joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5939bc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405130
mov eax, dword [ebp - 8]
call fcn.00405130
mov eax, dword [ebp - 0xc]
call fcn.00405130
mov eax, dword [ebp + 0xc]
call fcn.00405130
xor eax, eax
push ebp
push 0x593a81
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x593a0a
cmp dword [ebp - 4], 0
jne 0x593a13
mov eax, esi
call fcn.00404c80
jmp 0x593a5e
mov eax, 0x1400
call fcn.00402874
mov ebx, eax
mov eax, dword [ebp + 0xc]
call fcn.00405140
push eax
push 0x1400
push ebx
mov eax, dword [ebp - 0xc]
call fcn.00405140
push eax
mov eax, dword [ebp - 8]
call fcn.00405140
push eax
mov eax, dword [ebp - 4]
call fcn.00405140
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, esi
mov edx, ebx
call fcn.00404e78
mov eax, ebx
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x593a88
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ca4
lea eax, [ebp + 0xc]
call fcn.00404c80
ret
Function at 0x5c4374
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
call fcn.00405130
xor eax, eax
push ebp
push 0x5c447c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x178], 0x46464952
mov dword [ebp - 0x174], 0x24
mov dword [ebp - 0x170], 0x45564157
mov dword [ebp - 0x16c], 0x20746d66
mov dword [ebp - 0x168], 0x10
mov word [ebp - 0x164], 1
mov word [ebp - 0x162], bx
mov dword [ebp - 0x160], edi
movzx edx, bx
imul edx, edi
movzx eax, si
shr eax, 3
imul edx, eax
mov dword [ebp - 0x15c], edx
imul bx
mov word [ebp - 0x158], ax
mov word [ebp - 0x156], si
mov dword [ebp - 0x154], 0x61746164
xor eax, eax
mov dword [ebp - 0x150], eax
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14c]
call fcn.004030f8
mov edx, 0x2c
lea eax, [ebp - 0x14c]
call fcn.004037ec
call fcn.004029dc
lea edx, [ebp - 0x178]
lea eax, [ebp - 0x14c]
call fcn.00403938
call fcn.004029dc
lea eax, [ebp - 0x14c]
call fcn.00403268
call fcn.004029dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c4483
lea eax, [ebp + 8]
call fcn.00404c80
ret
Function at 0x5c4b18
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x5c4b20
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5c4cfd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x67c924], 0
jne 0x5c4cda
mov dl, 1
mov eax, dword [0x41c188]
call fcn.00403ec0
mov dword [0x67c924], eax
push 0
lea edx, [ebp - 0x14]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040a5a0
lea eax, [ebp - 0x10]
mov edx, 0x5c4d14
call fcn.00404f48
mov eax, dword [ebp - 0x10]
call fcn.00405140
push eax
call sub.kernel32.dll_CreateDirectoryA
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040a5a0
lea eax, [ebp - 0x1c]
mov edx, 0x5c4d14
call fcn.00404f48
mov eax, dword [ebp - 0x1c]
mov ecx, 1
mov edx, 0x5c4d24
call fcn.005c4990
mov edx, dword [ebp - 0x18]
mov eax, dword [0x67c924]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x67c924]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x5c4c2a
inc eax
mov dword [ebp - 8], eax
xor ebx, ebx
mov al, byte [0x5c4d2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, dword [0x67c924]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov edx, 0x5c4d38
call fcn.0040f7a4
mov ecx, dword [ebp - 0x24]
mov edx, ebx
mov eax, dword [0x67c924]
mov esi, dword [eax]
call dword [esi + 0x20]
inc ebx
dec dword [ebp - 8]
jne 0x5c4bed
mov eax, dword [0x67c924]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
dec eax
test eax, eax
jl 0x5c4cda
inc eax
mov dword [ebp - 8], eax
xor ebx, ebx
lea esi, [ebx + 1]
mov eax, dword [0x67c924]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
sub eax, esi
jl 0x5c4cd0
inc eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x2c]
mov edx, ebx
mov eax, dword [0x67c924]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x2c]
call fcn.00404f40
push eax
lea ecx, [ebp - 0x30]
mov edx, esi
mov eax, dword [0x67c924]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x30]
call fcn.00404f40
pop edx
cmp edx, eax
jge 0x5c4cca
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, dword [0x67c924]
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0x34]
mov edx, esi
mov eax, dword [0x67c924]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x34]
