joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c5134
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x5c5155
test edi, 0x40000
je 0x5c516f
test bl, bl
jne 0x5c51f0
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x5c51f0
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x5c51a2
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x5c51b7
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x5c51c6
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x5c51d7
cmp byte [esp + 2], 0
je 0x5c51f0
cmp byte [esp + 2], 0
je 0x5c51e8
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x5c51f0
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5c5494
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x5c54ba
mov eax, esp
push eax
push 0x5c545c
call sub.user32.dll_EnumWindows
jmp 0x5c54cd
mov eax, esp
push eax
push 0x5c543c
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x5c5590
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
xor eax, eax
mov si, ax
test bl, 4
je 0x5c55a2
or si, 1
test bl, 8
je 0x5c55ab
or si, 4
test bl, 1
je 0x5c55b4
or si, 8
test bl, 2
je 0x5c55bd
or si, 0x10
test bl, 0x10
je 0x5c55c6
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5c55d6
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x5c55dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
xor eax, eax
mov bx, ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5c55f5
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5c5605
or bx, 4
test esi, 0x20000000
je 0x5c5611
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x5cf694
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5cf6a6
add esp, 0xfffffff0
call fcn.00408c00
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c1508
mov eax, dword [0x603fa0]
mov dword [eax + 4], ebx
mov dword [eax], 0x5cfb68
mov eax, dword [0x603fb0]
mov dword [eax + 4], ebx
mov dword [eax], 0x5cfb74
mov eax, ebx
call fcn.005cfb80
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4809e4]
call fcn.004085e4
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x4809e4]
call fcn.004085e4
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x4809e4]
call fcn.004085e4
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x4809e4]
call fcn.004085e4
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x4809e4]
call fcn.004085e4
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5c988c
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x50b5a8]
call fcn.00512124
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x50b5a8]
call fcn.00512124
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x50b5a8]
call fcn.00512124
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x50b5a8]
call fcn.00512124
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x50b5a8]
call fcn.00512124
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005d0160
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5cff90
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5cff90
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5cff90
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5cff90
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5cff90
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5cf826
call fcn.00408c58
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5cfd2c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5cfedc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5cfebb
mov dl, 1
mov eax, dword [0x484730]
call fcn.004b06a4
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.0040a3bc
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5cfeaa
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00547ec0
test al, al
je 0x5cfe9d
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5cfeec
lea eax, [ebp - 0x394]
call fcn.00426804
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5cfe9d
xor eax, eax
push ebp
push 0x5cfe96
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5cff5c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5cfe7d
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040aebc
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5cfe7d
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040aebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5cfe9d
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5cfd9d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004b05cc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5cfee3
lea eax, [ebp - 0x3a0]
