joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e98d8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4e98ef
add esp, 0xfffffff0
call fcn.00407e68
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00455448
mov eax, dword [0x54e1b0]
cmp byte [eax], 0
jne 0x4e991c
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x184], al
mov eax, dword [0x54e4d0]
cmp word [eax + 2], 0
jne 0x4e9936
mov eax, dword [0x54e4d0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004ebacc
mov eax, dword [0x54e604]
cmp word [eax + 2], 0
jne 0x4e9950
mov eax, dword [0x54e604]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004ebcd0
mov byte [ebx + 0x39], 0
mov dl, 1
mov eax, dword [0x463e68]
call fcn.00469e68
mov esi, eax
mov dword [ebx + 0x40], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4ec248
mov dl, 1
mov eax, dword [0x43ac28]
call fcn.0040782c
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x43ac28]
call fcn.0040782c
mov dword [ebx + 0xb4], eax
xor eax, eax
mov dword [ebx + 0x64], eax
xor eax, eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x60], 0xff000018
mov dword [ebx + 0x7c], 0x1f4
mov byte [ebx + 0x80], 1
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x78], 0x9c4
mov byte [ebx + 0x8c], 0
mov byte [ebx + 0xa9], 1
mov byte [ebx + 0xc0], 1
mov dl, 1
mov eax, dword [0x468748]
call fcn.004734b4
mov esi, eax
mov dword [ebx + 0xa4], esi
push 0x4e9b34
mov eax, dword [0x54e390]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00473944
mov eax, dword [ebx + 0xa4]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4ec530
mov dl, 1
mov eax, dword [0x43ac28]
call fcn.0040782c
mov dword [ebx + 0x9c], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x54e390]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004235cc
test eax, eax
je 0x4e9a64
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0042337c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004235b0
test eax, eax
je 0x4e9a7c
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x90]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a310
push ebx
push 0x4eb4a4
call fcn.004df490
mov dword [ebx + 0x180], eax
mov byte [ebx + 0xd4], 0
mov eax, dword [0x54e1b0]
cmp byte [eax], 0
jne 0x4e9acd
mov eax, ebx
call fcn.004e9cf4
mov byte [ebx + 0x5d], 1
mov byte [ebx + 0x5e], 1
mov byte [ebx + 0x5f], 1
mov byte [ebx + 0xaa], 1
mov byte [ebx + 0xd5], 0
mov byte [ebx + 0xe0], 0
xor eax, eax
mov dword [ebx + 0xd8], eax
mov byte [ebx + 0xd7], 0
xor eax, eax
mov dword [ebx + 0xac], eax
mov eax, ebx
call fcn.004ec778
mov eax, ebx
call fcn.004ed3a4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4e9b2a
call fcn.00407ec0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ea02c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x4ea0d8
cmp dword [ebx + 0x98], 0
jne 0x4ea0d2
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4e9f64
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x4ea0d2
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4ea098
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4ea0d2
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.00448250
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4ea0a7
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4ea2f8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5542f4]
cmp dword [eax + 0x178], 0
je 0x4ea45d
test bl, bl
jne 0x4ea3ab
cmp dword [esi + 0xa0], 0
jne 0x4ea3a0
mov eax, esi
call fcn.004ed1f4
push eax
push 0x4ea204
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x4ea371
mov eax, dword [0x5542f4]
cmp byte [eax + 0xd7], 0
je 0x4ea371
mov eax, dword [esi + 0xdc]
call fcn.0040b6d0
mov edi, eax
cmp edi, 0
jl 0x4ea371
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ea35a
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ea3a0
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00448250
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ea380
inc dword [esi + 0xa0]
jmp 0x4ea45d
cmp dword [esi + 0xa0], 0
jle 0x4ea45d
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x4ea45d
cmp dword [esi + 0x48], 0
je 0x4ea408
mov eax, dword [0x5542f4]
cmp byte [eax + 0xd7], 0
je 0x4ea408
mov eax, dword [esi + 0xdc]
call fcn.0040b6d0
mov edi, eax
cmp edi, 0
jl 0x4ea408
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ea3f1
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ea437
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00448250
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ea417
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x4dbe30]
call fcn.0040b87c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5015ac
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50170b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x54d500], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x45e1a4]
call fcn.0045f2f0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5016e1
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0045f3d8
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040a310
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x501724
call fcn.0040a4c0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0045f664
test al, al
je 0x5016cb
lea ecx, [ebp - 4]
mov edx, 0x501798
mov eax, dword [ebp - 0xc]
call fcn.0045feec
