joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b0420
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0x80004005
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
cmp dword [ebp + 8], 0
je 0x5b0481
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
test edx, edx
jne 0x5b048b
jmp 0x5b05ae
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x5b04ba
jmp 0x5b05ae
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
ja 0x5b04d9
jmp 0x5b05ae
push 0
lea edx, [ebp - 0x1c]
push edx
push 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x5b0502
jmp 0x5b05ae
lea edx, [ebp - 0xc]
push edx
call fcn.005b0340
add esp, 4
test eax, eax
jne 0x5b051c
jmp 0x5b05ae
mov eax, dword [ebp - 0x14]
sub eax, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 1
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x5b0541
jmp 0x5b05ae
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x2c]
mov dword [edx], eax
push 0
push 0
push 4
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x5b057e
jmp 0x5b05ae
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.005b0370
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x5b05ae
cmp dword [ebp - 0x24], 0
je 0x5b05ae
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x28], 0xffffffff
je 0x5b05c5
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret
Function at 0x5b0960
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df2c8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x676580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 1
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.00472ab0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov byte [ecx + 0x30], 1
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x20]
mov byte [edx + 0x31], cl
mov edx, dword [ebp + 8]
add edx, 0xc
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x44
call fcn.0040ca60
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x48
call fcn.0040ca60
mov ecx, dword [ebp + 8]
add ecx, 0x14
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x4c
call fcn.0040ca60
mov edx, dword [ebp + 8]
add edx, 0x18
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
call fcn.0040ca60
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x54
call fcn.0040ca60
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x38
call fcn.0040ca60
mov edx, dword [ebp + 8]
add edx, 8
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x3c
call fcn.0040ca60
mov eax, dword [ebp + 8]
add eax, 4
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x40
call fcn.0040ca60
push 0
call fcn.00528281
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x34], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00472b00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5b0b00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x60], eax
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x60], 0
jne 0x5b0b9b
cmp dword [0x67e1c8], 0
je 0x5b0b94
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x1e
lea eax, [ebp - 8]
push eax
push str.init_failure__because__create_event_failure
push 0x62fe14
push 0x62fbd4
push 0x62fe0c
lea ecx, [ebp - 4]
push ecx
push 0x62fb4c
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
xor eax, eax
jmp 0x5b0c55
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
push 0x5b0a70
push 0
push 0
call fcn.005277fd
add esp, 0x18
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x5c], eax
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x5c], 0
jne 0x5b0c50
cmp dword [0x67e1c8], 0
je 0x5b0c35
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x26
lea eax, [ebp - 0x10]
push eax
push str.init_failure__because__create_thread_failure
push 0x62feb8
push str.KCmppGlobalMonitor::Init
push 0x62fe7c
lea ecx, [ebp - 0xc]
push ecx
push 0x62fe78
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x60], 0
xor eax, eax
jmp 0x5b0c55
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x5b0c60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x18], 0
jne 0x5b0c9c
jmp 0x5b0d55
mov eax, dword [ebp + 0x10]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x5b0cc2
jmp 0x5b0d55
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jae 0x5b0cdd
jmp 0x5b0d55
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
cmp eax, dword [ebp - 4]
jae 0x5b0cfa
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov dword [ebp - 0x10], 1
jmp 0x5b0d55
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5b0d15
jmp 0x5b0d55
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5b0d2c
jmp 0x5b0d55
cmp dword [ebp + 0x14], 0
je 0x5b0d46
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.00523d20
add esp, 0xc
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov dword [ebp - 0x10], 1
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x5b0d73
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x5b0d80
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x5b0db0
cmp dword [ebp + 0xc], 0
je 0x5b0db0
cmp dword [ebp + 0x10], 1
jae 0x5b0dba
jmp 0x5b0e3c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5b0dda
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x5b0dda
jmp 0x5b0e3c
push 0
push 0x80
push 2
push 0
push 7
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x5b0e03
jmp 0x5b0e3c
