joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e05dc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5e071d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5e0638
inc ebx
xor esi, esi
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.00404844
inc eax
add dword [ebp - 0x18], eax
inc esi
dec ebx
jne 0x5e061b
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
call fcn.0040280c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5e06fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5e069c
inc ebx
xor esi, esi
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00404a44
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcpyA
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrlenA_1
inc eax
add dword [ebp - 0x10], eax
inc esi
dec ebx
jne 0x5e066c
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 7
push 0
mov eax, dword [ebp - 8]
call fcn.00404a44
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x5e06e5
mov ecx, 0x5e0734
mov dl, 1
mov eax, dword [0x408468]
call fcn.0040e550
call fcn.00403ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e0702
mov eax, dword [ebp - 0x14]
call fcn.0040282c
ret
Function at 0x5e0da8
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5e0fbd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x18], eax
cmp bl, 1
cmc
sbb edi, edi
push edi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.iphlpapi.dll_GetIpForwardTable
mov esi, eax
cmp esi, 0x7a
jne 0x5e0e31
mov eax, dword [ebp - 0x14]
call fcn.0040280c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5e0e31
mov ecx, 0x5e0fd4
mov dl, 1
mov eax, dword [0x408468]
call fcn.0040e550
call fcn.00403ef0
xor eax, eax
push ebp
push 0x5e0f9b
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.iphlpapi.dll_GetIpForwardTable
mov esi, eax
test esi, esi
je 0x5e0e69
mov ecx, 0x5e0ff4
mov dl, 1
mov eax, dword [0x408468]
call fcn.0040e550
call fcn.00403ef0
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
dec edi
test edi, edi
jl 0x5e0edb
inc edi
xor ebx, ebx
mov esi, ebx
shl esi, 3
sub esi, ebx
mov eax, dword [ebp - 0xc]
cmp dword [eax + esi*8 + 4], 0
jne 0x5e0ed7
cmp dword [ebp - 0x10], 0
jne 0x5e0e9a
mov eax, 0x38
call fcn.0040280c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
lea edx, [eax + esi*8 + 4]
mov ecx, 0x38
mov eax, dword [ebp - 0x10]
call fcn.00407db0
mov eax, dword [ebp - 0xc]
lea eax, [eax + esi*8 + 4]
push eax
call sub.iphlpapi.dll_DeleteIpForwardEntry
mov esi, eax
test esi, esi
je 0x5e0ed7
mov ecx, 0x5e1018
mov dl, 1
mov eax, dword [0x408468]
call fcn.0040e550
call fcn.00403ef0
inc ebx
dec edi
jne 0x5e0e76
cmp dword [ebp - 0x10], 0
je 0x5e0f77
cmp dword [ebp - 0x18], 0
je 0x5e0f77
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x10]
push eax
call sub.iphlpapi.dll_SetIpForwardEntry
mov esi, eax
cmp esi, 0x490
jne 0x5e0f16
mov eax, dword [ebp - 0x10]
push eax
call sub.iphlpapi.dll_CreateIpForwardEntry
mov esi, eax
test esi, esi
je 0x5e0f69
cmp esi, 0x57
jne 0x5e0f37
mov ecx, 0x5e1040
mov dl, 1
mov eax, dword [0x408468]
call fcn.0040e550
call fcn.00403ef0
jmp 0x5e0f69
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00409a28
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x5e105c
call fcn.00404890
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x408468]
call fcn.0040e550
call fcn.00403ef0
cmp byte [ebp - 5], 0
je 0x5e0f77
mov eax, dword [ebp - 4]
call fcn.005e0a5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e0fa2
mov eax, dword [ebp - 0xc]
call fcn.0040282c
cmp dword [ebp - 0x10], 0
je 0x5e0f9a
mov eax, dword [ebp - 0x10]
call fcn.0040282c
ret
Function at 0x5e1064
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