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042a548
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5016cb
xor edx, edx
push ebp
push 0x5016c4
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5017b0
mov eax, dword [ebp - 8]
push eax
call fcn.00410974
test eax, eax
je 0x5016ad
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x5016ad
call fcn.00501538
test eax, eax
je 0x50169d
mov eax, dword [ebx + 0x50]
jmp 0x5016a0
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x54d500]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5016cb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5016e8
mov eax, dword [ebp - 0xc]
call fcn.0040785c
ret

Function at 0x501814
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x50185b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x50183e
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x50184f
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x50185b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x50ef38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x554388], 0
je 0x50f079
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x54e5c8]
mov edx, dword [edx]
xor al, byte [edx + 0xc0]
je 0x50f079
mov eax, dword [0x55438c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x554388]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x50f048
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x554388]
call fcn.00448250
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x50f040
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1f2], 0
je 0x50f040
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x68]
test al, al
je 0x50f040
mov eax, dword [ebp - 0x14]
call fcn.0051aab8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x50f040
push ebp
call fcn.0050eef4
pop ecx
test al, al
jne 0x50f040
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00407bb8
test al, al
je 0x50f040
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00407bb8
cmp byte [ebp - 1], 0
je 0x50f040
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040f090
test al, al
je 0x50f040
mov edx, dword [ebp - 0x14]
mov eax, dword [0x55438c]
call fcn.0050e654
inc edi
dec ebx
jne 0x50ef9d
mov eax, dword [0x55438c]
cmp dword [eax + 8], 0
jle 0x50f060
mov eax, dword [0x55438c]
call fcn.0050e70c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x50f079
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0050ed5c
pop ecx
test al, al
jne 0x50f079
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001011
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x10001049
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x10001037
mov al, 1
jmp 0x10001093
cmp dword [ebx + 0x54], ecx
jne 0x10001040
mov al, 2
jmp 0x10001093
cmp dword [ebx + 0x7c], ecx
jne 0x10001093
mov al, 3
jmp 0x10001093
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x1000105e
mov al, 4
jmp 0x10001093
cmp ecx, 5
jne 0x1000107e
cmp ebx, 0
jne 0x1000106c
mov al, 5
jmp 0x10001093
cmp ebx, 1
jne 0x10001075
mov al, 6
jmp 0x10001093
cmp ebx, 2
jne 0x1000107e
mov al, 7
jmp 0x10001093
cmp ecx, 6
jne 0x1000108a
cmp ebx, 0
jne 0x1000108c
mov al, 8
jmp 0x10001093
cmp ebx, 1
jne 0x10001093
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003fee
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
jne 0x10004033
push 0x80000005
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x1000401d
mov eax, 0x100092ee
push eax
push 1
mov ebx, 0x194
call fcn.10006530
add esp, 0x10
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], esp
push 0x40
push 0x1000
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10004067
push 6
call fcn.1000572c
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000407e
mov eax, 0
jmp 0x100040c7
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x1000409c
add eax, 8
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x100040bf
push 6
call fcn.1000572c
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x100040c7
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1000413f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push dword [ebp + 0x20]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10004189
push 6
call fcn.1000572c
add esp, 4
mov ebx, dword [ebp + 0x18]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push 0xffffffff
mov ebx, dword [ebp + 0x18]
push dword [ebx]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x100041b7
push 6
call fcn.1000572c
add esp, 4
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
mov ebx, dword [ebp + 0x18]
push dword [ebx]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x100041df
push 6
call fcn.1000572c
add esp, 4
cmp dword [ebp + 0x1c], 0
jne 0x100041fc
mov ebx, dword [ebp + 0x18]
cmp dword [ebx], 0
je 0x100041fc
mov eax, 1
jmp 0x100041fe
xor eax, eax
test eax, eax
je 0x1000422a
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 0x18]
push dword [ebx]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x1000422a
push 6
call fcn.1000572c
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x10004232
mov esp, ebp
pop ebp
ret 0x20
Function at 0x10005052
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x18]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x10005095
push 6
call fcn.1000572c
add esp, 4
jmp 0x1000509a
mov esp, ebp
pop ebp
ret 0x18

Function at 0x10005a50