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5b0e27
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 4]
je 0x5b0e2b
jmp 0x5b0e3c
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0xffffffff
je 0x5b0e53
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
jne 0x5b0e69
cmp dword [ebp + 8], 0
je 0x5b0e69
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5b46f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax - 0x3b8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 4]
mov byte [edx + 0x1c8], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x1b4
call fcn.0040b1c0
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x1c4
call fcn.0040b1c0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov edx, dword [eax + 0x14]
call edx
push 8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
mov esp, ebp
pop ebp
ret 8
Function at 0x5b51d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df412
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x676580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x20]
add ecx, 0x190
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x190]
mov eax, dword [edx + 0x1c]
call eax
push eax
lea ecx, [ebp - 0x10]
call fcn.004092b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040ee60
movzx ecx, al
test ecx, ecx
jne 0x5b5261
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403270
mov eax, dword [ebp + 8]
jmp 0x5b5357
mov ecx, dword [ebp - 0x20]
add ecx, 0xa4
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402050
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0040ee60
movzx edx, al
test edx, edx
jne 0x5b5324
push 0x636338
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.0040bb50
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00493020
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5b52f7
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00403270
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403270
mov eax, dword [ebp + 8]
jmp 0x5b5357
push 0x2f
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.0044c930
mov ecx, dword [ebp - 0x14]
push ecx
push 0x636350
lea edx, [ebp - 0x10]
push edx
call fcn.00403240
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00403270
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402050
mov ecx, dword [ebp - 0x1c]
or ecx, 1
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403270
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5b5a60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2e29
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x676580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0040ee60
movzx eax, al
test eax, eax
je 0x5b5ab2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403270
jmp 0x5b5c0d
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00579de0
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00403290
mov byte [ebp - 4], 2
mov edx, dword [ebp + 8]
push edx
push 0x6365e4
lea eax, [ebp - 0x14]
push eax
call fcn.00403240
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.00493020
push eax
lea ecx, [ebp - 0x18]
call fcn.00493020
push eax
call fcn.005767c0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5b5be6
push 1
push 0
push 0
lea ecx, [ebp + 8]
call fcn.00493020
push eax
push 0x6365f8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cdq
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
cmp dword [0x67e1c8], 0
je 0x5b5be6
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x20], 0
jl 0x5b5b57
jg 0x5b5b51
cmp dword [ebp - 0x24], 0x20
jbe 0x5b5b57
mov byte [ebp - 0x35], 1
jmp 0x5b5b5b
mov byte [ebp - 0x35], 0
mov cl, byte [ebp - 0x35]
mov byte [ebp - 0x29], cl
mov dword [ebp - 0x28], 0x442
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x29]
push eax
push 0x63667c
lea ecx, [ebp + 8]
call fcn.00493020
push eax
push 0x636660
push 0x636658
push str.KCommonPopBase2::OpenUrlByUserToken
push 0x636608
lea ecx, [ebp - 0x28]
push ecx
push 0x636604
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004540b0
mov ecx, eax
call fcn.00447700
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00403270
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403270
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5b8600
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x5b862a
mov ecx, dword [ebp - 4]
and ecx, 0x10
jne 0x5b862a
mov dword [ebp - 8], 1
jmp 0x5b8631
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x5b8980
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x5ec], 2
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4ec], 0
je 0x5b89c2
push 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x4ec]
add ecx, 4
call fcn.0042b1a0
mov ecx, dword [ebp - 4]
add ecx, 0x4f4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4f4]
mov edx, dword [eax + 0x34]
call edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x550], 0
push str.btnclose
mov ecx, dword [ebp - 4]
add ecx, 0x53c
call fcn.0040b1c0
mov ecx, dword [ebp - 4]
add ecx, 0x3c4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3c4]
mov edx, dword [eax + 0x18]
call edx
push 3
mov ecx, dword [ebp - 4]
add ecx, 0x4f4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4f4]
mov eax, dword [edx + 0x18]
call eax
push 8