cmp bl, 1
cmc
sbb esi, esi
push esi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x5e10bd
mov eax, dword [ebp - 0xc]
call fcn.0040280c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5e10bd
mov ecx, 0x5e1154
mov dl, 1
mov eax, dword [0x408468]
call fcn.0040e550
call fcn.00403ef0
xor ecx, ecx
push ebp
push 0x5e113c
push dword fs:[ecx]
mov dword fs:[ecx], esp
push esi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.iphlpapi.dll_GetIpForwardTable
test eax, eax
je 0x5e10f3
mov ecx, 0x5e1174
mov dl, 1
mov eax, dword [0x408468]
call fcn.0040e550
call fcn.00403ef0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
cmp eax, 0
jl 0x5e1126
mov edx, eax
shl edx, 3
sub edx, eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + edx*8 + 4], 0
jne 0x5e1120
mov eax, dword [ebp - 8]
mov eax, dword [eax + edx*8 + 0x10]
mov dword [ebp - 4], eax
call fcn.00403f9c
jmp 0x5e1143
dec eax
cmp eax, 0xffffffff
jne 0x5e10fe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e1143
mov eax, dword [ebp - 8]
call fcn.0040282c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5e1190
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
cmp bl, 1
cmc
sbb esi, esi
push esi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x5e11e9
mov eax, dword [ebp - 0xc]
call fcn.0040280c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5e11e9
mov ecx, 0x5e1280
mov dl, 1
mov eax, dword [0x408468]
call fcn.0040e550
call fcn.00403ef0
xor edx, edx
push ebp
push 0x5e1268
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.iphlpapi.dll_GetIpForwardTable
test eax, eax
je 0x5e121f
mov ecx, 0x5e12a0
mov dl, 1
mov eax, dword [0x408468]
call fcn.0040e550
call fcn.00403ef0
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
dec ebx
test ebx, ebx
jl 0x5e1244
inc ebx
xor esi, esi
mov eax, esi
shl eax, 3
sub eax, esi
mov edx, dword [ebp - 4]
lea eax, [edx + eax*8 + 4]
push eax
call sub.iphlpapi.dll_DeleteIpForwardEntry
inc esi
dec ebx
jne 0x5e122c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e126f
mov eax, dword [ebp - 4]
call fcn.0040282c
cmp dword [ebp - 8], 0
je 0x5e1267
mov eax, dword [ebp - 8]
call fcn.0040282c
ret
Function at 0x5e18cc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x5e19a3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5e19b4
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x5e1988
push 0x5e19c4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov edi, eax
test edi, edi
je 0x5e1982
push 0x5e19c4
call sub.kernel32.dll_OutputDebugStringA
lea eax, [esi + 0x48]
push eax
push 0
push esi
push 0x5e1820
push 2
call edi
mov edi, eax
mov eax, edi
xor edx, edx
push edx
push eax
lea eax, [ebp - 8]
call fcn.00409a28
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x5e19e4
call fcn.00404890
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [esi + 0x48]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.00409a28
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x5e19f4
call fcn.00404890
mov eax, dword [ebp - 0xc]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
push ebx
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e19aa
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404598
ret

Function at 0x5e2194
Capabilities:
Create process on windows

Disassembly:
push ebx
push ecx
mov ebx, eax
cmp dword [ebx + 0x48], 0
je 0x5e21b7
push 0
mov eax, dword [ebx + 0x48]
call fcn.00404a44
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
seta byte [esp]
jmp 0x5e21ce
cmp word [ebx + 0x72], 0
je 0x5e21ca
mov ecx, esp
mov edx, ebx
mov eax, dword [ebx + 0x74]
call dword [ebx + 0x70]
jmp 0x5e21ce
mov byte [esp], 0
mov al, byte [esp]
pop edx
pop ebx
ret

