joyce8/EMBER2024-capa huggingface dataset:
Function at 0x543d9d
Capabilities:
Terminate process

Disassembly:
mov eax, 0x6aefa6
call fcn.0066bd6c
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
inc esi
lea ebx, [edi + 0x9c]
push ebx
call fcn.0046a68e
mov eax, dword [edi + 0x98]
cmp eax, esi
je 0x543dd8
cmp eax, 2
je 0x543dd8
cmp eax, 6
jne 0x543dfe
mov ecx, edi
call fcn.00543706
jmp 0x543dfe
push esi
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
je 0x543df1
push 3
pop esi
mov dword [edi + 0x98], esi
jmp 0x543dfe
push 4
pop esi
mov dword [edi + 0x98], 5
and dword [ebp - 4], 0
push ebx
call fcn.0046a7cb
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x544fc2
Capabilities:
Create thread

Disassembly:
mov eax, 0x6c0242
call fcn.0066bd6c
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
je 0x544fe4
mov eax, 0x6fe1cc
mov dword [esi + 4], eax
jmp 0x544fe7
mov eax, dword [esi + 4]
mov dword [esi], method.std::_Facet_base.virtual_4
xor edi, edi
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], 0x6fe194
mov dword [esi + 8], 0x6d706c
mov dword [esi + 0xc], edi
mov eax, dword [esi + 4]
mov dword [esi], 0x6fe1ac
mov dword [esi + 8], 0x6fe1b4
mov dword [ebp - 4], edi
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], 0x6fe1c0
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x94]
mov dword [ecx + esi], eax
lea ecx, [esi + 0x28]
call fcn.00561dec
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 1
call fcn.00561dec
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
push 0x6fe1d4
lea eax, [esi + 0x10]
mov byte [ebp - 4], 4
push eax
mov dword [esi + 0x8c], edi
call fcn.0046a754
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [esi + 0x68], eax
lea eax, [esi + 0x88]
push eax
push edi
push esi
push 0x5453ec
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x6c], eax
mov eax, esi
mov byte [esi + 0x90], 1
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x5450b4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 4], esi
or dword [esi + 8], 0xffffffff
mov dword [esi + 0x14], eax
mov al, byte [ebp + 0xc]
mov byte [esi + 0x18], al
lea eax, [esi + 0x10]
push eax
push ecx
push esi
push 0x545906
push ecx
push ecx
mov dword [esi + 4], ecx
mov dword [esi], 0x6fe1a0
mov byte [esi + 0xc], cl
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 8], eax
mov eax, esi
pop esi
leave
ret 8
Function at 0x558ffc
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x6c148d
call fcn.0066bd6c
sub esp, 0x3c
push esi
push dword [ebp + 0x10]
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.004652a0
test al, al
je 0x559186
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
push eax
mov ecx, esi
call fcn.0055b702
mov ebx, dword [ebp - 0x10]
lea edx, [esi + 0x84]
cmp ebx, dword [edx + 4]
je 0x559052
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edi + ecx*4]
jne 0x559052
inc ecx
cmp ecx, 5
jne 0x559040
test ebx, ebx
jne 0x5590c8
cmp dword [esi + 0xdc], 0x3d0900
jg 0x559184
xor eax, eax
lea edi, [ebp - 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x34], 0
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
and dword [ebp - 0x28], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x48]
push eax
push ebx
lea eax, [ebp - 0x10]
mov ecx, edx
push eax
call fcn.0055728d
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x10]
test edx, edx
je 0x5590ad
mov eax, dword [ebp - 0x2c]
sub eax, edx
and eax, 0xfffffff0
push eax
push edx
call fcn.00427112
mov esi, dword [ebp + 8]
mov edi, ebx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x80
call fcn.0067e315
mov esi, dword [ebp - 0x14]
pop ecx
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x5590d4
mov eax, 0x75c988
push 0x80
push eax
push dword [ebx + 0x20]
call fcn.0067b730
mov eax, dword [ebx + 0x18]
add esp, 0xc
mov ecx, dword [ebx + 0x14]
sub eax, ecx
and dword [ebp + 8], 0
cmp eax, 0x10
jb 0x55913f
xor edi, edi
mov dword [ebp + 0xc], edi
add edi, ecx
lea ecx, [ebp - 0x38]
call fcn.004ccde3
push 6
push edi
lea ecx, [ebp - 0x38]
call fcn.004ccf53
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x38]
push eax
call fcn.004cce17
test al, al
jne 0x559195
mov eax, dword [ebx + 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [ebx + 0x14]
inc edx
mov edi, dword [ebp + 0xc]
sub eax, ecx
add edi, 0x10
sar eax, 4
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edi
cmp edx, eax
jne 0x5590fb
cmp dword [esi + 0xdc], 0x3d0900
jg 0x559184
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push 1
push eax
call fcn.004ccea1
push 0
call fcn.0067f294
mov dword [ebp - 0x1c], eax
mov al, byte [ebp - 0x1e]
and al, 0xfe
mov dword [ebp - 0x18], edx
or al, byte [ebp + 0x14]
pop ecx
mov byte [ebp - 0x1e], al
lea ecx, [ebx + 0x14]
lea eax, [ebp - 0x24]
push eax
call fcn.005573bc
inc dword [esi + 0xdc]
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0x10
push 0
call fcn.0067f294
mov dword [edi + 8], eax
mov al, byte [edi + 6]
and al, 0xfe
mov dword [edi + 0xc], edx
or al, byte [ebp + 0x14]
pop ecx
mov byte [edi + 6], al
jmp 0x559184