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
push edi
ja 0x10005ad0
je 0x10005ac1
cmp eax, 0x80000101
ja 0x10005aba
je 0x10005ac1
cmp eax, 0x80000004
je 0x10005a9d
cmp eax, 0x80000005
jne 0x10005ae5
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], 3
test eax, eax
je 0x10005b2b
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x10005b2b
mov ebp, dword [esp + 0x44]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 1
mov ebx, ecx
inc ebx
jmp 0x10005b2b
cmp eax, 0x80000201
jne 0x10005ae5
mov ebx, 4
lea ebp, [esp + 0x44]
mov dword [esp + 0xc], ebx
jmp 0x10005b2b
cmp eax, 0x80000401
je 0x10005b16
cmp eax, 0x80000501
je 0x10005b02
cmp eax, 0x80000601
je 0x10005aee
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
call sub.MSVCRT.dll__ftol
jmp 0x10005b23
fld dword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
call sub.MSVCRT.dll__ftol
jmp 0x10005b23
mov eax, dword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
lea ebp, [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.10006810
mov edi, dword [esp + 0x3c]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x20], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], 0
test edx, edx
je 0x10005c06
test ecx, ecx
je 0x10005c06
inc ecx
push esi
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10005ba8
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10005bfc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10005bf1
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop esi
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10005c20
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.10005880
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x10005c77
push ebx
push edi
call fcn.10005910
push esi
mov ebx, esi
call fcn.10005880
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x10005c4e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x10005c80
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x10005cc1.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x10005cc1.2
jmp dword [eax*4 + 0x10005d4c]
mov word [esp + 0x48], di
jmp 0x10005cfa
mov word [esp + 0x48], 2
jmp 0x10005cfa
mov word [esp + 0x48], 3
jmp 0x10005cfa
mov word [esp + 0x48], 4
jmp 0x10005cfa
mov word [esp + 0x48], 7
jmp 0x10005cfa
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x10005d44
cmp dword [esp + 0x70], edi
je 0x10005d30
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x10005d70
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10005dd9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.10005880
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5cb004]
jne 0x40100a
repz ret
jmp fcn.0040151b

Function at 0x4067a7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5cb004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403d19
and dword [ebp - 0x14], 0
cmp dword [0x5cde80], 0
mov dword [ebp - 0x18], eax
jne 0x40685a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406902
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406902
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x5cde80], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x5cde84], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5cde88], eax
call edi
push eax
call esi
mov dword [0x5cde90], eax
test eax, eax
je 0x40685a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5cde8c], eax
mov eax, dword [0x5cde8c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4068b3
cmp dword [0x5cde90], ecx
je 0x4068b3
push eax
call esi
push dword [0x5cde90]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4068b3
test ebx, ebx
je 0x4068b3
call edi
test eax, eax
je 0x4068aa
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4068aa
test byte [ebp - 8], 1
jne 0x4068b3
or dword [ebp + 0x10], 0x200000
jmp 0x4068e6
mov eax, dword [0x5cde84]
cmp eax, dword [ebp - 0x18]
je 0x4068e6
push eax
call esi
test eax, eax
je 0x4068e6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4068e6
mov eax, dword [0x5cde88]
cmp eax, dword [ebp - 0x18]
je 0x4068e6
push eax
call esi
test eax, eax
je 0x4068e6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5cde80]
call esi
test eax, eax
je 0x406902
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406904
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x5c2640
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x408
mov eax, dword [0x5cb004]
xor eax, esp
mov dword [esp + 0x404], eax
cmp dword [0x20a068c], 0xfc7
jne 0x5c266f
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x5ce3a4]
imul eax, eax, 0x343fd
cmp dword [0x20a068c], 0x139e
mov dword [0x5ce3a4], eax
jne 0x5c269e
mov ecx, dword [esp]
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x5ce3a4]
add eax, 0x269ec3
push esi
mov dword [0x5ce3a4], eax
movzx esi, word [0x5ce3a6]
and esi, 0x7fff
cmp dword [0x20a068c], 0x8e7
jne 0x5c26d3
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, dword [esp + 0x408]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x408
ret

Function at 0x5c27a0
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x5cbec0]
sub esp, 0x14
push ebx
mov ebx, dword [0x20a0030]
push edi
mov edi, dword [0x20a068c]
call fcn.005c26f0
cmp dword [0x20a068c], 0x2f
jne 0x5c27fa
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.005c2720
pop edi
pop ebx
add esp, 0x14
ret