Function at 0x5e4ad4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e4bd5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.00474e9c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040a320
lea eax, [ebp - 4]
mov edx, 0x5e4bec
call fcn.0040484c
mov eax, dword [ebp - 4]
call fcn.00409f98
test al, al
je 0x5e4bb1
test di, di
jg 0x5e4b55
push dword [ebp - 4]
push 0x5e4c00
push esi
push 0x5e4c18
push ebx
push 0x5e4c24
lea eax, [ebp - 4]
mov edx, 6
call fcn.00404904
jmp 0x5e4b89
push dword [ebp - 4]
push 0x5e4c30
lea edx, [ebp - 0xc]
movsx eax, di
call fcn.0040993c
push dword [ebp - 0xc]
push 0x5e4c44
push esi
push 0x5e4c18
push ebx
push 0x5e4c24
lea eax, [ebp - 4]
mov edx, 8
call fcn.00404904
mov eax, dword [ebp - 4]
call fcn.00404a44
mov ebx, eax
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.0040477c
mov eax, dword [ebp - 0x10]
mov dl, 6
call fcn.004f14f4
push 5
push ebx
call sub.kernel32.dll_WinExec
jmp 0x5e4bba
mov edx, esi
mov eax, ebx
call fcn.005e4a18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e4bdc
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404598
ret
Function at 0x5e4e8c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e4f3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.00474e9c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040a320
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x5e4f54
call fcn.00404890
mov eax, dword [ebp - 4]
call fcn.00409f98
test al, al
je 0x5e4f23
push dword [ebp - 4]
push 0x5e4f68
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0040993c
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404904
push 0
mov eax, dword [ebp - 4]
call fcn.00404a44
mov ebx, eax
push ebx
call sub.kernel32.dll_WinExec
mov edx, ebx
lea eax, [ebp - 0x14]
call fcn.0040477c
mov eax, dword [ebp - 0x14]
call fcn.005e48e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e4f45
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404598
ret
Function at 0x5e4fbc
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x444], ebx
mov byte [ebp - 2], cl
mov edi, edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x1c]
xor eax, eax
push ebp
push 0x5e51aa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x444]
movsx eax, bl
call fcn.0040993c
mov ecx, dword [ebp - 0x444]
lea eax, [ebp - 0x440]
mov edx, 0x5e51c4
call fcn.00404890
mov eax, dword [ebp - 0x440]
call fcn.00404a44
mov edx, eax
lea eax, [ebp - 0x43c]
call fcn.0040477c
mov eax, dword [ebp - 0x43c]
mov dl, 6
call fcn.004f14f4
cmp dword [0x659228], 0
je 0x5e518c
mov eax, dword [0x659228]
mov eax, dword [eax + 0x448]
cmp byte [eax + 0x30], 0
je 0x5e518c
lea eax, [ebp - 0x438]
xor ecx, ecx
mov edx, 0x436
call fcn.00402f1c
mov word [ebp - 0x438], di
mov al, byte [ebp - 2]
mov byte [ebp - 0x434], al
mov byte [ebp - 0x433], bl
lea edx, [ebp - 0x432]
mov ecx, 0x1f
mov eax, dword [ebp + 0x18]
call fcn.004f6794
mov al, byte [ebp + 0x14]
mov byte [ebp - 0x412], al
mov al, byte [ebp + 0x10]
mov byte [ebp - 0x411], al
test esi, esi
je 0x5e5142
lea edx, [ebp - 0x450]
mov eax, dword [esi + 0x10]
call fcn.0040993c
mov ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x44c]
mov edx, 0x5e51e4
call fcn.00404890
mov eax, dword [ebp - 0x44c]
call fcn.00404a44
mov edx, eax
lea eax, [ebp - 0x448]
call fcn.0040477c
mov eax, dword [ebp - 0x448]
mov dl, 6
call fcn.004f14f4
mov ax, word [esi + 6]
mov word [ebp - 0x436], ax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x410], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x40c], eax
mov eax, dword [esi + 0x18]
test eax, eax
jle 0x5e5142
lea edx, [esi + 0x1c]
lea ecx, [ebp - 0x404]
xchg ecx, eax
call fcn.0040a5c8
mov ax, word [ebp + 8]