call fcn.0040a3bc
pop eax
jmp eax

Function at 0x5d0af4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x60bc10]
cmp byte [eax + 0xc5], 0
jne 0x5d0b66
cmp dword [0x60bc38], 0
jne 0x5d0b26
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x603d60]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x60bc38], eax
cmp dword [0x60bc34], 0
jne 0x5d0b41
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x60bc34], eax
cmp dword [0x60bc3c], 0
jne 0x5d0b66
push esp
push 0
push 0
mov eax, dword [0x603d5c]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x60bc3c], eax
pop edx
ret
Function at 0x5d10e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5d10f7
add esp, 0xfffffff0
call fcn.00408c00
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c1508
mov eax, dword [0x603e20]
cmp byte [eax], 0
jne 0x5d1124
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x19c], al
mov eax, dword [0x6041b8]
cmp word [eax + 2], 0
jne 0x5d113e
mov eax, dword [0x6041b8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005d35a4
mov eax, dword [0x604300]
cmp word [eax + 2], 0
jne 0x5d1158
mov eax, dword [0x604300]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005d39bc
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x50b5a8]
call fcn.00512124
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5d3f68
mov dl, 1
mov eax, dword [0x4809e4]
call fcn.004085e4
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x4809e4]
call fcn.004085e4
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x510718]
call fcn.0051c738
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5d1348
mov eax, dword [0x604050]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0051cc54
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5d4254
mov dl, 1
mov eax, dword [0x4809e4]
call fcn.004085e4
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x604050]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00426604
test eax, eax
je 0x5d126b
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0042645c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004265e8
test eax, eax
je 0x5d1283
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040aebc
push ebx
push 0x5d2f78
call fcn.005c5574
mov dword [ebx + 0x198], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x603e20]
cmp byte [eax], 0
jne 0x5d12d4
mov eax, ebx
call fcn.005d1510
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005d45fc
mov eax, ebx
call fcn.005d5138
mov byte [ebx + 0x19e], 0
mov byte [ebx + 0xf5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5d133f
call fcn.00408c58
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d1840
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x5d18e2
cmp dword [ebx + 0xac], 0
jne 0x5d18dc
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5d1780
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5d18dc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5d18a2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5d18dc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004ab4f4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5d18b1
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5d1c24
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x60bc10]
cmp dword [eax + 0x190], 0
je 0x5d1d8d
test bl, bl
jne 0x5d1ce0
cmp dword [esi + 0xb4], 0
jne 0x5d1cd5
mov eax, esi
call fcn.005d4f88
push eax
push 0x5d1b24
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5d1ca6
mov eax, dword [0x60bc10]
cmp byte [eax + 0xeb], 0
je 0x5d1ca6
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5d1c87
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d1ca6
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d1c8f
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d1cd5
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ab4f4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d1cb5
inc dword [esi + 0xb4]
jmp 0x5d1d8d
cmp dword [esi + 0xb4], 0
jle 0x5d1d8d
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5d1d8d
cmp dword [esi + 0x58], 0
je 0x5d1d42
mov eax, dword [0x60bc10]
cmp byte [eax + 0xeb], 0
je 0x5d1d42
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5d1d23
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d1d42
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d1d2b
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d1d71
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ab4f4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d1d51
