joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5558bc
Capabilities:
Acquire debug privileges
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [0x698414]
mov eax, 0x555a28
call fcn.00555800
xor ebx, ebx
push 0x555a3c
push 0
push 0x100002
call sub.kernel32.dll_OpenEventA
mov dword [esi], eax
cmp dword [esi], 0
jne 0x555911
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
jne 0x555911
push 0x64
call sub.kernel32.dll_Sleep_1
push 0x555a3c
push 0
push 0x100002
call sub.kernel32.dll_OpenEventA
mov dword [esi], eax
cmp dword [esi], 0
je 0x5558f9
push 0x555a58
push 0
push 0x100002
call sub.kernel32.dll_OpenEventA
mov edx, dword [0x6981bc]
mov dword [edx], eax
mov eax, dword [0x698070]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x698164]
xor edx, edx
mov dword [eax], edx
cmp dword [esi], 0
je 0x55594b
mov eax, dword [0x6981bc]
cmp dword [eax], 0
jne 0x55597e
cmp dword [esi], 0
jbe 0x555958
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x6981bc]
cmp dword [eax], 0
jbe 0x55596f
mov eax, dword [0x6981bc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi], eax
mov eax, dword [0x6981bc]
xor edx, edx
mov dword [eax], edx
mov bl, 1
test bl, bl
jne 0x555a1b
push 0x555a84
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edx, dword [0x698070]
mov dword [edx], eax
push 0x555aa8
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edx, dword [0x698164]
mov dword [edx], eax
mov eax, dword [0x698070]
cmp dword [eax], 0
jbe 0x555a06
mov eax, dword [0x698164]
cmp dword [eax], 0
jbe 0x555a06
push 0
push 0
push 0
push 0
push 2
mov eax, dword [0x698070]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_MapViewOfFileEx
mov edx, dword [0x6982fc]
mov dword [edx], eax
push 0
push 0
push 0
push 0
push 2
mov eax, dword [0x698164]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_MapViewOfFileEx
mov edx, dword [0x6980a0]
mov dword [edx], eax
jmp 0x555a1b
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x6981bc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
pop esi
pop ebx
ret
Function at 0x5558d5
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [0x698414]
mov eax, 0x555a28
call fcn.00555800
xor ebx, ebx
push 0x555a3c
push 0
push 0x100002
call sub.kernel32.dll_OpenEventA
mov dword [esi], eax
cmp dword [esi], 0
jne 0x555911
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
jne 0x555911
push 0x64
call sub.kernel32.dll_Sleep_1
push 0x555a3c
push 0
push 0x100002
call sub.kernel32.dll_OpenEventA
mov dword [esi], eax
cmp dword [esi], 0
je 0x5558f9
push 0x555a58
push 0
push 0x100002
call sub.kernel32.dll_OpenEventA
mov edx, dword [0x6981bc]
mov dword [edx], eax
mov eax, dword [0x698070]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x698164]
xor edx, edx
mov dword [eax], edx
cmp dword [esi], 0
je 0x55594b
mov eax, dword [0x6981bc]
cmp dword [eax], 0
jne 0x55597e
cmp dword [esi], 0
jbe 0x555958
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x6981bc]
cmp dword [eax], 0
jbe 0x55596f
mov eax, dword [0x6981bc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi], eax
mov eax, dword [0x6981bc]
xor edx, edx
mov dword [eax], edx
mov bl, 1
test bl, bl
jne 0x555a1b
push 0x555a84
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edx, dword [0x698070]
mov dword [edx], eax
push 0x555aa8
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edx, dword [0x698164]
mov dword [edx], eax
mov eax, dword [0x698070]
cmp dword [eax], 0
jbe 0x555a06
mov eax, dword [0x698164]
cmp dword [eax], 0
jbe 0x555a06
push 0
push 0
push 0
push 0
push 2
mov eax, dword [0x698070]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_MapViewOfFileEx
mov edx, dword [0x6982fc]
mov dword [edx], eax
push 0
push 0
push 0
push 0
push 2
mov eax, dword [0x698164]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_MapViewOfFileEx
mov edx, dword [0x6980a0]
mov dword [edx], eax
jmp 0x555a1b
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x6981bc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
pop esi
pop ebx
ret
Function at 0x560adc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x6b3808
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x560afe
shr eax, 1
xor eax, 0xedb88320
jmp 0x560b00
shr eax, 1
dec edx
jne 0x560aec
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x560ae5
mov byte [0x6b3c08], 1
pop esi
pop ebx
ret

Function at 0x560b1c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x6b3c08], 0
jne 0x560b33
call fcn.00560adc
mov eax, edi
dec eax
test eax, eax
jl 0x560b5c
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x6b3808]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x560b3d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5630e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x563119
dec al
je 0x56315a
dec al
je 0x56319e
dec al
je 0x563209
jmp 0x563293
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x563293
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x563129
jmp 0x563293
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x563293
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x56316a
jmp 0x563293
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x563293
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5631cc
xor ebp, ebp
jmp 0x5631dd
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5631e6
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5631ae
jmp 0x563293
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x563293
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x563261
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00560b64
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x56321d
