.00409d80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5cc9f0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5cca34
lea eax, [ebp - 0x3c]
call fcn.004044b8
lea eax, [ebp - 0x28]
call fcn.004044b8
lea eax, [ebp - 0x24]
call fcn.004063bc
lea eax, [ebp - 0x20]
call fcn.004112f0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004044dc
ret
Function at 0x5cd918
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404968
mov eax, dword [ebp - 8]
call fcn.00404968
mov eax, dword [ebp - 0xc]
call fcn.00404968
mov eax, dword [ebp + 0x14]
call fcn.00404968
mov eax, dword [ebp + 0x10]
call fcn.00404968
mov eax, dword [ebp + 0xc]
call fcn.00404968
xor eax, eax
push ebp
push 0x5cdac2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x5cdad8
call fcn.00409c68
test al, al
jne 0x5cd98b
mov eax, 0x5cdad8
call fcn.00409f7c
lea eax, [ebp - 0x10]
mov ecx, 0x5cdaec
mov edx, dword [0x61e0e4]
call fcn.004047c4
mov eax, dword [ebp - 0x10]
call fcn.00409c58
test al, al
je 0x5cd9c5
lea eax, [ebp - 0x14]
mov ecx, 0x5cdaec
mov edx, dword [0x61e0e4]
call fcn.004047c4
mov eax, dword [ebp - 0x14]
call fcn.00409d80
lea eax, [ebp - 0x18]
mov ecx, 0x5cdaec
mov edx, dword [0x61e0e4]
call fcn.004047c4
mov ecx, dword [ebp - 0x18]
mov edx, 0x5cdad8
mov eax, 0x5cdb0c
call fcn.005cd8b0
push dword [0x61e0e4]
push 0x5cdb18
push 0x5cdb2c
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404838
mov eax, dword [ebp - 0x1c]
call fcn.00409c58
test al, al
je 0x5cda90
push 1
push dword [0x61e0e4]
push 0x5cdb18
push 0x5cdb2c
push 0x5cdb44
push dword [ebp - 4]
push 0x5cdb54
push dword [ebp - 8]
push 0x5cdb54
push dword [ebp - 0xc]
push 0x5cdb54
push dword [ebp + 0x14]
push 0x5cdb54
push dword [ebp + 0x10]
push 0x5cdb54
push dword [ebp + 0xc]
push 0x5cdb54
lea eax, [ebp - 0x20]
mov edx, 0x10
call fcn.00404838
mov eax, dword [ebp - 0x20]
call fcn.00404978
push eax
call sub.kernel32.dll_WinExec
cmp byte [ebp + 8], 0
je 0x5cda9a
mov eax, dword [0x60ece4]
mov eax, dword [eax]
call fcn.00492d48
push 0
call sub.kernel32.dll_ExitProcess_1
mov eax, dword [0x61e0e8]
call fcn.005c902c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5cdac9
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004044dc
lea eax, [ebp + 0xc]
mov edx, 3
call fcn.004044dc
ret

Function at 0x5ce2d8
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffa8
mov esi, ecx
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x44
call fcn.00402e40
mov dword [esp + 4], 0x44
mov dword [esp + 0x30], 1
mov word [esp + 0x34], si
mov eax, dword [0x60ece4]
mov eax, dword [eax]
call fcn.00492ab0
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
push ebx
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x5ce33b
xor eax, eax
mov dword [esp], eax
jmp 0x5ce374
mov eax, dword [0x60ece4]
mov eax, dword [eax]
call fcn.00492ab0
push 0x64
mov eax, dword [esp + 0x4c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov ebx, eax
mov eax, dword [0x60ece4]
mov eax, dword [eax]
call fcn.00492ab0
cmp ebx, 0x102
je 0x5ce347
push esp
mov eax, dword [esp + 0x4c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [esp]
add esp, 0x58
pop esi
pop ebx
ret
Function at 0x5e250c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404968
xor eax, eax
push ebp
push 0x5e257f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x1505
mov eax, dword [ebp - 4]
call fcn.00404778
test eax, eax
jle 0x5e255b
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
mov edi, ebx
shl edi, 5
add ebx, edi
add ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5e2544
mov edx, esi
mov eax, ebx
and eax, 0x7fffffff
call fcn.004096dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e2586
lea eax, [ebp - 4]
call fcn.004044b8
ret

Function at 0x5f8cb8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x101c], ecx
mov dword [ebp - 0x1020], ecx
mov dword [ebp - 0x1014], ecx
mov dword [ebp - 0x1018], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5f8e65
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5f8d41
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 5
mov edi, 0x60e3e4
push 0
mov eax, dword [edi]
call fcn.00404978
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_FindWindowExA
mov dword [ebp - 0xc], eax
add edi, 4
dec esi
jne 0x5f8d19
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5f8d4d
test bl, bl
je 0x5f8e3f
push 0
push 0
push 0xe
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x1010]
push edx
inc eax
push eax
push 0xd
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
call fcn.00404728
push 0x1001
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
call fcn.00404728
lea edx, [ebp - 0x1014]
mov eax, dword [ebp - 0x10]
call fcn.00408f48
mov eax, dword [ebp - 0x1014]
push eax
lea edx, [ebp - 0x1018]
mov eax, 0x5f8e80
call fcn.00408f48
mov eax, dword [ebp - 0x1018]
pop edx
call fcn.00404abc
mov esi, eax
test esi, esi
jle 0x5f8e20
lea eax, [ebp - 0x1020]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.004049d8
mov eax, dword [ebp - 0x1020]
lea edx, [ebp - 0x101c]
call fcn.00409198
mov edx, dword [ebp - 0x101c]
lea eax, [ebp - 0x10]
call fcn.00404550
mov eax, dword [ebp - 8]
push dword [eax]
push 0x5f8ea8
push dword [ebp - 0x10]
push 0x5f8eb4
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00404838
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f8e6c
lea eax, [ebp - 0x1020]
mov edx, 4
call fcn.004044dc
lea eax, [ebp - 0x10]
call fcn.004044b8
ret