mov edx, ebx
mov eax, dword [0x67c924]
mov edi, dword [eax]
call dword [edi + 0x20]
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [0x67c924]
mov edi, dword [eax]
call dword [edi + 0x20]
inc esi
dec dword [ebp - 0xc]
jne 0x5c4c5a
inc ebx
dec dword [ebp - 8]
jne 0x5c4c44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c4d04
lea eax, [ebp - 0x34]
mov edx, 0xa
call fcn.00404ca4
lea eax, [ebp - 4]
call fcn.00404c80
ret
Function at 0x5c5aa8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5c5ab0
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5c5c5f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5c5c70
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jbe 0x5c5afc
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x5c5afc
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_PostMessageA
mov eax, 0xa
call fcn.0052a444
xor ebx, ebx
lea eax, [ebp - 0xc]
call fcn.005216c0
lea eax, [ebp - 0xc]
mov edx, 0x5c5c84
call fcn.00404f48
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x5c5c98
mov eax, 0x5c5ca8
call fcn.005939bc
cmp dword [ebp - 4], 0
jne 0x5c5b3a
test esi, esi
je 0x5c5c44
dec esi
jne 0x5c5b50
cmp dword [ebp - 4], 0
jne 0x5c5b50
lea eax, [ebp - 4]
mov edx, 0x5c5cb8
call fcn.00404d18
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004094f8
mov edx, dword [ebp - 0x10]
mov eax, 0x5c5ce4
call fcn.00405284
test eax, eax
jle 0x5c5beb
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004094f8
mov edx, dword [ebp - 0x18]
mov eax, 0x5c5ce4
call fcn.00405284
mov edx, eax
add edx, 5
mov ecx, 0x7fffffff
mov eax, dword [ebp - 4]
call fcn.004051a0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
call fcn.0040972c
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004094f8
mov edx, dword [ebp - 0x24]
mov eax, 0x5c5ce4
call fcn.00405284
mov ecx, eax
add ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004051a0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040972c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00404d18
jmp 0x5c5bf3
lea eax, [ebp - 8]
call fcn.00404c80
push 0
push 0x5c5cec
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x5c5c13
push 0x5c5c70
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jbe 0x5c5c1f
push 9
push ebx
call sub.user32.dll_ShowWindow
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00405140
push eax
mov eax, dword [ebp - 4]
call fcn.00405140
push eax
push 0x5c5cf8
push 0
call sub.shell32.dll_ShellExecuteA
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c5c66
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00404ca4
ret

Function at 0x5d2948
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a01ac
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x5d2989
cmp eax, dword [esp]
pop edx
pop eax
ja 0x5d2953
pop esi
pop ebx
ret
pop edx
pop eax
jg 0x5d2953
pop esi
pop ebx
ret
Function at 0x5d3994
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d3b9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [0x4407cc]
call fcn.0040407c
test al, al
je 0x5d3b73
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x238]
call fcn.004094f8
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x238]
call fcn.00404cd4
mov edx, dword [ebx + 0x238]
mov eax, 0x5d3bb4
call fcn.00405284
dec eax
jne 0x5d3a67
lea eax, [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 9
mov eax, dword [ebx + 0x238]
call fcn.004051a0
push 3
push 0
mov eax, dword [ebp - 4]
call fcn.00405140
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040a5a0
lea eax, [ebp - 0x1c]
mov edx, 0x5d3bc8
call fcn.00404f48
mov eax, dword [ebp - 0x1c]
call fcn.00405140
push eax
push 0x5d3bd8
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x5d3b51
mov edx, dword [ebx + 0x238]
mov eax, 0x5d3be8
call fcn.00405284
dec eax
jg 0x5d3aa0
mov edx, dword [ebx + 0x238]
mov eax, 0x5d3bf4
call fcn.00405284
dec eax
jg 0x5d3aa0
mov edx, dword [ebx + 0x238]
mov eax, 0x5d3c04
call fcn.00405284
dec eax
jle 0x5d3b04
cmp dword [0x67cb78], 0
jbe 0x5d3acc
mov eax, dword [ebx + 0x23c]
push eax
mov ecx, dword [ebx + 0x238]
mov dl, 1
mov eax, dword [0x5d1d3c]
call fcn.005e9c9c
call fcn.0049cbe8
jmp 0x5d3b51
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebx + 0x22c]