Function at 0x559a69
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor ecx, ecx
push esi
mov esi, dword [esp + 8]
mov eax, ecx
xor eax, 3
mov al, byte [eax + edx]
mov byte [ecx + esi], al
inc ecx
cmp ecx, 0x14
jne 0x559a74
pop esi
ret 8
Function at 0x560dcf
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
lea ebx, [edx + 2]
push edi
push 0xa
pop ebp
lea edi, [esi + 4]
mov al, byte [edi - 4]
and al, 7
mov byte [ebx - 2], al
mov eax, dword [edi - 4]
shr eax, 3
and al, 7
mov byte [ebx - 1], al
mov ecx, dword [edi - 4]
shr ecx, 6
and cl, 7
mov byte [ebx], cl
mov al, byte [edi]
and al, 1
shl al, 2
xor al, cl
mov byte [ebx], al
lea ebx, [ebx + 8]
mov eax, dword [edi]
shr eax, 1
and al, 7
mov byte [ebx - 7], al
mov eax, dword [edi]
shr eax, 4
and al, 7
mov byte [ebx - 6], al
mov ecx, dword [edi]
lea edi, [edi + 0xc]
shr ecx, 7
and cl, 7
mov byte [ebx - 5], cl
mov al, byte [edi - 8]
and al, 3
add al, al
xor al, cl
mov byte [ebx - 5], al
mov eax, dword [edi - 8]
shr eax, 2
and al, 7
mov byte [ebx - 4], al
mov eax, dword [edi - 8]
shr eax, 5
and al, 7
mov byte [ebx - 3], al
sub ebp, 1
jne 0x560de4
mov al, byte [esi + 0x78]
and al, 7
mov byte [edx + 0x50], al
mov eax, dword [esi + 0x78]
shr eax, 3
and al, 7
mov byte [edx + 0x51], al
mov ecx, dword [esi + 0x78]
shr ecx, 6
and cl, 7
mov byte [edx + 0x52], cl
mov al, byte [esi + 0x7c]
and al, 1
shl al, 2
xor al, cl
mov byte [edx + 0x52], al
mov eax, dword [esi + 0x7c]
shr eax, 1
and al, 7
mov byte [edx + 0x53], al
mov eax, dword [esi + 0x7c]
shr eax, 4
and al, 7
xor ebx, ebx
mov byte [edx + 0x54], al
mov esi, ebx
mov cl, byte [esi + edx]
add cl, bl
mov al, cl
and cl, 7
sar al, 3
mov bl, cl
add byte [esi + edx + 1], al
shr bl, 2
mov al, bl
shl al, 3
sub cl, al
mov byte [esi + edx], cl
inc esi
cmp esi, 0x54
jl 0x560e9d
add byte [edx + 0x54], bl
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x560ecd
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
xor ecx, ecx
mov edx, ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
mov ebx, 0x700850
mov ebp, ecx
sub ebx, edi
add edx, dword [ebx + edi]
mov esi, dword [edi]
mov al, byte [edi]
sub esi, edx
sub al, dl
shr esi, 0x1f
mov byte [esp + ebp + 0x10], al
lea edi, [edi + 4]
inc ebp
mov edx, esi
cmp ebp, 0x20
jl 0x560ee5
mov edx, dword [esp + 0x34]
dec esi
movzx eax, byte [esp + ecx + 0x10]
xor eax, dword [edx + ecx*4]
and eax, esi
xor dword [edx + ecx*4], eax
inc ecx
cmp ecx, 0x20
jl 0x560f07
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x56cac2
Capabilities:
Encode data using xor