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5991e0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x599254
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004053ec
mov dword [ebp - 8], 0xfd
lea eax, [ebp - 4]
mov edx, 0xfe
call fcn.004058f0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040557c
push eax
call sub.advapi32.dll_GetUserNameW
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004058f0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59925b
lea eax, [ebp - 4]
call fcn.004053ec
ret
Function at 0x59b234
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405168
xor eax, eax
push ebp
push 0x59b29b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
call fcn.00405178
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404f14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59b2a2
lea eax, [ebp - 4]
call fcn.00404cac
ret
Function at 0x59e10c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405168
mov eax, dword [ebp - 8]
call fcn.00405168
xor eax, eax
push ebp
push 0x59e221
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov dl, 1
mov eax, dword [0x42d344]
call fcn.0042d4b0
mov dword [ebp - 0x10], eax
cmp byte [ebp + 8], 0
je 0x59e160
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x2011f
jmp 0x59e16a
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x2001f
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.0042d58c
xor eax, eax
push ebp
push 0x59e1e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0042d6d0
mov eax, dword [ebp - 0x10]
call fcn.0042d55c
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0042d6d0
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x59e1de
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405178
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x10]
call fcn.0042d55c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x59e1fe
mov eax, dword [ebp - 0x10]
call fcn.00403e80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59e228
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cd0
ret

Function at 0x59e5f4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [0x698260]
cmp dword [eax], 0
je 0x59e616
lea eax, [ebp - 4]
push eax
mov eax, dword [0x698260]
mov eax, dword [eax]
call eax
xor eax, eax
push ebp
push 0x59e644
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
mov eax, ebx
call fcn.00405178
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x59e65c
mov eax, dword [0x697b2c]
cmp dword [eax], 0
je 0x59e673
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x697b2c]
mov eax, dword [eax]
call eax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x59e67c
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x59e819
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x59a9b0]
call fcn.0059ffa4
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59e830
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59e870
call fcn.00404d00
lea edx, [ebp - 8]
mov eax, dword [0x69800c]
mov eax, dword [eax]
call fcn.00431668
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040f8f8
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x10]
mov ecx, 0x59e884
call fcn.00404fcc
mov byte [ebx + 0x14], 1
mov edx, ebx
mov eax, dword [0x6b4e18]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59a9b0]
call fcn.0059ffa4
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59e830
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59e870
call fcn.00404d00
lea eax, [ebx + 0x10]
mov edx, 0x59e884
call fcn.00404d00
mov byte [ebx + 0x14], 1
mov edx, ebx
mov eax, dword [0x6b4e18]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59a9b0]
call fcn.0059ffa4
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59e830
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59e89c
call fcn.00404d00
lea edx, [ebp - 0x10]
mov eax, dword [0x69800c]
mov eax, dword [eax]
call fcn.004317d8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040f8f8
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x10]
mov ecx, 0x59e8ac
call fcn.00404fcc
mov byte [ebx + 0x14], 1
mov edx, ebx
mov eax, dword [0x6b4e18]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59a9b0]
call fcn.0059ffa4
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59e830
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59e89c
call fcn.00404d00
lea eax, [ebx + 0x10]
mov edx, 0x59e8ac
call fcn.00404d00
mov byte [ebx + 0x14], 1
mov edx, ebx
mov eax, dword [0x6b4e18]
call fcn.0041ee98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59e820
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404cd0
ret
Function at 0x5a2b50
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405168
xor eax, eax
push ebp
push 0x5a2be3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dword [esi], 0
mov dword [esi + 4], 0
push 0
push 0x80
push 3
push 0
push 4
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00405178
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
cmp edi, 0xffffffff
je 0x5a2bcd
lea eax, [ebp - 8]
push eax
push edi
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
mov eax, dword [ebp - 8]
shl eax, 0x20
or eax, ecx
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
mov bl, 1
push edi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a2bea
lea eax, [ebp - 4]
call fcn.00404cac
ret

Function at 0x5a31c4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov edx, dword [ebp + 8]
mov byte [edx], 0
mov edx, dword [ebp - 8]
mov byte [edx], 0
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x5a32a2
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
mov ecx, eax
mov dl, 1
mov eax, dword [0x41cc64]