mov word [ebp - 4], ax
cmp byte [ebp - 1], 0
je 0x5e516f
push 0x436
lea ecx, [ebp - 0x438]
mov eax, dword [0x659228]
mov eax, dword [eax + 0x448]
mov dl, 1
call fcn.005de140
jmp 0x5e518c
push 0x436
lea ecx, [ebp - 0x438]
mov eax, dword [0x659228]
mov eax, dword [eax + 0x448]
mov dl, 2
call fcn.005de140
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e51b1
lea eax, [ebp - 0x450]
mov edx, 6
call fcn.00404598
ret

Function at 0x5e6864
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e68d8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.004047f4
mov edx, dword [ebp - 0x108]
mov eax, ebx
mov ecx, 0x5e68ec
call fcn.00404890
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e68df
lea eax, [ebp - 0x108]
call fcn.00404574
ret
Function at 0x5e7920
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
call fcn.004cd230
mov ebx, eax
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.004746e0
mov eax, 1
call fcn.004cd9c8
call fcn.004cd230
sub eax, ebx
cmp eax, 0x1f4
jge 0x5e7961
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x448]
cmp dword [eax + 0x34], 0
jne 0x5e792b
pop ebx
pop ebp
ret

Function at 0x5e8ce0
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5e8e08
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x5e8e18
call sub.kernel32.dll_WinExec
push 0
push 0x5e8e64
call sub.kernel32.dll_WinExec
push 0
push 0x5e8eb4
call sub.kernel32.dll_WinExec
push 0
push 0x5e8f08
call sub.kernel32.dll_WinExec
push 0
push 0x5e8f54
call sub.kernel32.dll_WinExec
push 0
push 0x5e8fa8
call sub.kernel32.dll_WinExec
push 0
push 0x5e8fe4
call sub.kernel32.dll_WinExec
mov eax, 0x5e9024
call fcn.005e8908
mov eax, 0x5e903c
call fcn.005e8b28
mov eax, 0x5e9060
call fcn.005e8908
mov eax, 0x5e9078
call fcn.005e8b28
mov eax, 0x5e90a0
call fcn.005e8908
mov eax, 0x5e90b8
call fcn.005e8b28
mov eax, 0x5e90e0
call fcn.005e8908
mov eax, 0x5e90f8
call fcn.005e8b28
mov eax, 0x5e9120
call fcn.005e8908
mov eax, 0x5e9138
call fcn.005e8b28
mov eax, 0x5e9160
call fcn.005e8908
mov eax, 0x5e9178
call fcn.005e8b28
mov eax, 0x5e91a0
call fcn.005e8908
mov eax, 0x5e91b8
call fcn.005e8b28
mov eax, 0x5e91e0
call fcn.0040a1d0
push 0
push 0x5e91ec
push 0x5e91f8
call sub.kernel32.dll_CopyFileA
mov edx, 2
mov eax, 0x5e91e0
call fcn.0040a0b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5e8e12
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5ea898
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call fcn.004cd230
mov ebx, eax
call fcn.005fbcc8
test al, al
je 0x5ea8cd
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.004746e0
mov eax, 0xa
call fcn.004cd9c8
call fcn.004cd230
sub eax, ebx
cmp esi, eax
ja 0x5ea8a3
pop esi
pop ebx
ret
Function at 0x5eabbc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x5eabc5
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5eadf3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x45c], 0
je 0x5eacbe
cmp dword [ebx + 0x454], 3
jl 0x5eacbe
call fcn.004cd230
sub eax, dword [ebx + 0x458]
mov ecx, 0xea60
xor edx, edx
div ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x460]
cmp eax, dword [ebp - 4]
jbe 0x5eacb6
cmp byte [ebx + 0x438], 0
je 0x5eac73
push 0x5eae0c
mov eax, dword [ebx + 0x460]
sub eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.00409a28
push dword [ebp - 0xc]
push 0x5eae2c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404904
mov edx, dword [ebp - 8]
xor ecx, ecx
mov eax, 0x5eae48
call fcn.005e495c
jmp 0x5eadd8
push 0x5eae0c
mov eax, dword [ebx + 0x460]
sub eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.00409a28
push dword [ebp - 0x14]
push 0x5eae2c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404904