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5c1a14]
call fcn.0040d1b8
pop edi
pop esi
pop ebx
ret
Function at 0x5d2b84
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5d2be1
cmp byte [ebx + 0xeb], 0
jne 0x5d2be1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a554
mov eax, dword [esi]
test eax, eax
je 0x5d2bce
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5d2bee
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a7ac
jmp 0x5d2bee
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a7ac
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5d4810
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5d4881
mov eax, esi
call fcn.005419a8
test al, al
je 0x5d4881
mov eax, dword [ebx + 0x98]
call fcn.00541540
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5d4881
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x5d4872
push 0
mov eax, dword [ebx + 0x98]
call fcn.00541540
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00537778
jmp 0x5d4881
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005d461c
pop esi
pop ebx
ret
Function at 0x5f2a60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
mov dword [ebp - 4], eax
lea eax, [ebp - 0x204]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x204]
mov ecx, pe_nt_image_headers32
call fcn.0040aebc
mov esp, ebp
pop ebp
ret

Function at 0x5f2b98
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a4b0
mov eax, dword [ebp - 8]
call fcn.0040a4b0
xor eax, eax
push ebp
push 0x5f2c9a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
call fcn.0040a7f4
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.004261f4
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov edx, 0x5f2cb4
call fcn.0040b06c
lea eax, [ebp - 0x78]
xor ecx, ecx
mov edx, 0x10
call fcn.00407e04
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x44
call fcn.00407e04
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 0xc0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x20]
call fcn.0040ae20
push eax
push 0
push 0xc000220
push 0
push 0
push 0
mov eax, dword [ebp - 0x24]
call fcn.0040ae20
push eax
mov eax, dword [ebp - 0x1c]
call fcn.0040ae20
push eax
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x5f2c70
call sub.kernel32.dll_GetLastError
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2ca1
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040a41c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a41c
pop eax
jmp eax
Function at 0x5c4db0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
inc ebp
add byte [0x270], bh
jne 0x5c4e05
mov ecx, dword [ebp + 4]
mov eax, 0xfffffd90
nop dword [eax]
and ecx, 0x80000000
mov edx, dword [ebp + eax*4 + 0x9c8]
mov esi, edx
and esi, 0x7ffffffe
or esi, ecx
shr esi, 1
mov ecx, edx
and edx, 1
neg edx
and edx, 0x9908b0df
xor edx, dword [ebp + eax*4 + 0xff8]
xor edx, esi
mov dword [ebp + eax*4 + 0x1384], edx
inc eax
jne 0x5c4dc4
mov eax, dword [ebp]
jmp 0x5c4edf
cmp eax, 0x4e0
invalid
invalid
Function at 0x615e7c
Capabilities:
Encode data using xor

Disassembly:
inc eax
lahf
inc esp
push edi
xor eax, 0x559e0dda
test dword [ebx], eax
or byte [edi], al
xchg edx, eax
cmp eax, 0x224557e8
lahf
fnstsw word [esi + 0x17dc1030]
std
xor al, 0x7b
out dx, al
invalid
sub bl, byte [ebp - 0x1d]
popfd
test dword [edx], eax
cmp al, byte [esi]
cmp dh, byte [edi - 0x39723d0]
outsd dx, dword [esi]
sbb eax, 0xdb91b1a
or cl, byte [ebx + 2]
adc al, 0x3e
jp 0x615ee8
fstp qword [esi + 0x10]
push cs
xchg edi, eax
scasd eax, dword es:[edi]
sbb ebx, edi
jno 0x615e2b
sub cl, byte [ecx + edx*2 - 0x4273f672]
ficomp dword [edx - 0x2a]
push edx
scasb al, byte es:[di]
ret
jp 0x615f4d
outsb dx, byte [esi]
jmp 0xd2a44c69
jecxz 0x615fb4
xor ebx, dword [edx - 0x6f878420]
aam 0x62
pop ss
bound edx, qword [edi]
push esi
stosd dword es:[edi], eax
add dword [ebp - 7], ecx
xor ecx, dword [eax + 0x4d]
cmp dword [ecx], esi
jp 0x615f56
add byte [edi - 0x7251bd71], bl
outsd dx, dword [esi]
invalid
mov dword [ebp - 0x75], esp
ret

Function at 0x7586f4
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
jb 0x7586f3
xchg edi, eax
lds edx, es:[ebp - 0x7857abd4]
push eax
adc eax, 0x26bb7281
and al, 0xf6
cmp eax, 0xc78a6154
loopne 0x758703
xchg edi, eax
int 0x4c
mov bl, 0x31
pushal
ror byte [ecx + 0x6badc2c9], 1
shr byte [ecx + 0x1a34b8d5], cl
mov word [edi], gs
das
adc cl, ch
adc ebp, dword [ecx - 0x7a0871e1]
std
rol byte [ebx - 0x76], cl
mov ch, byte [eax]