mov eax, dword [ecx + 0x48]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x4c]
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov dword [ebp - 8], eax
mov ecx, dword [ebx + 0x238]
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.005d3744
jmp 0x5d3b51
cmp dword [0x67cba4], 0
je 0x5d3b1b
mov eax, dword [ebx + 0x24c]
call dword [0x67cba4]
jmp 0x5d3b51
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebx + 0x22c]
mov eax, dword [ecx + 0x48]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x4c]
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov dword [ebp - 8], eax
mov ecx, dword [ebx + 0x238]
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.005d3744
cmp dword [ebx + 0x23c], 0
je 0x5d3b67
lea eax, [ebx + 0x23c]
call fcn.00404c80
jmp 0x5d3b7a
mov eax, 0x5d3c14
call fcn.005d241c
jmp 0x5d3b7a
mov eax, ebx
call fcn.005d3c70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d3ba4
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404ca4
lea eax, [ebp - 4]
call fcn.00404c80
ret
Function at 0x5d5898
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x5d58a0
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405130
mov eax, dword [ebp - 8]
call fcn.00405130
xor eax, eax
push ebp
push 0x5d5ab7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x5d5acc
call fcn.00405284
test eax, eax
jle 0x5d5986
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404d18
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00404d18
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404f40
mov ecx, eax
sub ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.004051a0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.004094f8
mov edx, dword [ebp - 0x14]
mov eax, 0x5d5adc
call fcn.00405284
test eax, eax
jle 0x5d5986
lea edx, [ebp - 0x1c]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0040a5a0
push dword [ebp - 0x18]
push 0x5d5ae8
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.0040a6bc
push dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405000
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00544360
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00404d18
lea eax, [ebp - 0x24]
call fcn.0052173c
mov eax, dword [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0040a6bc
mov ecx, dword [ebp - 0x28]
mov edx, 0x5d5af8
mov eax, 0x5d5b08
call fcn.00523218
lea eax, [ebp - 0x2c]
call fcn.0052173c
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x5d5b18
mov eax, 0x5d5b08
call fcn.00523218
lea eax, [ebp - 0x30]
call fcn.0052173c
mov eax, dword [ebp - 0x30]
push eax
mov ecx, 0x5d5b28
mov edx, 0x5d5b34
mov eax, 0x5d5b08
call fcn.00523218
lea eax, [ebp - 0x34]
call fcn.0052173c
mov eax, dword [ebp - 0x34]
push eax
mov ecx, 0x5d5b44
mov edx, 0x5d5b50
mov eax, 0x5d5b08
call fcn.00523218
lea edx, [ebp - 0x3c]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040a5a0
lea eax, [ebp - 0x38]
mov edx, 0x5d5b60
call fcn.00404f48
mov eax, dword [ebp - 0x38]
call fcn.0040a15c
test al, al
je 0x5d5a84
push 8
push 0
push 0
lea edx, [ebp - 0x44]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.0040a5a0
lea eax, [ebp - 0x40]
mov edx, 0x5d5b60
call fcn.00404f48
mov eax, dword [ebp - 0x40]
call fcn.00405140
push eax
push 0x5d5b70
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x5d5a9c
push 0x40
mov ecx, 0x5d5b78
mov edx, 0x5d5b80
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a04e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d5abe
lea eax, [ebp - 0x44]
mov edx, 0x11
call fcn.00404ca4
ret
Function at 0x5ec604
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x5ec60c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405130
xor eax, eax
push ebp
push 0x5ec733
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0052173c
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x5ec748
mov eax, 0x5ec758
call fcn.00554334
lea eax, [ebp - 0x14]
call fcn.0052173c
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x5ec76c
mov eax, 0x5ec758
call fcn.00554334
mov al, byte [0x5ec774]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x5ec780
mov eax, dword [ebp - 4]
call fcn.0040f7a4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.00404d18