call fcn.00422090
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x50]
mov ecx, 0x40
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp word [ebp - 0x50], 0x5a4d
je 0x5a3230
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a32d8
mov eax, dword [ebp - 4]
mov byte [eax], 1
mov eax, dword [ebp - 0x14]
cdq
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.00421b20
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 0xc], 0x50
jne 0x5a327a
cmp byte [ebp - 0xb], 0x45
jne 0x5a327a
cmp byte [ebp - 0xa], 0
jne 0x5a327a
cmp byte [ebp - 9], 0
jne 0x5a327a
mov eax, dword [ebp - 8]
mov byte [eax], 1
mov eax, dword [ebp + 8]
mov byte [eax], 1
jmp 0x5a3298
cmp byte [ebp - 0xc], 0x4e
jne 0x5a328e
cmp byte [ebp - 0xb], 0x45
jne 0x5a328e
mov eax, dword [ebp - 8]
mov byte [eax], 1
jmp 0x5a3298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a32d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a32ca
cmp dword [ebp - 0x10], 0
je 0x5a32d8
mov eax, dword [ebp - 0x10]
call fcn.00403e80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5a4834
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov eax, 0x5a4884
call fcn.005c0f58
mov esi, eax
mov eax, dword [edi]
mov byte [eax + 0x24], 0
mov eax, dword [edi]
call fcn.005a446c
test esi, esi
jle 0x5a4873
push 1
push 0x5a4890
push 0x5a4890
push 0x5a4894
push 0x5a48a0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5a5374
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5a5436
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x5a544c
call fcn.005c0f58
mov dword [ebp - 4], eax
mov eax, 0x6c4e8c
mov edx, dword [ebx]
mov edx, dword [edx + 8]
call fcn.00404d00
mov eax, dword [0x6c4e90]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5a53f8
inc ebx
xor esi, esi
lea ecx, [ebp - 0x10]
mov edx, esi
mov eax, dword [0x6c4e90]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040f8f8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x5a5460
call fcn.00404fcc
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.005a4f14
inc esi
dec ebx
jne 0x5a53c0
cmp dword [ebp - 4], 0
jle 0x5a541b
push 1
push 0x5a546c
push 0x5a5470
push 0x5a5488
push 0x5a5494
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a543d
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404cd0
ret
Function at 0x5ad2e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5ad3f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x324]
mov edx, dword [eax + 0x30]
mov eax, dword [esi + 0x310]
call fcn.00536004
mov eax, dword [esi + 0x310]
mov edx, dword [eax + 0x210]
mov eax, dword [esi + 0x314]
call fcn.0053381c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [esi + 0x31c]
call fcn.00453418
mov eax, dword [esi + 0x318]
mov eax, dword [eax + 0x168]
call fcn.004394b4
mov ecx, eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [0x697ec4]
mov eax, dword [eax]
mov eax, dword [eax + 0x320]
call fcn.004606d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x5ad3c6
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dl, 1
mov eax, dword [0x5acbd8]
call fcn.00403e50
mov ebx, eax
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
mov edx, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 4]
call fcn.00404d00
mov byte [ebx + 0x10], 0
mov edx, ebx
mov eax, dword [esi + 0x330]
call fcn.0041ee98
inc dword [ebp - 8]
dec dword [ebp - 0xc]
jne 0x5ad383
mov eax, dword [esi + 0x330]
mov edx, dword [eax + 8]
mov eax, dword [esi + 0x310]
call fcn.00535cf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ad3f7
lea eax, [ebp - 0x10]
call fcn.00404cac
ret
Function at 0x5ad400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ad5f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x328]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
call fcn.00536004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov edx, dword [eax + 0x210]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
call fcn.0053381c
mov eax, dword [ebp - 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00453418
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x318]
mov eax, dword [eax + 0x168]
call fcn.004394b4
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, dword [0x697ec4]
mov eax, dword [eax]
mov eax, dword [eax + 0x320]
call fcn.004606d4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x58]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x5ad5b9
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov dl, 1
mov eax, dword [0x5acc94]
call fcn.00403e50
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x58]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x6980ec]
call fcn.00407364
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
mov eax, 0x5ad60c
call fcn.005c1564
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
add eax, 4
call fcn.00404d00
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, 0x5ad61c
call fcn.005c1564
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
add eax, 0x10
call fcn.00404d00
xor eax, eax
push ebp
push 0x5ad575
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x14]
mov edx, 0x5ad62c
mov eax, 0x5ad638
call fcn.005c1564
mov eax, dword [ebp - 0x28]
call fcn.0051f578
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5ad59c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [ebp - 0x10]
call fcn.0041ee98
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x5ad4c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
call fcn.00535cf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ad5fd
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00404cd0
lea eax, [ebp - 0x14]
call fcn.00404cac
ret