Disassembly:
movzx edx, byte [esp + 0xc]
mov ecx, dword [esp + 4]
neg edx
push esi
mov esi, dword [esp + 0xc]
push edi
push 0x20
sub esi, ecx
pop edi
mov eax, dword [esi + ecx]
xor eax, dword [ecx]
and eax, edx
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x56cad8
pop edi
pop esi
ret 0xc

Function at 0x56caee
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push 0x1e
pop edi
mov ebx, dword [esi + 0x7c]
mov ecx, edi
mov edx, ebx
xor edx, 0x7f
dec edx
shr edx, 0x1f
mov eax, dword [esi + ecx*4]
xor eax, 0xff
dec eax
shr eax, 0x1f
and edx, eax
dec ecx
test ecx, ecx
jg 0x56cb06
mov ecx, 0xec
sub ecx, dword [esi]
shr ecx, 0x1f
and ecx, edx
neg ecx
mov eax, ecx
and eax, 0x7f
sub ebx, eax
movzx eax, cl
mov dword [esi + 0x7c], ebx
sub dword [esi + edi*4], eax
dec edi
test edi, edi
jg 0x56cb34
and ecx, 0xed
sub dword [esi], ecx
pop edi
pop esi
pop ebx
ret 4

Function at 0x56d405
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
and dword [esp], 0
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, esi
mov dword [esp + 0x10], eax
test esi, esi
je 0x56d49c
push ebx
push edi
dec esi
cmp dword [esp + 0x28], 0
mov dword [esp + 0x24], esi
je 0x56d430
call dword [esp + 0x28]
mov esi, dword [esp + 0x10]
xor ebx, ebx
push 8
pop eax
dec eax
mov dword [esp + 0x14], eax
call fcn.00687816
mov edi, eax
jmp 0x56d44a
xor ebp, 1
call fcn.00687816
cmp edi, eax
je 0x56d447
call fcn.00687816
mov edi, eax
call fcn.00687816
cmp edi, eax
jne 0x56d473
xor esi, 1
call fcn.00687816
cmp edi, eax
je 0x56d463
mov dword [esp + 0x10], esi
cmp ebp, esi
je 0x56d43e
mov eax, dword [esp + 0x14]
add ebx, ebx
or ebx, ebp
test eax, eax
jne 0x56d439
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov byte [eax], bl
inc eax
mov dword [esp + 0x20], eax
test esi, esi
jne 0x56d420
mov eax, dword [esp + 0x18]
pop edi
pop ebx
pop esi
pop ebp
add esp, 0xc
ret 0xc