mov al, byte [0x5ec774]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, 0x5ec790
mov eax, dword [ebp - 4]
call fcn.0040f7a4
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00404d18
lea eax, [ebp - 0x20]
call fcn.0052173c
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x5ec7a4
mov eax, 0x5ec758
call fcn.00554418
push 1
push 0
push 0
lea edx, [ebp - 0x28]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0040a5a0
lea eax, [ebp - 0x24]
mov edx, 0x5ec7b8
call fcn.00404f48
mov eax, dword [ebp - 0x24]
call fcn.00405140
push eax
push 0x5ec7c8
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ec73a
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00404ca4
ret
Function at 0x5fe8e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a01ac
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x5fe925
cmp eax, dword [esp]
pop edx
pop eax
ja 0x5fe8ef
pop esi
pop ebx
ret
pop edx
pop eax
jg 0x5fe8ef
pop esi
pop ebx
ret

Function at 0x605dd4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor esi, esi
push eax
push 0
push 0x100001
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push esi
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
pop esi
pop ebx
ret

Function at 0x605dd9
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor esi, esi
push eax
push 0
push 0x100001
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push esi
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
pop esi
pop ebx
ret
Function at 0x61d9dc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x61d9e4
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x61dc1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1ec]
cmp eax, 1
jne 0x61da9c
lea eax, [ebp - 4]
push eax
mov edx, dword [ebx + 0x1cc]
mov eax, 0x61dc34
call fcn.00405284
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebx + 0x1cc]
call fcn.004051a0
lea eax, [ebp - 8]
push eax
mov edx, dword [ebx + 0x1cc]
mov eax, 0x61dc34
call fcn.00405284
mov edx, eax
inc edx
mov ecx, 0x1e
mov eax, dword [ebx + 0x1cc]
call fcn.004051a0
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x61dc34
call fcn.00405284
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004051a0
push esi
mov eax, dword [ebx + 0x1f0]
push eax
mov ecx, dword [ebx + 0x1ac]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00637ee8
jmp 0x61dbdf
test eax, eax
jne 0x61dabd
mov eax, dword [ebx + 4]
mov edx, dword [0x604624]
call fcn.004040a0
mov ecx, esi
mov edx, dword [ebx + 0xc]
call fcn.0063684c
jmp 0x61dbdf
cmp eax, 7
jne 0x61dad0
mov edx, esi
mov eax, ebx
call fcn.0061d730
jmp 0x61dbdf
cmp eax, 8
jne 0x61dbdf
mov eax, ebx
call fcn.0061ffa8
test esi, esi
je 0x61db5e
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0x1f0]
call fcn.0040a5a0
push dword [ebp - 0x24]
push dword [ebx + 0x210]
push 0x61dc40
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405000
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405140
push eax
mov eax, dword [ebx + 0x1f0]
call fcn.00405140
push eax
call sub.kernel32.dll_CopyFileA
call fcn.00580c00
test eax, eax
je 0x61db43
mov ecx, 1
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.006058b0
jmp 0x61db51
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.0058f340
mov eax, dword [ebp - 0xc]
call fcn.0040a450
jmp 0x61dbdf
cmp dword [ebx + 0x1d4], 0
jne 0x61db6e
mov eax, ebx
call fcn.0063adec
mov eax, dword [ebx + 0x1d4]
test eax, eax
je 0x61dbdf
xor edx, edx
call fcn.0053b8fc
push 0x61dc48
lea edx, [ebp - 0x34]
mov eax, dword [ebx + 0x1d4]
call fcn.0053bb30
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00411e1c
add esp, 0xc
push 0x61dc58
push 0x61dc68
push 0x61dc48
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00411e1c
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00411e1c
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push 0
call fcn.00411e1c
add esp, 0xc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61dc24
lea eax, [ebp - 0x54]
mov edx, dword [0x401160]
mov ecx, 3
call fcn.00405754
lea eax, [ebp - 0x24]
call fcn.00404c80
lea eax, [ebp - 0x20]
call fcn.00411e14
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ca4
ret
Function at 0x63adec