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov eax, 0x5eae5c
call fcn.005e495c
jmp 0x5eadd8
xor eax, eax
mov dword [ebx + 0x454], eax
mov eax, dword [0x655c48]
mov edx, esi
call fcn.004045c8
mov eax, dword [0x655af8]
mov byte [eax], 2
push 0
push 0
mov ecx, dword [0x655c48]
mov ecx, dword [ecx]
lea eax, [ebp - 0x18]
mov edx, 0x5eae70
call fcn.00404890
mov ecx, dword [ebp - 0x18]
mov edx, 0x5eae84
mov eax, 0x5eae98
call fcn.00613a6c
mov dword [ebx + 0x44c], 1
inc dword [ebx + 0x454]
call fcn.004cd230
mov dword [ebx + 0x458], eax
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.004e67fc
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x450]
call fcn.004045c8
cmp byte [ebx + 0x438], 0
je 0x5ead6e
push 0x5eaea8
push esi
push 0x5eaecc
lea edx, [ebp - 0x24]
mov eax, dword [0x655af8]
movzx eax, byte [eax]
call fcn.0040993c
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404904
mov eax, dword [ebp - 0x20]
call fcn.004f14a0
jmp 0x5eada1
push 0x5eaee4
push esi
push 0x5eaecc
lea edx, [ebp - 0x2c]
mov eax, dword [0x655af8]
movzx eax, byte [eax]
call fcn.0040993c
push dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00404904
mov eax, dword [ebp - 0x28]
call fcn.004f14a0
mov eax, ebx
call fcn.005e9e6c
test al, al
je 0x5eadd1
cmp byte [ebx + 0x438], 0
je 0x5eadd1
push ebx
push 0x5ea398
push ebx
push 0x5ea4a8
mov eax, dword [0x655c48]
mov eax, dword [eax]
xor ecx, ecx
mov edx, edi
call fcn.00641230
xor eax, eax
call fcn.005fbb3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eadfa
lea eax, [ebp - 0x2c]
mov edx, 0xa
call fcn.00404598
ret
Function at 0x5f8ec8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5f907d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
sub eax, 1
jb 0x5f8f02
je 0x5f8fbe
dec eax
je 0x5f9055
jmp 0x5f9060
lea edx, [ebp - 0x10]
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.00474e9c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040a320
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx*4 + 0x653f10]
call fcn.004e6660
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.0040477c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 4]
pop edx
call fcn.00404890
mov eax, dword [ebp - 4]
call fcn.00409f98
test al, al
je 0x5f8fb7
lea ecx, [ebp - 8]
mov edx, 0x5f9094
mov eax, dword [ebp - 4]
call fcn.0040a28c
mov eax, dword [ebp - 8]
call fcn.00409f98
test al, al
jne 0x5f8f76
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.005f72c8
cmp dword [ebx*4 + 0x653f1c], 0
je 0x5f8f9c
push dword [ebp - 4]
push 0x5f90a4
push dword [ebx*4 + 0x653f1c]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404904
push 0
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
seta bl
jmp 0x5f9062
xor ebx, ebx
jmp 0x5f9062
lea edx, [ebp - 0x1c]
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.00474e9c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0040a320
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebx*4 + 0x653f10]
call fcn.004e6660
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.0040477c
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 4]
pop edx
call fcn.00404890
call fcn.004f02fc
test al, 0x10
je 0x5f9051
mov eax, dword [ebp - 4]
call fcn.00409f98
test al, al
je 0x5f9051
cmp dword [ebx*4 + 0x653f1c], 0
je 0x5f9039
push dword [ebp - 4]
push 0x5f90a4
push dword [ebx*4 + 0x653f1c]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404904
push 0
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
seta bl
jmp 0x5f9062
xor ebx, ebx
jmp 0x5f9062
mov eax, esi
call fcn.005faf7c
mov ebx, eax
jmp 0x5f9062
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f9084
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00404598
ret