Function at 0x56d576
Capabilities:
Create thread

Disassembly:
call 0x56d576
call 0x56d576
call 0x56d576
call 0x56d576
call 0x56d576
call 0x56d576
call 0x56d576
call 0x56d576
call 0x56d576
call 0x56d576
jmp 0x56d576
push 0
push 0x400
mov dword [0x7feb80], 0
push 0x56d529
mov dword [0x7feb74], 1
call fcn.006879ce
add esp, 0xc
push 0x10
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
mov dword [0x7feb74], 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [0x7feb80]
mov ecx, dword [0x7feb80]
shr eax, 3
xor ecx, eax
mov eax, dword [0x7feb7c]
shr ecx, 3
xor eax, ecx
xor dword [0x7feb80], eax
and dword [0x7feb80], 7
mov eax, dword [0x7feb80]
mov dword [0x7feb7c], eax
mov eax, dword [0x7feb78]
mov ecx, dword [0x7feb80]
shl eax, 3
xor ecx, eax
mov dword [0x7feb78], ecx
mov eax, dword [0x7feb78]
ret

Function at 0x56f322
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
pop ecx
ret
Function at 0x57dacf
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x10], esi
jne 0x57daf7
lea eax, [edi + 0x14]
push eax
push esi
push edi
push 0x57db51
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [edi + 0x10], eax
test eax, eax
jne 0x57daf7
inc esi
jmp 0x57db12
push dword [esp + 0xc]
mov ecx, edi
call fcn.0057b922
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.DLL_SetEvent]
test eax, eax
jne 0x57db12
push 2
pop esi
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x585b33
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x6b7003
call fcn.0066bd6c
push ecx
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.00410204
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.00410204
mov al, byte [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x30], al
mov al, byte [ebp + 0x14]
mov byte [esi + 0x31], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x586eeb
Capabilities:
Access peb ldr_data
Get ntdll base address
Get system information on windows