invalid
cld
aas
inc ebx
inc esi
inc ebp
cmp byte [edi - 0x5fcb0bfa], bl
inc esi
add dword [ebx], esi
pop edi
pop eax
out 0xc3, eax
invalid
dec ebx
xor edi, dword [edi + eax*4]
adc byte [ebx - 0x3ab59d3c], 0x4a
dec edx
lds edi, [edx + 0x72]
jo 0x7586e9
loope 0x758779
push 0xffffffffffffffb3
jge 0x758681
in al, 0x3d
inc edx
and bh, bl
sti
cli
mov dword [0x4f5f5021], eax
mov ss, ebp
dec ecx
cmp dword [eax - 0x75], ebx
dec edi
sahf
mov ch, 0xc7
stosb byte es:[edi], al
hlt
jecxz 0x75879d
push ebx
lcall 0x3420, 0xe5a6ad5c
or byte [ebp - 0x6e], 0x58
dec edx
ret
mov bl, 0xc0
aam 0x11
and edx, dword [edx + 0x16]
sub esi, eax
lahf
xor ebx, ebp
lodsb al, byte [esi]
lds ebx, [ecx + 0x1312d69b]
invalid
Function at 0x59a870
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00598afc
and dword [ebp - 4], 0
cmp dword [0x5aeccc], 0
mov ebx, eax
jne 0x59a921
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x59a9d2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x59a9d2
push eax
call fcn.00598a8a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5aeccc], eax
call esi
push eax
call fcn.00598a8a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5aecd0], eax
call esi
push eax
call fcn.00598a8a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5aecd4], eax
call esi
push eax
call fcn.00598a8a
pop ecx
mov dword [0x5aecdc], eax
test eax, eax
je 0x59a921
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00598a8a
pop ecx
mov dword [0x5aecd8], eax
mov eax, dword [0x5aecd8]
cmp eax, ebx
je 0x59a979
cmp dword [0x5aecdc], ebx
je 0x59a979
push eax
call fcn.00598b05
push dword [0x5aecdc]
mov esi, eax
call fcn.00598b05
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x59a979
test edi, edi
je 0x59a979
call esi
test eax, eax
je 0x59a970
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x59a970
test byte [ebp - 0xc], 1
jne 0x59a979
or dword [ebp + 0x10], 0x200000
jmp 0x59a9b2
mov eax, dword [0x5aecd0]
cmp eax, ebx
je 0x59a9b2
push eax
call fcn.00598b05
pop ecx
test eax, eax
je 0x59a9b2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x59a9b2
mov eax, dword [0x5aecd4]
cmp eax, ebx
je 0x59a9b2
push eax
call fcn.00598b05
pop ecx
test eax, eax
je 0x59a9b2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5aeccc]
call fcn.00598b05
pop ecx
test eax, eax
je 0x59a9d2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x59a9d4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x59ac56
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ad428]
jne 0x59ac60
repz ret
jmp fcn.0059cc14
Function at 0x59f3c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x5ac790], 0x1b77
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [0x5ac790], 0x2357
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 8], eax
mov dword [0x5ac790], 0x2042
mov dword [ebp - 0x10], 0
jmp 0x59f446
mov eax, dword [ebp - 4]
add esp, 0x10
pop ebp
ret
jmp 0x59f507
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
jne 0x59f50b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
je 0x59f471
jmp 0x59f509
cmp dword [ebp - 0x10], 0x104
jge 0x59f419
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + eax*2]
cmp eax, 0
jne 0x59f462
jmp 0x59f419
jmp 0x59f464
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x59f446
mov dword [0x5ac794], 0x2099
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
jne 0x59f507
mov dword [0x5ac790], 0xe2e
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x59f414
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x59f502
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
jne 0x59f500
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + eax*2 - 0xe]
cmp eax, 0x6c
jne 0x59f4fe
mov eax, dword [0x5ac790]
sub eax, 0x2531
mov dword [0x5ac794], eax
mov dword [ebp - 4], 1
jmp 0x59f40c
jmp 0x59f500
jmp 0x59f502
jmp 0x59f414
jmp 0x59f509
jmp 0x59f50b
mov dword [ebp - 4], 0
jmp 0x59f40c

Function at 0x59f690
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.0059f690]
mov dword [ebp - 8], eax
jmp 0x59f6d1
jmp 0x59f6ab
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x59f6f9
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
jmp 0x59f6e0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x59f6a3
jmp 0x59f6a1
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x59f6bd
jmp 0x59f6ab
mov al, 1
test al, 1
jne 0x59f6d1
jmp 0x59f6e8
mov dword [0x5ac794], 0x1b8b
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 8
pop ebp
ret