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63af39
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x63ae2a
call fcn.00403ef0
mov eax, 0xa
call fcn.0052a444
xor eax, eax
mov dword [ebx + 0x170], eax
cmp dword [ebx + 0x1d4], 0
jne 0x63af23
mov eax, ebx
call fcn.0061ffa8
cmp dword [ebx + 0x1a0], 0
je 0x63af23
cmp dword [ebx + 0x1e8], 0
jne 0x63aea9
mov eax, ebx
call fcn.0063ad50
test eax, eax
je 0x63aea9
mov al, byte [0x63af48]
push eax
lea eax, [ebp - 4]
push eax
mov ecx, 0x63af54
mov edx, 0x63af64
mov eax, dword [ebx + 0x1f0]
call fcn.0040f7a4
push 0
mov eax, dword [ebp - 4]
call fcn.00405140
push eax
mov eax, dword [ebx + 0x1f0]
call fcn.00405140
push eax
call sub.kernel32.dll_CopyFileA
mov edx, 0x63af74
mov eax, dword [ebp - 4]
call fcn.0058f3d0
jmp 0x63af23
mov eax, dword [ebx + 0x4c]
sub eax, dword [0x681adc]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebx + 0x48]
sub ecx, dword [0x681ad8]
mov edx, dword [0x681adc]
mov eax, dword [0x681ad8]
call fcn.0041cd1c
mov eax, dword [ebx + 0x44]
push eax
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.user32.dll_OffsetRect
mov eax, dword [ebx + 0x1f0]
push eax
xor ecx, ecx
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x30]
call fcn.00606964
mov esi, eax
mov dword [ebx + 0x1d4], esi
test esi, esi
je 0x63af23
lea eax, [esi + 0x80]
mov edx, dword [ebx + 0x1cc]
call fcn.00404cd4
mov edx, dword [ebx + 0x1f0]
mov eax, dword [ebx + 0x1d4]
call fcn.0047f338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63af40
lea eax, [ebp - 4]
call fcn.00404c80
ret
Function at 0x63edf0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405130
xor eax, eax
push ebp
push 0x63f01f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x63f038
call fcn.00405284
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004051a0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x63f038
call fcn.00405284
mov edx, eax
inc edx
mov ecx, 0xa
mov eax, dword [ebp - 4]
call fcn.004051a0
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x63f038
call fcn.00405284
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004051a0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x520c78]
call fcn.00523f8c
mov ebx, eax
push 0x63f044
push dword [ebp - 8]
push 0x63f084
push dword [ebp - 0xc]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00405000
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x248]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call fcn.00524f10
xor edx, edx
mov eax, dword [ebx + 0x30]
call fcn.004b2d38
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, 1
mov eax, dword [ebx + 0x30]
call fcn.004b2d38
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, ebx
call fcn.004bcf30
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 4]
mov edx, dword [ebp - 0x14]
mov eax, 0x63f098
call fcn.00405284
dec eax
jne 0x63ef68
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x7fffffff
mov edx, 8
mov eax, dword [ebp - 0x14]
call fcn.004051a0
push dword [0x681a94]
push dword [ebp - 0x10]
push 0x63f0a8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405000
mov eax, 0x63f0b8
call fcn.00521648
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.005229a8
xor eax, eax
call fcn.00521648
mov edx, 0x63f0cc
mov eax, dword [ebp - 0xc]
call fcn.0058f3d0
or edi, 0xffffffff
jmp 0x63f004
cmp dword [ebp - 0x10], 0
je 0x63f004
push 0
mov ecx, dword [0x67d730]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x495cc8]
call fcn.00498a54
mov ebx, eax
mov edx, 9
mov eax, dword [ebx + 0x68]
call fcn.0042a5c0
mov edx, 0x63f0d8
mov eax, dword [ebx + 0x68]
call fcn.0042a548
mov dl, 2
mov eax, ebx
call fcn.0049a7cc
push 0x63f0e8
push dword [ebp - 8]
push 0x63f0f4
push dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00405000
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov ecx, ebx
mov dl, 1
mov eax, dword [0x604624]
call fcn.00621014
mov esi, eax
mov eax, esi
call fcn.00629d08
mov edx, 0x64
mov eax, esi
call fcn.00639d88
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xec]
mov eax, ebx
call fcn.00403ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63f026
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404ca4
ret