mov ecx, dword [ebp - 4]
add ecx, 0x3c4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3c4]
mov edx, dword [eax + 0x20]
call edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5b8d30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax - 0x3c0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 4]
mov byte [edx + 0x168], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x154
call fcn.0040b1c0
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x164
call fcn.0040b1c0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov edx, dword [eax + 0x14]
call edx
push 8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
mov esp, ebp
pop ebp
ret 8
Function at 0x5b92a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df4d6
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x676580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x20]
add ecx, 0x130
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x130]
mov eax, dword [edx + 0x1c]
call eax
push eax
lea ecx, [ebp - 0x10]
call fcn.004092b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040ee60
movzx ecx, al
test ecx, ecx
jne 0x5b9331
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403270
mov eax, dword [ebp + 8]
jmp 0x5b9424
mov ecx, dword [ebp - 0x20]
add ecx, 0x44
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402050
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0040ee60
movzx edx, al
test edx, edx
jne 0x5b93f1
push str.index.html
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.0040bb50
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00493020
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5b93c4
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00403270
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403270
mov eax, dword [ebp + 8]
jmp 0x5b9424
push 0x2f
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.0044c930
mov ecx, dword [ebp - 0x14]
push ecx
push str.file:____sindex.html
lea edx, [ebp - 0x10]
push edx
call fcn.00403240
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00403270
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402050
mov ecx, dword [ebp - 0x1c]
or ecx, 1
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403270
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5bb5b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [0x67e1c8], 0
je 0x5bb5e5
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push str.KCommonPopBase::DownloadPackage
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x30], 0
jne 0x5bb5f5
xor eax, eax
jmp 0x5bb6a2
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0x30]
call fcn.00584b50
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5bb610
xor eax, eax
jmp 0x5bb6a2
mov ecx, dword [ebp - 4]
call fcn.0044b9f0
push eax
mov ecx, dword [ebp - 4]
call fcn.004a6db0
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x44
push eax
call fcn.005b0f20
mov ecx, eax
call fcn.005b1050
cmp dword [ebp + 0xc], 0
jne 0x5bb642
mov eax, 1
jmp 0x5bb6a2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
call fcn.005b0f20
mov ecx, eax
call fcn.005b1150
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [0x67e1c8], 0
je 0x5bb69f
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0xc]
push eax
push str.KCommonPopBase::DownloadPackage::
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447700
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x5bb6b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4518
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x676580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0040ee60
movzx eax, al
test eax, eax
je 0x5bb702
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403270
jmp 0x5bb870
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00579de0
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00403290
mov byte [ebp - 4], 2
mov edx, dword [ebp + 8]
push edx
push str._url:__s_
lea eax, [ebp - 0x14]
push eax
call fcn.00403240
add esp, 0xc
push str.wormhole_pop
lea ecx, [ebp - 0x28]
call fcn.004092b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.00577040
add esp, 8
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00403270
cmp dword [ebp - 0x10], 0
je 0x5bb849
push 1
push 0
push 0
lea ecx, [ebp + 8]
call fcn.00493020
push eax
push 0x637b1c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cdq
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
cmp dword [0x67e1c8], 0
je 0x5bb849
mov dword [ebp - 0x34], 0
cmp dword [ebp - 0x20], 0
jl 0x5bb7ba
jg 0x5bb7b4
cmp dword [ebp - 0x24], 0x20
jbe 0x5bb7ba
mov byte [ebp - 0x39], 1
jmp 0x5bb7be
mov byte [ebp - 0x39], 0
mov al, byte [ebp - 0x39]
mov byte [ebp - 0x2d], al
mov dword [ebp - 0x2c], 0x551
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x2d]
push edx
push str.___result:
lea ecx, [ebp + 8]
call fcn.00493020
push eax
push str.ShellExecute_
push 0x637b80
push str.KCommonPopBase::OpenUrlByUserToken
push 0x637b2c
lea eax, [ebp - 0x2c]
push eax
push 0x637b28
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004540b0
mov ecx, eax
call fcn.00447700
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00403270
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403270
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4