Disassembly:
mov eax, 0x6c41f0
call fcn.0066bd6c
sub esp, 0x40
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi + 0x28], 0
lea ecx, [esi + 0x30]
mov dword [esi], 0x71f064
mov byte [esi + 0x2c], 1
call fcn.00586ece
and dword [ebp - 4], 0
lea ecx, [esi + 0x38]
call fcn.00457919
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [esi + 8], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
mov dword [esi + 0xc], ecx
push eax
lea eax, [ebp - 0x18]
push eax
push eax
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.DLL_GetProcessTimes]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x14], ecx
mov ecx, dword [ebp - 0x24]
mov dword [esi + 0x18], eax
mov eax, esi
mov dword [esi + 0x1c], ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x588846
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
ret 4
Function at 0x588eda
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
push edi
mov edi, dword [esp + 0x18]
mov dh, byte [edi]
mov al, byte [edi + 4]
test ebx, ebx
je 0x588f32
push ebp
mov ebp, dword [esp + 0x14]
push esi
inc dh
movzx esi, dh
mov dl, byte [esi + edi + 8]
add al, dl
movzx ecx, al
mov byte [esp + 0x1c], al
mov al, byte [ecx + edi + 8]
mov byte [esi + edi + 8], al
mov byte [ecx + edi + 8], dl
mov al, byte [esi + edi + 8]
add al, dl
movzx eax, al
mov al, byte [eax + edi + 8]
xor byte [ebp], al
inc ebp
mov al, byte [esp + 0x1c]
sub ebx, 1
jne 0x588ef8
pop esi
pop ebp
movzx ecx, dh
mov dword [edi], ecx
movzx ecx, al
mov eax, dword [esp + 8]
mov dword [edi + 4], ecx
pop edi
pop ebx
pop ecx
ret 0xc
Function at 0x58a744
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
xor edx, edx
push 3
pop ebp
mov ebx, dword [esp + 0x20]
lea eax, [edi + 2]
div ebp
lea eax, [eax*4 + 1]
cmp dword [ebx], eax
jae 0x58a76f
push 6
mov dword [ebx], eax
pop eax
jmp 0x58a85e
xor edx, edx
mov eax, edi
div ebp
push esi
mov esi, dword [esp + 0x20]
imul ecx, eax, 3
xor eax, eax
test ecx, ecx
je 0x58a7f9
xor edx, edx
lea eax, [ecx - 1]
div ebp
mov edx, dword [esp + 0x18]
mov ebp, dword [0x7a5278]
inc eax
imul ecx, eax, 3
mov ebx, eax
mov dword [esp + 0x10], ecx
movzx ecx, byte [edx]
shr ecx, 2
mov al, byte [ecx + ebp]
mov byte [esi], al
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, ebp
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
movzx ecx, byte [edx + 1]
shr eax, 6
and ecx, 0xf
add eax, ebp
mov al, byte [eax + ecx*4]
mov byte [esi + 2], al
movzx eax, byte [edx + 2]
add edx, 3
and eax, 0x3f
mov al, byte [eax + ebp]
mov byte [esi + 3], al
add esi, 4
sub ebx, 1
jne 0x58a79e
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
jmp 0x58a7fd
mov edx, dword [esp + 0x18]
cmp eax, edi
jae 0x58a852
movzx ebp, byte [edx]
inc eax
mov dword [esp + 0x24], eax
cmp eax, edi
jae 0x58a813
movzx ecx, byte [edx + 1]
jmp 0x58a815
xor ecx, ecx
mov edx, dword [0x7a5278]
mov eax, ebp
shr eax, 2
shl ebp, 4
mov al, byte [eax + edx]
mov byte [esi], al
mov eax, ecx
shr eax, 4
add eax, ebp
and eax, 0x3f
mov al, byte [eax + edx]
mov byte [esi + 1], al
cmp dword [esp + 0x24], edi
jae 0x58a846
and ecx, 0xf
mov al, byte [edx + ecx*4]
jmp 0x58a848
mov al, 0x3d
mov byte [esi + 2], al
mov byte [esi + 3], 0x3d
add esi, 4
mov byte [esi], 0
sub esi, dword [esp + 0x20]
xor eax, eax
mov dword [ebx], esi
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x59165b
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
push esi
push 0
lea eax, [esp + 8]
mov esi, ecx
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x59172e
call fcn.005c6097
test al, al
jne 0x59172e
call fcn.0060170f
cmp eax, 1
je 0x59172e
cmp byte [0x7f6ff5], 0
je 0x5916b6
cmp byte [0x7f7009], 0
je 0x5916b6
cmp byte [esi + 0x60], 0
je 0x5916b6
mov ecx, dword [0x7f8130]
call fcn.005d9922
test al, al
je 0x59172e
cmp byte [0x7f6f8c], 0
push edi
je 0x5916f2
call fcn.00461099
mov edi, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
add edi, 0x1e
adc ecx, 0
cmp ecx, edx
ja 0x5916f2
jb 0x5916db
cmp edi, eax
ja 0x5916f2
cmp byte [esi + 0x5c], 0
je 0x5916f2
inc dword [0x7f7018]
call fcn.00461099
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], edx
cmp byte [0x7f6f8d], 0
je 0x59172d
call fcn.00461099
mov edi, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
add edi, 0x1e
adc ecx, 0
cmp ecx, edx
ja 0x59172d
jb 0x591716
cmp edi, eax
ja 0x59172d
cmp byte [esi + 0x5c], 0
je 0x59172d
inc dword [0x7f7014]
call fcn.00461099
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], edx
pop edi
pop esi
pop ecx
ret

Function at 0x593e5a
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x592bd2
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 4], 2
setle al
leave
ret

Function at 0x593e7a
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push edi
xor edi, edi
push edi
push dword [ebp + 8]
call fcn.0068829a
pop ecx
pop ecx
test eax, eax
je 0x593e9c
xor al, al
jmp 0x593f59
cmp dword [ebp + 0xc], edi
je 0x593f40
push esi
push 0x230
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.0066f070
add esp, 0xc
lea eax, [ebp - 0x230]
mov esi, str.hh.exe
push 0x118
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
add eax, eax
lea ecx, [ebp - 0x230]
sub eax, esi
add ecx, eax
movzx eax, word [esi]
mov word [ecx + esi], ax
lea esi, [esi + 2]
test ax, ax
jne 0x593ede
push dword [ebp + 0xc]
lea eax, [ebp - 0x668]
push dword [ebp + 8]
push str.ms_its:_s::_s
push 0x438
push eax
call fcn.00463afb
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x230]
push eax
push str.Opening_help_file:__S__S
call fcn.00427598
add esp, 0x20
lea eax, [ebp - 0x668]
push 1
push edi
push eax
lea eax, [ebp - 0x230]
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
jmp 0x593f4f
push 1
push edi
push edi
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov al, cl
pop edi
leave
ret 8
Function at 0x5950b1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x10]
push esi
mov esi, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp byte [0x7c0df0], 0
push 0x1bc
push dword [esi + 4]
je 0x5950ee
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x14]
jmp 0x595102
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x10]
lea edx, [esi + 0x9c]
and dword [esi + 0xa0], 0
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0xa4], eax
mov eax, dword [ebp - 4]
sub eax, ecx
mov dword [esi + 0xa8], eax
mov eax, dword [esi + 0x74]
pop esi
test eax, eax
je 0x595139
push edx
push dword [eax + 4]
call fcn.005a3814
leave
ret

Function at 0x5a2153
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 8]
push ebx
push ebp
push esi
push edi
push 5
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov edi, eax
test edi, edi
je 0x5a21b2
push edi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov esi, eax
test esi, esi
je 0x5a21b2
push esi
call dword [sym.imp.KERNEL32.DLL_LockResource]
push edi
push dword [esp + 0x18]
mov ebp, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x1c]
mov ebx, eax
add ecx, ebx
push ecx
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x5a21bb
push esi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
push ebx
push ebp
push edi
call fcn.0066d9b0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x5a21d7
mov dword [eax], ebx
mov eax, edi
jmp 0x5a21b4
Function at 0x5a4761
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x6c5521
call fcn.0066bd6c
sub esp, 0x34
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
xor ecx, ecx
push edi
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x6fe924
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ecx
push eax
mov word [esi + 0x18], cx
call fcn.0047353d
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
jb 0x5a47ad
mov eax, dword [ebp - 0x40]
push 0x726f00
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0046da68
push eax
mov ecx, esi
call fcn.00427394
lea ecx, [ebp - 0x28]
call fcn.0042756c
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x5a47d6
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0047e71e
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
jb 0x5a47ec
mov eax, dword [ebp - 0x28]
push 0x726f08
push eax
call fcn.0067d261
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.004102c8
test edi, edi
je 0x5a482c
push edi
push dword [ebp + 0xc]
mov byte [esi + 0x18], 1
push 1
push dword [ebp + 8]
call fcn.0067d7db
add esp, 0x10
cmp dword [ebp + 0xc], eax
jne 0x5a4825
mov byte [esi + 0x19], 1
push edi
call fcn.0067ccb3
pop ecx
lea ecx, [ebp - 0x40]
call fcn.0042756c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x5a71e5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call section..text
push esi
mov esi, dword [ebp + 0xc]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x5a71f9
sub esi, ecx
mov eax, 0x7d0
sar esi, 1
cmp esi, eax
jl 0x5a7213
mov esi, eax
lea eax, [esi + 1]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x2000]
push eax
call fcn.00428912
add esi, esi
lea edx, [ebp - 0x2000]
mov ecx, 0x726fc0
mov eax, esi
sub eax, ecx
add edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x5a7239
push 0x82d
lea eax, [ebp - 0x1ffa]
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop esi
leave
ret 8

Function at 0x5a7382
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x5a7391
mov eax, dword [esi]
push 0x6df84c
push eax
call fcn.0047e2cd
test al, al
jne 0x5a73b9
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x5a73aa
mov eax, dword [esi]
push 0x6e1a84
push eax
call fcn.0047e2cd
test al, al
je 0x5a73d3
cmp dword [esi + 0x14], 0x10
jb 0x5a73c1
mov esi, dword [esi]
push 1
xor eax, eax
push eax
push eax
push esi
push eax
push dword [esp + 0x20]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
ret 8